[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default

To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
From: Max Jakob Maass <max@xxxxxxxxxxxxx>
Date: Tue, 21 Jan 2014 16:02:45 +0100
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 21 Jan 2014 10:12:52 -0500
Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; t=1390316565; l=1976; s=domk; d=velcommuta.de; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:References: Subject:To:MIME-Version:From:Date:X-RZG-CLASS-ID:X-RZG-AUTH; bh=5n5CwP+ViKUKdvDfeUzwZHb+y6I=; b=daizPxUy3cYMdV4lM1hLl79jMZM2D1Vb1Q6kVdFuUuqfB3cENURyPcWO20OCngXXGk9 5NhBHbEIgL52p+su3Hy9oPOLCKXX1UZA+1y2CuC8kaL6cuvKHy3WeSJnXKJGpS3Q9w7Le WZiwJJ7xOZFqfTvUlK1yMIVGCm+OqDdb+dQ=
In-reply-to: <52DE89F3.1080208@xxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-id: "all discussion about theory, design, and development of Onion Routing" <tor-talk.lists.torproject.org>
List-post: <mailto:tor-talk@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
Openpgp: url=http://verify.velcommuta.de/gpg/3408825E.asc
References: <1390277171.428385.27196.8353@xxxxxxxxxxxxxxx> <52DE4C43.1060109@xxxxxxxxx> <52DE5C45.3030107@xxxxxxxxxx> <52DE658D.10809@xxxxxxxxxxxxx> <52DE87FF.50507@xxxxxxxxxx> <52DE89F3.1080208@xxxxxxxxxxxxx>
Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-talk" <tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx>
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 21.01.2014 15:53, Max Jakob Maass wrote:
>> Also, it'd be nice if http://tortestprivacy.url.ph/ would allow 
>> tweaking the full URL (rather than just port number) for public 
>> testing purposes. Could you perhaps help with that, TT Security? 
>> :)
> I'm not TT Security, but you can use my version: 
> http://62.141.42.149/test.php
> 
> It's not very pretty, but it is only a minor modification of the 
> original that includes this ability.
> 
I'm also hosting it as a hidden service, to see if that makes any
difference. If you want to test it:
http://ehlznccisf5mnhw2.onion/test.php

My results were: It makes no difference. Tor rejects local addresses
that are not 127.0.0.1, even the IP of my machine, with the log
message "[warn] Rejecting SOCKS request for anonymous connection to
private address [scrubbed].".

Have fun playing around with it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQJ8BAEBCgBmBQJS3owPXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ4NEM0ODA5N0EzQUY3RDU1MTg5QTc3QUMx
NjlGOTYyNDM0MDg4MjVFAAoJEBafliQ0CIJe1lcP/0x63I4xzb+9YjsjCLikd5UU
TlGTs7hmxJbPhXU7Q45XYnr0NbROlcT6cnV+9NlAlhxwmQ19lNsCZ00B/Zg5Jtjv
ah9ofpYoVK+a2YtcrgXgkDSJ/CwQC2it3V/Q4pu8Ile+TzlmkiQKl0xvLVVEmN3N
8HYsoMNA9VrhZmoXGUAHTX+6gytfvOmOhPf8tLr8/R+/d4LTQzibKCnBUOLyQ0F5
ZpZo8Aq2kLyHHeovqPA5xT6HHIJLltsqOUtQiR1M2PJ0iCus+VZVqXiQB+4no/gU
zDs0SfK1ITZ2ruiEf6R+P2xwc4YjusfP8HG399OQmCbMPc1r+Ugj81e1iNx79xIt
QF7NGJkqhsw88R5Hno16450q2sE56HkrRDA5MPcXJuyHPfNzFGgauS84Vjo/7/LF
tkwwFV6n5A0TjzNFz2aX4VsCXOLEFLcGLfufKCcwBkmTJ+TrffNhtedjFYqo+N0+
kJAMsi/N2+rKvMMF+ZDNVoCZRjFJcO/4tMoqpHy8KZ+Bb/IQTloHGzzOq1gDHGpf
60QUdvCQQ26i5OxENpkHCYa2IkG4TqONy54c9Bp+hCtuxGRrGmB1KJ53ALMXNeBf
vLlFspdDz4GbqeT8K38iQUlJyzrtPlN9IMnBcx6QXmDbb00gWP8Qeip7oyj+dHNr
2SNpqz5HHwZGnvR6uUr7
=a1zp
-----END PGP SIGNATURE-----
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

Follow-Ups:
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Olivier Cornu

References:
- [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: TT Security
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Yuri
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Olivier Cornu
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Max Jakob Maass
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Olivier Cornu
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Max Jakob Maass

Prev by Author: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Next by Author: Re: [tor-talk] Businesses blocking Tor access
Previous by thread: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Next by thread: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Index(es):
- Author
- Thread