Tor Browser 6.0.5 is released

Georg, you are quoted in a rather terrifying story about a critical flaw affecting both TB and Tails version of TB:

http://www.theregister.co.uk/2016/09/18/mozilla_tor_flaws/
Mozilla will patch zero-day Firefox bug to fiddle man-in-the-middle diddle
Researcher revealed Tor flaw after initially being ignored
Darren Pauli
18 Sep 2016

> Mozilla will patch a flaw in its Firefox browser that could allow well-resourced attackers to launch man-in-the-middle impersonation attacks that also affects the Tor anonymity network. The flaw was first noticed by researchers describing the attacks against Tor ahead of the publication of a patch in version 6.0.5. "That vulnerability allows an attacker who is able to obtain a valid certificate for addons.mozilla.org to impersonate Mozilla's servers and to deliver a malicious extension update," Tor developer Georg Koppen says. "This could lead to arbitrary code execution. Moreover, other built-in certificate pinnings are affected as well. Obtaining such a certificate is not an easy task, but it's within reach of powerful adversaries such as nation states."

The attack was reported by a researcher who goes by Movrcx:

> The need to obtain a legitimate TLS certificate for addons.mozilla.org was the cause of the high cost of entry to the attack, something Movrcx says was "difficult to accomplish but not impossible. This attack enables arbitrary remote code execution against users accessing specific clearnet resources when used in combination with a targeting mechanism; such as by passively monitoring exit node traffic for traffic destined for specific clearnet resources," he wrote. "Additionally this attack enables an attacker to conduct exploitation at a massive scale against all Tor Browser users and to move towards implantation after selected criteria are met - such as an installed language pack, public IP address, DNS cache, stored cookie, stored web history, and so on."

(For those who have forgotten, some years ago a hacker (apparently living in Iran) was able to obtain the crown jewel of certificates, a genuine certificate claiming that he was wildcard at google.com. That deplorable incident was well handled by Mozilla.org, but that was some time ago and Mozilla's priorities may have changed.)

Disturbingly, Movrcx adds

> members of the Tor Project did not accept his initial private disclosure.

He gives more detail here:

https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at…
Tor Browser Exposed: Anti-Privacy Implantation at Mass Scale
Credit: @Ox000000

> The combination of chaining the vulnerabilities described below allows a malicious exit node operator or global adversary to conduct a silent remote code execution attack on all platforms of the Tor Browser. This attack is not limited to just being hypothetical in nature and evidence shows that this attack has already been possible for a number of years. The list of vulnerable deployments to this attack includes the native Tor Browser for Windows, Linux, OSX and also includes Tor Browser installations on dedicated operating systems such as Tails and Whonix.

Concerning TP ignoring his warnings, he says:

> This vulnerability was originally described publicly in concept before the initial confirmation of the feasibility of the attack. Reaction to the theoretical disclosure was mocked as non-credible by Micah Lee and Andrea Shepard.

This seems indefensible, given that Movrcx had proven that the attack works and that Tor users were attempting to post warnings to this blog (which mysteriously never appeared) that an attack appeared to be in progress which possibly involved certificates.

[boklm:]

> There was a reboot of the server hosting the blog today, and for some reason the comments on recent blog posts disappeared.

S--t happens, I know that. But this deletion just seems much too convenient for USG interests. Maybe someone made a mistake accidentally on purpose. Or maybe current or former members of NSA/TAO intruded into the server (they certainly have the motive, means, and opportunity) and deleted the posts, making sure to time the deletion and to leave other misleading clues to encourage you to assume that the "accidental" deletion was due to an intermittent bug which happened to pop up during the reboot, a bug whose appearance is too rare to be worth trying to isolate and fix.

Well, NSA/TAO is not too rare. TP is a high priority target for them, there can be little doubt of that. And I say again, you have to worry not only about current members of NSA/TAO but a steadily growing number of "alumni" who are now working for effects-for-hire companies or even worse, for Comcast. (Seriously-- I could name names but then this post would be censored, eh?)

[gk:]

> We have not been censoring comments.

Well, my warnings about a mystery node with all zeros nickname--- was that Morcvx's testing the method?-- which never completes any circuits, whose appearance in Onion Circuits seems to be associated with the AdBlock Plus (not NoScript) updater running in Tails TB never appeared in the blog. My posts asking if others were seeing the same suspicious certificates I have been seeing never appeared. My posts asking whether it might be possible to persuade news sites likely to be attacked by sophisticated well-funded attackers, such as theintercept.com, to use onion services as a way to (as I understand it) avoid the problems with CAs, especially root CAs trusted by TB which are issued to extremely repressive governments or their FVEY-based contractors.

I believe that *you* believe TP is not censoring anyone here, but I fear that there is so much political pressure being put on Shari by FBI, USIC that someone else might see deleting or censoring posts which are too critical of the USG to be the lesser of two evils, compared to USG suddenly arresting every US TP employee and effectively finishing off the Project.

More and more I must conclude that the USA is not a safe home for TP and the whole kit and kaboodle, especially critical keyrings, should relocate to a safer place (maybe Iceland or Norway?).

I have already concluded we should not trust Roger's judgment (he apparently hired CIA agent David Chasteen to write code), and if there is any fire behind the veil of smoke covering up the firing of Jacob A, he too may have shown a lack of judgment in how our enemies would exploit his personal life to harm the Project.

And now I have to question Andrea's judgment. And even that of Micah Lee. Who's left? You and a few others who never write anything in the blog.

I've been trying hard to be supportive of the Shari regime but she's certainly not making it easy right now by remaining silent on so many critical issues, such as the question of whether or not TP supports a pardon for Edward Snowden, or what TP is doing to counter the dangerous demands for backdoors and free hacking powers--- not to mention the smearing of Snowden and the entire Tor community--- by FBI Director James Comey.

Georg, please, please, please, post a blog about the attack described by Movrcx and whether or not it can be mitigated. The new edition of Tails is due tomorrow but I don't know whether it will be delayed because of the emergency.