Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vulnerability]

The tag has no usage guidance.

13
votes
3answers
726 views

Are there any vulnerabilities in the process of onion routing?

In onion routing, messages are repeatedly encrypted and then sent through several network nodes called onion routers. Each onion router removes a layer of encryption to uncover routing instructions, ...
7
votes
1answer
228 views

Tor historical vulnerabilities list

Is there a compiled list of all discovered and fixed Tor vulnerabilities from the time of its creation until now? I am looking for something like this list for open-ssl https://www.openssl.org/news/...
7
votes
3answers
1k views

How can website fingerprinting be prevented?

Recent research [PDF] has shown that website fingerprinting works with Tor. Website fingerprinting = Determine what website is visited based on certain characteristics even when encryption is applied....
2
votes
3answers
192 views

TAILS: “Probable” information leakage

From https://tails.boum.org/security/index.en.html : Probable holes Until an audit of the bundled network applications is done, information leakages at the protocol level should be considered as ...
2
votes
2answers
173 views

Equation: The Death Star of Malware Galaxy, How much does it compromise Tails?

Equation: The Death Star of Malware Galaxy https://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/ reported to compromise the firmware of hard drive and reprogram the ...
1
vote
1answer
3k views

Why is the “administrator” password not saved in Tails?

I can use any password to be administrator for each particular session [as long as I type it twice], at Tails boot. That seems like a g a p i n g security hole if an adversary were to get/have access ...
1
vote
1answer
239 views

Malicious hidden service directories [closed]

https://nakedsecurity.sophos.com/2016/09/07/can-you-trust-tors-hidden-service-directories/ if the descriptor ID is predictable, how easy is to muscle into the positions in the list just above a ...
1
vote
1answer
435 views

Orbot, Tor identities and changing network connectivity paths

I've been thinking about a potential vulnerability that in certain cases may make it possible to identify a Tor client. Say a malicious entry node establishes a connection with an Orbot client. This ...
1
vote
2answers
115 views

How vulnerable would Tor users be if a single entity controlled a large number of nodes?

There 4626 relays online. What is stopping a single entity from adding, say, 9000 relays to the network around the world so they can occasionally watch bits of the network? If the cost of this is ...
1
vote
1answer
91 views

End-to-End Attack Collecting Information Using SIGINT: How Is It Done?

I'm reviewing the documents filtered by Snowden related to Tor. Two documents in particular, entitled "A potential technique to deanonymise users of the TOR network (proposal)" and "A potential ...
1
vote
0answers
73 views

Are there known vulnerabilities in JonDo's custom Tor client?

The JonDo client includes an option for accessing the Tor network. Given some of the features (excerpted below) it seems to use a custom Tor client. Are there known vulnerabilities? JonDo has Tor ...
0
votes
2answers
1k views

Do vulnerabilities exist in Tor Browser Bundle

This site: http://www.hongkiat.com/blog/do-donts-tor-network/ claims that Tor Browser Bundle should not be used to protect one’s online privacy and security. FBI’s recent takedown of Freedom ...
0
votes
1answer
166 views

How could Tor be cracked? [closed]

I've heard that government agencies et al. have not been able to crack Tor. Why have they been unable? What would one have to do to crack Tor? Are there any Tor "stress tests"?
0
votes
1answer
76 views

Effects of CVE-2017-9445?

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9445 http://openwall.com/lists/oss-security/2017/06/27/8 https://www.ubuntu.com/usn/usn-3341-1/ What does this mean for tor browser users? How ...
0
votes
2answers
90 views

Is Tails affected by the GnuTLS Hello Vulnerability (CVE-2014-3466) ? If so, how?

There are reports that many Linux systems are compromised by a recent critical GnuTLS issue. Is Tails affected by this?
0
votes
1answer
30 views

How to check for Spectre vulnerabilities and similar threats for my relay to be secure?

Setup I'm running my new (2 days old) relay using: my own dedicated server Dell T20 with hardware: CPU: Intel Xeon E3-1225 v3 @ 3.20GHz (Haswell) RAM: 32 GB DDR3 ECC NET: overall maximum bandwidth ...
0
votes
1answer
146 views

How secure is Tor? Can Tor's traffic be monitored by an attacker?

In the first episode of the first season of Mr.Robot, Elliot is able to monitor Rohit's traffic even though he was using Tor and .onion sites. How did Elliot do that? Would it be possible to do that ...
0
votes
1answer
57 views

Old Tor users can affect my HS?

Lets say a user is using a Tor version from 2013 and decides to connect to my HS that has the latest Tor client. Since the user has an old version of Tor, can the vulns in the Tor version reveal my IP?...