Tor Freedom Host compromised, JS injected into multiple sites

http://pastebin.com/pmGEj9bV

by coolnow • 13 years ago

129 42 13 years ago

pastebin.com

mixmax• 13 years ago

It seems that the JS is checking for firefox and then opening an iframe, which presumably holds some more JS.

Anyone know what that might be, and who has compromised freedom host?

coolnow2• 13 years ago

The IP that's hosting the iframe is a Verizon Business one. The JS also looks to be setting a cookie, probably for identification purposes (reading the cookie from another site to confirm the user?). I'm not sure that's the case because once the Tor Bundle is closed, cookies are automatically deleted.

tmbeihl7• 13 years ago

The cookie is set to expire after 30 minutes

nilved• 13 years ago

Cookies can't be read by other sites, can they?

vitaltao• 13 years ago

I wonder who could've done it..

jevinskie• 13 years ago

Are you implying it is the NSA? If so, please state so and why you believe that. Otherwise this comment adds nothing to the discussion.

mischanix• 13 years ago

Funnily enough the IP address in the iframe location is in a /11 formerly belonging to D.C.-headquartered MCI Communications, now under Verizon, and traceroute points to it being in D.C. as well.

This could be faked, but it's interesting on its own.

coolnow2• 13 years ago

Probably because they have a hard-on for snooping and TOR, by design, makes it extremely hard to correlate usage with a person without owning exit nodes and/or social engineering.

snitko• 13 years ago

So the founder of Tor Freedom is arrested and now this. Quite a coincidence. Maybe not NSA, but probably some kind of government agency. I think the best bet people can make these days is to assume that government is guilty and means to do nasty things - until proven otherwise.

ToothlessJake4• 13 years ago

It is NSA[1]. No implication needed. FBI nabs host owner and suddenly code is injected to exploit all end users? Rather tired of people downplaying these events at every attempt. What does your comment add? At least the parent comment you are responding hinted at a potential suspect.

Perhaps he doesn't want to be hunted either directly implicating the US for the US's work.

Seriously, bring something to the discussion if you are going to be asking others to do the same.

By the way the person who started the site linked is being prosecuted by the DoJ[2], no doubt with others involved being hunted down as well. I'm sure there is no implications to any of this.

[1] http://wiki.echelon2.org/wiki/Endgame_Systems

[2] http://www.thenation.com/article/174851/strange-case-barrett...

_b8r0• 13 years ago

Complete conjecture, but it's not that far a hop skip and jump to consider the possibility that Sabu's team in the FBI built and planted the JS.

tmbeihl7• 13 years ago

The ip address with the iframe seems to be down now? Anyone get a copy of the iframe JS?

syncerr2• 13 years ago

Another one: http://pastebin.com/K61QZpzb

Shows an iframe URL of: http://nl7qbezu7pqsuone.onion?requestID=203f1a01-6bc7-4c8b-b...

Which is live now[1], and shows:

[1] http://nl7qbezu7pqsuone.onion.to/?requestID=203f1a01-6bc7-4c...

tmbeihl7• 13 years ago

here's the script that loads ... time to decode http://pastebin.com/7G8MeWcs

kaoD• 13 years ago

Might want to check these too:

    window.location.href="content_1.html";

    iframe.src="content_2.html";

metricman• 13 years ago

Could the kind intelligence that decodes this post a play-by-play for us regular folk? Is the first step trying to trace the logic mentally? Building some kind of graph-based representation of the code and its calling behavior...? When I read var77, var78, var79... well, yea.

syncerr2• 13 years ago

Targets Firefox version 17 and lower. This is the version (17.0.7) that you're required to use for TOR on Windows.[1]

It would take a long time to walk through what's being done, and even that isn't likely to be helpful. There's a lot of Array, Int32Array, and ArrayBuffer allocation and retrieval. It's possible one of the larger strings is for injecting code into memory. It doesn't look at the guid stored in the cookie or the query param. If it is a memory injection, your guess is as good as mine.[2]

Just my sense for staring at this for an hour. I know JavaScript, but I'm not a security expert.

  Original iframe w/ ?requestID=<guid>: http://pastebin.com/HcGRQk2N (with HTML)
  content_1.html: <connection reset> (only used for versions of Firefox less than 17)
  content_2.html: http://pastebin.com/7sTk8bgx
  content_2.html?????: http://pastebin.com/t9x4GHr1 (same as content_2.html)
  content_3.html: http://pastebin.com/GGCny4Vb
  error.html: <connection reset> (it's likely meant to fail)

[1] https://www.torproject.org/projects/torbrowser.html.en https://www.mozilla.org/en-US/firefox/organizations/faq/

[2] http://pastebin.com/gVna4pi2 (NB: it gets modified before used)

tmbeihl7• 13 years ago

They seem to possibly targeting the tor browser bundle

FedRegister3• 13 years ago

Who is actually running Javascript from Tor though?

unimpressive• 13 years ago

The Tor Browser Bundle enables Javascript by default.

FedRegister3• 13 years ago

Which is a mistake, and this shows why. Javascript should be default-off everywhere, and then if there's a Tor site you trust (oxymoron if I've ever heard one) then you enable Javascript.

betterunix• 13 years ago

People who need or want to use something like GMail over Tor?

icebraining• 13 years ago

Gmail has a "basic HTML" view which works fine without JS, though.

FedRegister3• 13 years ago

They can use the non-Javascript interface to set up IMAP/POP3 and then just use a POP client - no Javascript required.

PhasmaFelis• 13 years ago

I realize this marks me a failure as a hacker and a human being, but JavaScript is not my native tongue and Google Translate doesn't seem to have an option for it. Could someone please post some actual news about...whatever is happening?

stdgy• 13 years ago

Here's my current understanding:

- Freedom Host's founder arrested in Ireland for potential extradition on American child pornography distribution charges.

- Odd Javascript snippets found on sites hosted by Freedom Host. Initial investigations seem to point towards a possible 0-day targeting Firefox.

If the delivered Javascript is a browser-breaker, this strongly suggests someone is collecting the actual identities of the Tor users.

mtgx• 13 years ago

This seems to be happening at the same time with the founder's arrest. Coordinated action?

Argentum01• 13 years ago

Or perhaps it's been going on for awhile and the arrest brought the necessary scrutiny

ToothlessJake4• 13 years ago

I've referenced Endgame Systems before[1], exploiting end users for-profit via for figures like the NSA is their type of game.

"There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year.[2]"

Endgame's product list was not marked classified, a product meant for distribution only to the likes of the NSA but peddled amongst fellow for-profit "whitehat" in arms. Yet another company with immunity to laws others are hunted and imprisoned for.

[1] https://news.ycombinator.com/item?id=6115881

[2] http://wiki.echelon2.org/wiki/Endgame_Systems

cne_productizer• 13 years ago

Speaking as someone in the field (I know people from Endgame, and work in a similar place with much more discretion), this is a load of shit. The FBI wouldn't be deploying Endgame product like this.

runeks• 13 years ago

The Tor Project should offer a bundle with 1) a VirtualBox image with Tor installed configured to work with 2) a Tor daemon installed on the host system. This should add another level of security.

Tor Freedom Host compromised, JS injected into multiple sites

Related Stories