<story><title>Javascript exploit actively used against TorBrowser</title><url>https://lists.torproject.org/pipermail/tor-talk/2016-November/042639.html</url></story><parent_chain></parent_chain><comment><author>micaksica</author><text>If TBB leads want to run Firefox with JavaScript &amp;quot;default on&amp;quot;, then Tor Browser Bundle needs to be messaged as insecure. Either that or turn on NoScript and inform people what bad shit can happen when their browser is interpreting arbitrary code in a not-so-sandboxed manner. TBB is &lt;i&gt;not&lt;/i&gt; a solution against targeted deanonymization attacks.&lt;p&gt;This is neither the first nor is the last 0day in Firefox that will affect TBB.&lt;p&gt;IMO the best practical mitigation against these attacks is sandboxing with an amnesic system like Tails, as even as a VM it will leak a lot less information about the machine it is running on and requires burning both a Firefox 0day and a VM escape to get any real information outside of the real IP address of the user and some basic things out of &amp;#x2F;proc (although Tails may protect against the latter now). Also, as the whole VM goes away when it&amp;#x27;s closed, you&amp;#x27;re not getting persistence on that machine if you just pop the browser.&lt;p&gt;A 30 second glance at the source code makes it looks like this exploit pivots to attacker-controlled memory on the heap, and spawns a thread using kernel32.dll. As EMET has hardening against attacks like this, I am curious if this exploit works at all on EMET-enabled Windows systems.</text></comment>
<story><title>Javascript exploit actively used against TorBrowser</title><url>https://lists.torproject.org/pipermail/tor-talk/2016-November/042639.html</url></story><parent_chain></parent_chain><comment><author>tlrobinson</author><text>I feel like Tor Browser should just spin up a fresh VM with a minimal Linux distribution and fullscreen Tor browser, with the VM&amp;#x27;s only networking tunneled through Tor.&lt;p&gt;I think Hyper-V can do graphics as well and it looks like bhyve added some sort of graphics support earlier this year, but xhyve has none. Not sure if there are any other lightweight hypervisors that support graphics (or maybe just use a protocol like X11 or VNC?).&lt;p&gt;Docker for Mac and Docker for Windows have done a great job of hiding the fact that it&amp;#x27;s using virtualization from users (but doesn&amp;#x27;t need graphics, of course)</text></comment>