21 ÐÐÐÐÑÑ 2014 Ð. 10:13:54 ÐÐÐÑÐÐÐÐÑÐÐÑ Mike Cardwell (tor@xxxxxxxxxxxxxxxxxx) ÐÐÐÐÑÐÐ: If you can use XMLHttpRequest to perform a request against a machine on your LAN that isn't using CORS, and then read the response, then there is a bug, and you will get a healthily sized cheque from Google or Mozilla for reporting it to them. If you can't read the response then there isn't a bug. What you're seeing is: how the web works.
Hi ALL, First of all, i would say i am a practician in the matter of testing. What we have: 1. OS: Windows (i think all others can be included) 2. App: Tor Browser Bundle 3.5 (Firefox 24.2.0 in it) with default settings 3. Some WWW web-site (not local file:// scheme) it can be ANY other web-site that you visit by Tor 4. This web-site can access to LAN resources by sending query to http://127.0.0.1:port and GET THE ANSWER from application that listen to that port! Not matter how it listen on 127.0.0.1 or 0.0.0.0(ALL interfaces). With some conditions: a. Application is set to accept connections from loopback interface (127.0.0.1) by system firewall rules. For some firewalls there is no necessity to have allowing rules for that. And any application can LISTEN on 127.0.0.1 without any alerts from system firewall. This is really a potentialy hole! b. Application decides to answer or not to that query. If it will be a standard web-server it can reject these queries by examination the Origin header. If application don't pay attention to the HTTP headers it will answer to the query. This can reduce the degree of problem but don't exclude it at all. For example it can be a very hidden malware that not detected by antivirus and it will be enable to invisibly communicate with it's "second part" when you visit some web-sites because it doesn't need in allowing rules in system firewall. Unbelievable scenario? :) but it can be! You can test such scenario manually: just create a simple app that listens on 127.0.0.1:7777 or any other port more than 1024, accepts connections and makes a simple answer, you will see this answer on http://tortestprivacy.url.ph/ when you will scan 7777 port. I think it is better and simple to prohibit access to LAN resources by turning on ABE of NoScript Add-ON by default. It's worth saying if you set the rules in your system firewall for Tor's Firefox to allow queries only for 9150 and 9151 ports(default settings) this also will close the hole. But if we need for Tor's Firefox connections to loopback interface by default, very often people open ALL ports of loopback interface, not only necessary ports. -- Regards, TT Security -- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk