[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #18513 [Tor Browser]: New Identity bypass
#18513: New Identity bypass
-----------------------------+----------------------
Reporter: tahuttun | Owner: tbb-team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Tor Browser | Version:
Severity: Major | Keywords:
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
-----------------------------+----------------------
The "new identity" bypass requires no JS and works with highest private
and security level that Tor Browser has! The attack works because favicon
cache is not truncated. An attacker may spread unique tokens as part of
the favicon addressess.
The new identity may be traced to the old one, since we know which token
is given to which user and have ability to test if the user has the exact
token (use token once, mark it as used and generate more if required).
Furthermore, because the favicon connection is not closed when the "new
identity" is ran we have also the knowledge that the tor browser is still
open. Favicons are flushed when browser is closed.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18513>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs