{"id":113257,"date":"2024-01-31T01:41:06","date_gmt":"2024-01-30T23:41:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor"},"modified":"2024-01-31T01:41:06","modified_gmt":"2024-01-30T23:41:06","slug":"rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/rezultaty-vtorogo-audita-bezopasnosti-razrabotok-proekta-tor","title":{"rendered":"Results of the second security audit of Tor Project developments","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the anonymous Tor network published the results of the second audit conducted by Radically Open Security from April to August 2023 (the first audit was carried out by Cure53 from November 2022 to April 2023). The review focused on the code that ensures the operation of exit nodes, the Tor Browser, infrastructure components (metric collection, SWBS, Onionoo API), and testing utilities. The primary goal of the re-evaluation was to assess the changes made to increase the speed and reliability of the Tor network, such as the traffic-splitting protocol Conflux added in the Tor 0.4.8 release and methods to protect Onion services from DoS attacks based on proof of work. <\/p>\n
The audit identified 17 vulnerabilities, only one of which was classified as critical. Four vulnerabilities were rated as medium severity, while 12 were categorized as minor issues. The most critical vulnerability was found in the onbasca application (Onion Bandwidth Scanner), used for scanning the bandwidth of network nodes. <\/p>\n
The vulnerability is caused by the ability to send requests via the HTTP GET method, which allows for the substitution of cross-site requests on behalf of another user (CSRF, Cross-Site Request Forgery). This gives an attacker the opportunity to add their bridge nodes to the database by manipulating the parameter 'bridge_lines'. For example, an attacker could host a web page with JavaScript code fetch('http:\/\/127.0.0.1:8000\/bridge-state\/?bridge_lines=obfs4+0.0.0.000000+AAA+cert0+iat-mode0', and if a user with an active session to the Onion Bandwidth Scanner opens this page, the IP '0.0.0.0' will be added to the database on their behalf. <\/p>\n
Medium severity issues: <\/p>\n
\n
Denial of service in metrics-lib through the transmission of a large compressed file \u2014 since the file is unpacked into memory, one could send a zip bomb (for example, packing 600 MB of zeros into 0.0006 MB) and cause exhaustion of available memory.\n
Use in tor-android-service (used in the Tor browser for Android) of the discontinued third-party module tun2socks.\n
Writing a null byte beyond the allocated buffer in the Tor client due to the use of the read_file_to_str_until_eof function, which returns the size without counting the null character.\n
A vulnerability in sbws (Simple Bandwidth Scanner) allows rolling back an HTTPS connection to HTTP using a redirect to HTTP. A Tor exit node controlled by an attacker could potentially exploit this vulnerability to leak API tokens. <\/ul>\n