2

https://threatpost.com/serious-tcp-bug-in-linux-systems-allows-traffic-hijacking/119804/

http://fossbytes.com/linux-distribution-hackable-serious-tcp-bug-report/

I am not clear on how this TCP news affects Tor users. I understand it allows an attacker to inject malicious code into a TCP stream but can someone try explaining:

  • What we can do to protect ourselves as VPN/Tor users?
  • Should this be considered a major threat to every day Tor users?
  • Who is actually capable of executing such an attack? Anyone on the network? Global adversaries?

cheers

3
  1. What we can do to protect ourselves as VPN/Tor users?
    • Note that the attack itself is targeted at the service, not the client (I.E. tor relay, not the tor client) so there isn't much you can do. If you run a relay then patch when it's available, in the mean time Akamai suggest increasing the net.ipv4.tcp_challenge_ack_limit to a value high enough that someone trying to reach and maintain the limit could not feasibly do so.
  2. Should this be considered a major threat to every day Tor users?
    • Outside of being simply an oracle to determine if Alice has a connection to Bob's public service, it could be used as a sniper attack. Since Tor is using TLS the Man-on-the-Side injection attack wouldn't be feasible (they could inject data but it would fail cryptographic authentication), only tearing down the connection would. The sniper attack can be performed through other means (as outlined in the paper) already.
  3. Who is actually capable of executing such an attack? Anyone on the network? Global adversaries?
    • Anyone on the internet who can spoof IP traffic as the client to the server and simultaneously hold open their own connection to the target server (and count to 100 ;)).

The paper itself is available at this link.

2

Tor developer Isis Agora Lovecruft has published a blog post on this.

CVE-2016-5696 and its effects on Tor

tl;dr: This vulnerability is quite serious, but it doesn’t affect the Tor network any more than it affects the rest of the internet. In particular, the Tor-specific attacks mentioned in the paper will not work as described.

https://blog.patternsinthevoid.net/cve-2016-5696-and-its-effects-on-tor.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.