[REQ_ERR: COULDNT_RESOLVE_HOST] [KTrafficClient] Something is wrong. Enable debug mode to see the reason.[REQ_ERR: COULDNT_RESOLVE_HOST] [KTrafficClient] Something is wrong. Enable debug mode to see the reason.[REQ_ERR: COULDNT_RESOLVE_HOST] [KTrafficClient] Something is wrong. Enable debug mode to see the reason.[REQ_ERR: COULDNT_RESOLVE_HOST] [KTrafficClient] Something is wrong. Enable debug mode to see the reason. Java for tor browser mega
java for tor browser mega
darknet покупка попасть на мегу

В левой области окна перейдите ко вкладке «Дополнительные». Tor представляет собой анонимайзер для Mozilla Firefox, которое позволяет скрывать личные данные в интернете путем подключения к прокси-серверу. Как установить Tor После того как скачали программу, приступим к ее установке. Если вы уже использовали Firefox, интерфейс будет выглядеть практически идентично. Официальный сайт Tor браузера в России.

Java for tor browser mega скачать браузер тор на русском языке с официального сайта 2015 mega2web

Java for tor browser mega

Извиняюсь, но, шелковый путь даркнет mega продолжения

For the stupid person 2 above saying that the rates of rape and molestation have gone down ,you know why that is?? I believe the feds are after the Darknet drug markets much more than CP. Would you deny them the little respite and relief they claim that marijuana provides them? Current drug policy in many places does just that, leaving such people-- in misery-- with no alternative but the very "black markets" that you refer-to.

What about "taking down" some of the legal, sanctioned, privileged mega corporations that promote, glamorize and glorify this poison? Re: "money laundering": Can whatever Tor may facilitate in this regard even hold a candle to the likes of the Wall Street banksters or even or especially the Federal Reserve, the World Bank, etc. And the prison-industrial complex; the ways in which a number of entities directly benefit from a drug policy that results in mass incarceration is an absolutely critical aspect that cannot be overlooked in any discussion of these matters.

A typical post from a typical Tor user. You are guys are really experts in this stuff. I am sorry you were hacked ;. Or said another way, the larger and broader the Tor user base gets, the less relevant this little subset is. Why is that not mentioned in the article or in any articles for that matter? Why is this not investigated? There could have been another exploit, different from this one in that page, one that still works in the latest version.

More data is needed. All the ones in red are bad news. And most of the ones in red came out after Firefox 10 was abandoned. Not to be paranoid but how do we not know that old Tor versions are safe and the new versions are actually planted with back doors? Reproduce the build environment and build it on your own machine. Are you even sure that, should there be anything suspicious in the code, that you would recognize it?

Browser versions less than 17 WERE exploited by this. Does anybody know the contents of that file? Exactly, there is a lot of misinformation being spread on all official channels. But that is clearly not the case if you read the code. I wonder why it was never obtained? If my browser was safe but I had a separate instance of FF open elsewhere, can the malicious javascript bleed through and phone home to the FBI from there?

In a vulnerable browser, somebody could have written an exploit to take over your computer, and from there it could mess with any other running or not yet running applications. Since malicious client side scripts have no direct access to the underlying filesystem or OS of the client, they can not be transmitted across browsers.

However, if you have malicious bookmarks or addons installed and voluntarily transfer them, perhaps in ignorance, then the other browser is also vulnerable. And it depends if "malicious scripts installed" are at an OS level, or at a browser level.

If something infects your OS, any application is vulnerable. So, with a older version of TBB with javascript disabled and ex on linux, a user would not be affected by this? Any knowledge as to whether EMET would have prevented the exploit from running? Nobody has talked about this but the enhanced mitigation features are useful under Windows and should be common practice.

People know it affected us through Javascript, because specifically it was a Javascript attack when visiting those sites. Events happened in the order of. Visit infected site 2. Malicious Javascript code awaits you, it attempts to launch! No, I saw the same message a couple of days ago and I was prodding around FH to see what was going on but noscript was always on.

Thing is, I updated my TBB today to It says "to implement a crucial fix https has reset to default rules" or similar. This is 64bit linux. A few days ago I also had this bar showing up. IIRC it was displayed as soon as the browser started and visited the check. I also made screenshots of this event. Quoting the poster before me: all i want to know if this was sent from TOR or because of this exploit.

That is what I wish to know too. I was using the latest version of TBB at the time when I received the above "crucial fix" message but with JavaScript enabled. Did that bar pop up when you visited a know infected site?

Or was it randomly some other time? I am unable to answer this question as there is no way for me to tell whether the site that gave me the "crucial fix" error has been infected or not. I read that the sub-bar was one of the indicators that the exploit had been run on your browser. Sorry, you might want to nuke your hard drives :. Probably it was part of the last update of the extension.

I got that popup after getting the newest TOR bundle today. I disabled JS and all the other things and did not visit the infected sites on this new bundle. Was the update official or it was an attack? I even clicked it. I use FF It is not related to any exploit.

It is not put there by any website one visited. Sorry if this has been asked already, but I only downloaded the Tor Browser Bundle a few days ago, so I presume I had the latest browser version, I just checked, and Javascript was enabled.

For non-Tor browsing, I use Firefox Am I safe from this exploit? Anon: "Would running Tails with Iceweasel They do work with NSA but also many other government agencies source: I used to work for them! The link in that article to the robtex. Can Torproject please fix the check. Also, the notion that half the hidden services were hosted by FH is likely bunk.

This TOR exploit thingy. Will it grab the ip of your computer on that network, like It grabs your hostname e. There is no reason to let the Tor Browser process or indeed, any process run by that user speak to the Internet. Is it another process vidalia?

If so, yes a firewall blocking tor browser outbound would be a really good idea. I was assuming Tor Browser itself makes the connection. So to prevent future exploits of this type, could torproject maybe show downloaders how to set the Windows firewall properly to block all outgoing connections it allows all by default except allow tor.

And mention if a window ever pops up to allow tbb-firefox. The other answer is to run Tails in a VM on Windows, if you really need to be running Windows in the first place. Hi, Once again sorry for being redundant, but I thought I would ask a broader question hoping that it would answer a lot of questions.

If someone had Windows 7, Tor Browser Bundle 2. No, the exploit was fixed in One question.. I have the ESR version The vulnerability was fixed in firefox So you are not at risk. So if one had turned off javascript on ones pre v 17 browser, that would have stopped the exploit from executing?

Do we know Has somebody tested it against this particular exploit? I know as a programmer myself we like to indicate a bug is "fixed" but it really needs to be tested by others. Any law experts around? Assuming this illegal exploit worked, what could they do with the IP list? Is a couple random visits to FH sites like, exploring hidden wiki links enough to warrant raids?

Just wondering what exactly was the purpose of this illegal exploit, because clearly not all affected are guilty, even if they did visit some of the illegal sites once or twice by mistake or due to curiosity. A raid on them would destroy their lives nevertheless. Can this list be used against international citizens? Would international agencies accept tips obtained this way? The code did change multiple times, did it not? And parts of it are not yet obtained.

I am positive that this exploit is a small part of an overarching federal project. The NSA are doing the fishing in order to be able to connect the dots at a later date. They are looking for a couple hundreds of big fish, not thousands of small fish. Apparently nobody knows what was in it, because it was never obtained. Because the code did not exit but loaded this page, one has to assume another version of this, or another exploit was indeed executed on Firefox versions below Therefore all the news and security reports that specifically claim this attack targeted version 17 only, are wrong.

Would Request Policy block this attack? Or maybe Request Policy handled iframes differently than the main page? Somebody would need to investigate. For those of us just hearing about Tor for the first time, help me understand this in non computer tech terms And if someone used Tor Bundle on windows during this time frame but had that little S in the top left corner clicked so a circle with a line was through it, are they still at risk?

Or did that turn off their script stuff? The presumable owner of Freedom Host was arrested July 29th and the malicious code was first noticed on August 4th. If you have the little "S" with a red slash through it, it is blocking scripts from executing and you are highly unlikely to have been affected.

When 2. Yes, but did the. Read the advisory for details. While the TBB may have made it easier for people to use Tor a good thing it has also made Tor into one big honeypot. The situation before TBB was that Tor users had basically no chance to secure themselves against a wide array of known attacks at the browser level.

At least in this case we learned about the issue, and put out a patch that users could upgrade to, more than a month before it was exploited. If we lived in a world where there existed a mainstream browser Firefox, Chrome, Safari, IE, something that actually addressed these application-level privacy attacks, I think this would be a worthwhile discussion to have. That sure would be nice to fix. In any any event, you and I agree on the fundamentals.

Now they are real. I see them as all equally bad. I am, and have been, running it for some time now. Probably Unrelated, Huh. Whatever it was has also Killed my Relay setup entirely Perhaps worse than that, every time I attempt to access certain of the now defunct. TemplarKnight tormail.

I guess you have some list that you think is the entirety of the Tor hidden service list, and not many of those are reachable for you? But at the same time, it sounds like your computer is broken in all sorts of ways? Sounds like you might want a reinstall, and maybe with a safer operating system.

B "why [ They just took our name to try to trick people into thinking they were legitimate. And then they did a good enough job at never being reachable when we tried to contact them about it. YES, I went through SIX lists and I do realize that they did not encompass the entirety of the Onion HS sites, but I have been doing this for several months on a weekly basis and my estimate is fairly accurate.

The fact of the matter is that TOR Mail did work well enough that it became the accepted standard for secure email communications in the world. TOR will never be compromised by the Intelligence Mega-plex, simply because they use it themselves That is correct. Tor has not and will not be compromised as long as big corporations, businesses and government agencies use it.

I feel safe enough using Tor Browser Bundle by itself with scripts disabled. I think I downloaded tor within the dates in the advisory, but not sure. Click here to go to the download page". Is there any way that the exploit could still have run, as the advisory states that "the attack appears to collect the hostname and MAC address of the victim computer, send that to a remote webserver over a non-Tor connection, and then crash or exit. The exploit does attempt to run on I need to report that five customers and counting have similar issues with tor-browser: 1.

They had tor-browser crashes and windows reboots reported in early July. Why assume it is unrelated to the attacks in late July. All of these systems had up-to-date browsers with the most secure setting script etc. All show, after the window OS rebooted, MS was eager to send you a possible fix.

Is MS involved in this matter? Why not? Remember, the FEDS have full access, and they are the good guys. All via MS. They know who might be using the tor browser, based on the Metadata gathered, and the OS used as well. None of them had this problem prior to using the tor-browser back one year or more. All used the browser for the first time very recently, because of the Snowden leaks. Dear FBI, I hijacked your exploit and started loading CP sites through Tor, each time I had the exploit code delivered but firewall rules and other mitigation techniques prevented it from phoning home, simultaneously with this I injected your exploit in users traffic through their clearnet exit nodes, framing them for viewing the CP.

I did this a great many times, always taking care to clear cookies and use a new circuit to your compromised hidden services. I started doing this almost as soon as I recognized what was going on, and has added what I imagine must be significant noise to your database of suspected pedophiles.

Fact, many FBI or alike agents that work with cp all day end up with problems, and many of them end up getting caught with possession of cp! I would just like to clarify that I run multiple exit nodes, they are not part of a family and I will not name them. My exit nodes carry traffic for a great many Tor users every day, and I have randomly exposed them to your exploit during the duration of your operation. I am not going to reveal the exact way in which I did this, but suffice to say I have seriously contaminated your database of harvested IP addresses.

That said I would also like to warn all users of Tor that you are very possibly in the database of the FBI even if you never loaded a child porn hidden service. I did this in order to confound their operation and provide plausible deniability to all targeted Tor users.

I apologize in advance if the FBI kicks your doors down, but perhaps after they realize a great many of their targets are in fact not involved with CP, they will realize that their operation was a failure. If someone was always using the then most current version of TBB, would they have been at risk on any day?

As a user of Tormail, is there any way to find out if my real IP information has leaked out? Freedom of information request to the FBI? Name address, bank account and any other info that they have. We have been royaly shafted. Right, true. Unfortunately I have missed the update and used But I have the script blocker activated an usually no script is carried out. Is there a risk that this attack can overcome this mechanism? But I think cookies can be received without having script enabled.

Because v I also saw one cookie, under Torbutton cookie Protections, but it was maybe 2 or 3 weeks ago. I was checking everything in settings and so I saw one cookie there and I moved it. I know that for sure by from the file modified date of when I extract it and checked the version. Is it normal there ever be a cookie under the Torbutton cookie protections? In fixed version does the exploit only make the cookie but not send it? I have two questions for arma: -If I downloaded my browser mid-late June, early July, would I still be vulnerable?

You should obviously have Javascript disabled by default in Tor browser. I know that before the time frame was a few days ago, but I wasnt sure if there had been any developments. It will take time to process all that information and get court orders for addresses of IPs etc - so I should think everyone who was compromised has at least a week before their door is busted down and all their computer equipment seized. Probably months. First, your IP address by itself is not worth much as evidence - could have come from someone using your WiFi or a visitor to your house.

Deleted files can be recovered. Truecrypt , unless your country can force you to give up the key e. The raid will still happen, but if the computer with the compromised MAC is not found and there is no illegal material found, there is no case against you and you will eventually get all your stuff back with no action taken though it will probably take a year or so. Do not believe anyone who tells you that saying anything different will be better. Nobody is going to get busted because he attempted to visit the front page of some kinky website.

FBI is most likely going to distribute the collected list of IPs to local police departments for further surveillance. You will receive your knock years later and nobody is going to even mention this TorSploit then. Agree, this is the most likely couse of action here. You need to change your habits and be very careful what you say or do online and IRL from now till..

I disagree. It is sufficient to get a search warrant, same as happened with the Landslide bust. The LEA then hope to find a good percentage who have illegal material on their PCs - which is what they prosecute over. Contrary to what you say, I cannot see that any LEA is going to spend the resources on setting up years of surveillance on the probably thousands of households who were caught by the sting. But in Landslide the feds had records of what the customers purchased and downloaded.

Here all they know is the person went to the website, but not what they downloaded or looked at. It would seem similar to "this person was observed leaving a house of a known drug dealer. Reasonable suspicion to stop and question them maybe, but enough probable cause to get a search warrant? I would suggest yes. If they know for instance that you accessed a cp site, that would be a strong suggestion that you would have cp on your computer after all, why would you be accessing the cp website if not to get cp?

According the Wikipedia, a Federal investigation into Texas based Landslide Productions yielded a user database with ,00 names of which 35, were U. S residents. Of the 35,, a portion were selected to receive invitations to purchase illegal material by mail. The results of this subsequent sting yielded search warrants and arrests. It would seem that an IP and MAC address are slight evidence when compared with the credit card and business records found in the Landslide investigations.

On the other hand, is this exploit something a U. I am a US lawyer at least by education and historical avocation. The NSA can and does intercept all international traffic. We have a constitution in our country the US , but outside the US different countries are organized under different rules. And, international communications are essentially subject to no rules. It gets worse. If they give information lawfully collected in an international communication to the FBI, the FBI can use it against you.

Why would they need a warrant? Earlier in this thread somebody mentioned WiFi. Are you nuts? Anything you put out using WiFi or other frequencies of the electomagnetic spectrum - including use of your cell phone and its geolocation - is fair game. The long-standing principle is that "the airwaves belong to the people" codified in the Communications Act of And, you may remember a famous speech in US history about our government being "of the people, by the people, and for the people.

Thus, the government "of the people" should be able to listen to anything on the airwaves they own. Sounds strange, huh? This is very different from breaking into the house of a suspect to install a surveillance device. That does require a warrant because the Fourth Amendment protects "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" without a warrant. An off-shore server is not the "house, papers or effects" of a US citizen or a citizen then-subject to US law.

Try moving to Russia and setting up a server hosting comments critical of Vladimir Putin. See how far your protest for a US warrant gets you. Even a visit to tormail front page could lead you to a raid or a surveillance? Hi Arma, Thanks for your replies. You are amazing for replying so quickly in these trying times for privacy and anonymity. Has TOR thought of adopting more advanced header analysis and inbuilt firewall system, that will actively parse and analyze for hack attempts.

Have you thought of upgrading the TOR Browser bundle so that it will act also as a comprehensive firewall like Comodo firewall? You need to block this in your firewall! Does this mean that if we have a tormail email account are emails can now be read. Will tor email ever be back? You have to assume that all emails on Tormail are now in the hands of LEA.

It could have been the primary target and all the sloppy CP bust exploit could be just a coverup. Nobody talks about Tormail - the real issue here, but everyone talks about a few busted pedos. What they really bust is Tormail, used by whistle blowers and activists. They want to get to those who are anti government and pro people, like wiki-leaks supporters. Taking down a few CP sites that only had links and have already been partially restored on safe servers, is just a media attention catcher.

Yes the primary target of the NSA was tormail. This cannot be repeated enough! Of course there is the chance to find out lots of other potentially useful info that could come from nation actors of every nation who might happen to use tormail. The secondary target was fear. They have aimed for some time though using various stories of busts where TOR was not actually the determining factor to scare people away from TOR and any other anonymous network.

Projects like TOR are quite useful to their own people and probably even more useful to the CIA yet to them it is extremely dangerous in the hands of the average citizen or a whistle-blower. With this operation - they have achieved both major goals. The U. It is a venture capital company that funds start-up technology companies developing technology of value to intelligence gathering. Two things to keep in mind:. In-Q-Tel is NOT the only company in the venture capital world that invests in the information technology surveillance space.

There are plenty of others. I know this is hard to believe, but start-up enterprises desperate for sales are not terribly discerning about whom their customers are. If you have a Facebook account, why would you ever use Tor? Tor mail was the target. ROK censors the Internet, and censors the news. Except for information she received from me some of which was classified and identified as such with instructions not to distribute it further , she knew very little.

The international student organization that sponsored her study there was also kept apprised with the classified intel left out. There were a few hairy days. But, fortunately, they passed uneventfully. It would be nice to be able to confirm that she is safe. KCIA will want to get me, again. I expect them any time. You should worry about everything that you should normally worry about on the Internet.

Most of the recommendations in the advisory still apply, now and in the future. Well tor is totally safe anymore. Who knows whats next on the javascript exploits list? In the meantime, any alternatives to tormail are welcome, since tormail wont come back up anytime soon.

Is the tor mail data center compromised now and is a LEA looking through those mails already? There are some steps you can take to protect yourself even more from similar attacks, but a typical VPN service or a proxy is not one of those steps.

Am I correct? Wrong, see post above. That is not how it works. If you have a dedicated tor proxy which only allows traffic to go over the tor network then there is no way that the script could have circumvented that. Same situation if you setup a vpn the api called respects the routing table and therefore would have used the vpn connection.

Can you please explain in detail how the exploit gets your actual ip address regardless of using a VPN rather then just saying it does? It reads it from Windows network stack, then sends it over browser-independent connection. If you use VPN, transparent Tor, etc it is just a communication channel for delivery.

Like a raindrop, no matter how many clouds are in way, it reaches the ground. Since Tor Mail was extremely popular with drug dealers and financial fraudsters I would say yes LEA are looking through the emails. CP, drug deals and financial fraud are only covers. Like catching whistleblowers who reveal their secret plans and illegal schemes. What else can we use now to communicate without being spied upon? Tormail was the place to go.. Soon they will call you a pedophile or terrorist, if you use PGP or any sort of encryption at all.

TorMail is an interesting issue here. The almost certain fact is that existing accounts are in the hands of FBI. So technically, TorMail could resume as soon as they find a new service provider. They could continue under the name of TorMail, or they could use any other name, in order to not be associated with the compromised old accounts. Or FBI could start their own anonymous mail service under a different name. The crucial point is that we will have no way to tell which is true.

TorMail could have been hostile, bribed, or hacked. Same about FH. If you let your real-world id slip, you are doomed either way. The fact that hidden services was constructed specifically to hide the identity of both ends of the connection makes it amazing that Torproject did not take steps to protect users from malicious hidden services by disabling javascript by default on onion domains. It should give more than a few people pause to consider that both torproject and TAILS, by default, do not enable javascript blocking AND both software suites direct the browser on load to a page that could be compromised in the exact same manner as site on FreedomHosting were.

I understand that to a certain extent you must trust the project developers not to backdoor your software, but I see no reason why every time I load the software I am asked to trust their website. Basically, the address No, NSA gathers electronic intel -- mostly tracking terrorists. IP-to-whatever databases are notorious for being inaccurate. There is no doubt about that now. If it were hackers, they would announce it on day 1. They would also inject a virus with the payload.

They can keep the collected data for years to come, watch the suspects, and strike at any time they see fit. Especially if Tormail was the primary target, they will not issue any official announcements and everyone will forget about it. How about instead of treating everyone as a suspect, stop invading other countries and kill their children?

It really is that simple. And stop spying on the world. If I had version No, the exploit requires Javascript to work. If Javascript was disabled, as it should have been in the first place, there is no chance it could have worked. For TBB 2. Although it was patched on June 26, it may well have been happening for quite some time before that. Quite some time before you all updated to Yes you are safe NOW from this particular exploit if you have Sources on the reported exploit execution dates, please?

On a related sidenote, i understand most or at least many people who were subjected to this exploit experienced a browser crash. One would think these crashes would have been reported during all of July if the exploit had been in effect "silently" from way beyond the fixed update on the 26th of June. I have an interesting question. There are a bunch of bugs in Firefox that can cause unrelated crashes. Assuming you had javascript disabled, your crash was probably something unrelated.

As far as we know currently that is. And one of those patches could have caused the crash too. I was using Tails and the 1st thing I do is disable JS. This happened on the 4 I believe. Also running the most recent Tails distro. Would it make a difference if Javascript was enabled globally and Iframes were disabled on all sites via NoScript? Stupid question. So if I did this a few times over the last couple of weeks I should have used the last version every time, and should be safe even with JS enabled right?

Be sure to check the signature each time you download it. Not happening. It is a ridiculous suggestion. Plus PGP software for windows does exist, despite your comment suggesting otherwise. It could be easier to use, but a particular piece of software for a platform is not indicative of any problems or benefits of that platform.

Truth is we have more software choices for just about everything on Windows. The thrust of my position is that security is an absolute property that must be designed in from the beginning, coded with care, and enforced throughout the software development lifecycle.

This embodies a set of issues that are orthogonal to whether the source code is open or not -- it depends on training, design, and use of appropriate tools. Thus, the nature of whether code is produced in an open or proprietary manner is largely orthogonal to whether the code and encompassing system should be highly trusted.

Each side makes arguments and refutes the arguments of others. In truth, neither is correct or both are. Whether or not source is proprietary does not determine if the software is better. A famous Spaf quote: "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts.

If you want to rectify that, for starters please cite an URL that fits that criterion. Be constructive. Yes indeed. If I was using 2. Was I injected? Switching away from windows because there is a security issue in the software YOU use. Forget it, I will no longer support you.

You are nothing but Microsoft hating geeks. Even if everyone switched to Macs, this exploit still would have worked because it allows execution of whatever code the exploiter wants to put in there. They could have written Mac specific code if they had wanted. Would having only Tor allowed to access the net in my Windows firewall settings not even DNS is allowed through block this attack?

How likely are the ramblings of the guy saying he runs exit nodes and embedded the exploit in random traffic? Yes you would have been save from this exploit. Make sure only a user with admin rights is able to turn the FW off. The payload itself was extremely strait forward - a 5 year old could have written it.

If they are dynamic and logged at the FH servers then it is not possible to "poison" the database. Forgott to mention that as an exitnode operator he would not be able to "accuse" real tor users because he cannot know their ip addresses. If Tor. The real solution is to install tor in a virtual machine with a new Windows installation, then take a snapshot after you install TBB on it, and have it restore to the snapshot after EACH use.

If you feel as if you may have been compromised, what should you do? Well, it just means your IP and MAC address as well as proof of what exploited site possibly page you visited is on a U. Only you know what pages you visited and what would happen if the U. So users need to have a way of finding out if they have been compromised Anybody else remember when the default settings for NoScript in TorPark had "allow scripts globally" set to on?

Please show me one. Also, seriously, TorPark? That brings me back. Hi - I was one of the unfortunate ones that tried to login to tormail and got the error system maintenance, please check back in a few hours. I got that error about times as i kept trying to login. I had Javascript enabled and was running the torbrowser bundle with Firefox But there are other vulnerabilities in Question: in the advisory it is recommended to use RequestPolicy.

I never used Tor on my actual machine; it was always on a virtual machine And I wonder Then, you can use java, flash, or wathever. Your real mac never connected to the router, the live system leaves no trace, the encrypted flash unit is in your rectum, or another safe place. Yes, might be slower than your own connection,". Another noob question. Java, or did you mean JavaScript? Used by whom to spoof your IP to whom? Have an older version of TBB maybe updated last year on my laptop I use only when my work computers are down.

I am sure that it has the version exploit could run on. I last used it mid July but always set the button to no scripts s tab with blue cross out for fear of adware and viruses. Not sure if I visited any of those freedom host things, i know i didnt get anything sayingdown for maintenance. Did the malware only take advantage of stupid people with their scripts left on or did effect those with even the no script turned to block all?

Could someone with knowledge respond? The exploit payload used Windows-specific code. The language is simply too complex and it is just too easy to fuck something up. This is not a matter of "being good coders", this is really a matter of a programming language that makes it too easy to screw something. It is clear by now that this is becoming an emergency What i propose here is to write a custom web browser in go for instance that supports only basic HTML and CSS and that relies only on go libraries and to make it the tor-browser.

My proposal could be extended to Tor itself in order to prevent exploits in it too. Here is another scenario. But you need JS for some reason and forget to disable it again. Then a few days ago you load up your now outdated and vulnerable TBB to find most FH sites are down or act weird. You go to legal but infected onions on FH or Tormail with the maintenance message, and BAM they have your real ip, mac, host.

They know what site you have visited by sending not only MAC and hostname but also some sort of generated ID from the site. Does it disable anything else? Restoring NoScript to the default setting of blocking scripts globally may be the preferred option. You can control this feature toggling the noscript.

And similarly, many non-OS apps? The idea that MAC correlation to IP and other fingerprint data is some closely guarded secret in this age The whole point of using tor is to stay anonymous, if people want easy access to the net they would use IE instead. Are they paid by you know who to keep the backdoor open? This is evidenced in a lot of the choices they have made: quick circuit rotation even much quicker in the past at 30 seconds, raised only to reduce load on the network too , a suggestion to leave javascript enabled to reduce browser fingerprinting despite opening you up to an entire class of hacking techniques that could deanonymize you, etc.

Tor developers have a different threat model in mind than a majority of their users do. They also are very concerned about getting as many people using the network as possible, and will sacrifice security for useability.

This also contributed to their choice to leave javascript enabled. It also contributes to their choice to give you three entry guards even though you are much more secure with a single entry guard or possibly two. It is also why entry guards rotate so much. So pretty much we have a few issues. The first issue is that our threat model is not the same threat model as the Tor people are focusing on.

The second problem is that they have taken to pandering to idiots. The third problem is that they have taken to pandering to people who want to watch cat videos on youtube. Defend yourself against network surveillance and traffic analysis. Many webs sites load javascripts from ajax. What is so hard to have it disabled by default and only enable it when you really need them?

By enabling javascript by default they are tricking those non tech savvy people into leaking information to everyone out there. Yeah you have a good point actually. The Tor developers reason for turning javascript on actually makes no sense at all. So pretty much their entire defense of turning javascript on has crumbled.

Right, Tor is a specialized tool to ensure privacy, that is its core function, its sole reason for existence. The Torproject team should make it easy for people to maintain privacy, not make it easy for people to watch youtube. That means disabling javascript by default, not the other way around. Using this proxy safely, for browsing, introduces a world of new headaches.

And keep in mind that TBB is relatively new compared to the Tor program itself. See the end of the advisory for links to approaches that can make this better. And then help us do it! Great job guys!! The only safe way now is to install a new and clean windows in virtualbox, then install TBB, after that take a snapshot of the virtual machine, so you can restore it to a brand new state after each shutdown.

The user base for Tails is not large enough to detect hidden backdoors. Not many Tor users are Windows experts I bet. For this alone-- the glaring contradiction and the lack of any response to it thus far from anyone at the Tor Project despite numerous other comments being posted by arma in the time since I pointed-out the contradiction -- people should be alarmed and demanding an explanation, regardless of where anyone may stand on the question of JavaScript itself.

No kidding. I want to switch to Chrome, but it still has some enormous privacy vulnerabilities that are unfixed and unfixable using the APIs provided. Out of curiosity, are there plans for a completely sandboxed bundle using an encrypted virtual machine without direct network access?

There are a number of open-source VMs, and you could run a very minimalist distribution of linux inside the VM to cut down on image size. The only multi-platform code to maintain would be the TOR binary already ported , the VM, and whatever network rules are used to refuse the VM external access. Being a single browser hole away from complete de-anonymization is a completely untenable situation.

If you want to get the extra credit, you could run two VMs, and put the Tor client plus some good iptables rules in the second one. As long as the demand is there people will come up with something. Arma, whoever you are, thanks for being there and for bringing a little sanity to this issue. Your efforts are appreciated. Did investigate in cookie mechanisms because I remember to saw a cookie N-serv once without having any JS functionality enabled.

This is possible as cookies can be generated via HTTP alone. I can imagine that this cookie even with that name was generated maybe to track my browser history. But without JS enabled there is no known mechanism yet that the real IP can be sent out. What would make it less vulnerable I think if Tor - Firefox can be patched to only be able to send out requests through TOR. If I understand it correctly in this case the exploit did sent out info through clearnet. Strange to hear that in GB the police can force you to reveal the PW of a container.

How do they detect that a certain file is a container I use TC? No one has a answer for that. See above comments about VPNs too. The Javascript also make the browser crash and exit, after executing the payload. Sooo, how can we tell which dark sites are hosted with Freedom Hosting before we click on them?

Say if they come back online under the FBi control and who knows what sort of codes injected into them for track and trace. A question please. I downloaded TBB version 2. Please correct me if I missed something. Thanks for the reply Arma. So my conclusion is that not all TBB 2.

The real answer needs to be getting people off the "run an application in Windows and think it can possibly be secure" model. For a bunch of people who surf onion sites, there seem to be an awful lot of paranoid people here. Me thinks perhaps your Tormail and surfing activities might be a little questionable huh? Particulartly if you used Freedom Hosting which was basically a disguise for CP.

Well, there is a lot of fear flowing through every single post around this issue since it came out to light. This is causing doubleposting asking the same questions again and again First, lets calm our minds Second, lets stick to the source Tor developers are our best source of information If it is said that using the latest bundle keeps us safe regardless of the javascript configuration on FireFox nor in the NoScript We need to avoid the path to the paranoia and in the way getting others paranoid Third, people here are very worried since some of them were sneaking in illegal sites that they are unmistakably going to jail because of that I cannot but see a pattern there Fifth, yes Tor has absorbed the hugest hit in its history I have less than a month using Tor and what brought me here is that i felt sick of the Snowden revelations about how the espionage has no limits Tor is under attack and depends on us this project suvivies Clarification required please - It says on this site that TBB 2.

I downloaded 2. Is my TBB vulnerable? The advisory recommends "you might like" the Request Policy add-in to improve security. The advice that appears on the download page, however, discourages us from installing add-ins to the Tor browser.

I am running Firefox ESR When I go to Help About and press the "Update" button, the message that returns says that I have the current version. Yet this advisory refers to a later version of the browser as the current one. What am I missing? A message like "Your system seems to support the NX bit but it is currently enabled only for Windows Services, you should enable it for all the programs in order to avoid running exploits which could deanonymize you". At what date was the malicious code placed onto the Freedom Hosting sites?

How long had it been there before it was detected? Для этого выбираем:. Будет показано предупреждение, о вероятной угрозы деанонимизации либо вреда для компа. О том, как поменять язык в обозревателе, читайте в статье: « Как поменять язык в Тор ».

Перебегаем в меню Тор, нажатием на иконку с 3-мя полосами, показанными на скриншоте ниже. Кликаем на Add-ons либо «Расширения», в зависимости от языка интерфейса. Раскроется меню со всеми установленными дополнениями. Чтоб убрать NoScript в глобальном смысле, жмем на Disable.

Чтоб включить javascript на определенном веб-сайте в Tor Browser , жмем на «Options». Перебегаем в раздел Per-site Permissions и вставляем в текстовое поле ссылку на страничку. Ваш адресок email не будет размещен. Skip to content. MultiSetup Официальный дистрибутив Telegram Тихая установка без диалоговых окон Советы по установке нужных программ Пакетная установка пары программ.

Всё выше tor browser скачать бесплатно xp mega будут!

A city may decide to improve their coffers by taking your property. What are people saying? Hope being frank is tolerated. Otherwise ta. And TBB would have shown a red or yellow warning on the home page in the last month telling us to update? Yep, although there is one specific build of TBB with FF version 10 that for some reason did not mention that.. But part of this Javascript attack was that it checked to see if you were running version The script checks for "document.

It also checks as an OR for "window. So the script doesnt give a damn what version you have. Every mozilla-based browser is targeted not only firefox. It works for every single FF version under the updated one. Are you saying that the TBB released after June 26 are also vulnerable to the attack? This seems to go against everything I have read regarding this attack.

You are half-correct. You are talking about the script that injects the iframe. The actual exploit loaded into the iframe only attacks Firefox To be redundant here, Well, that makes me feel much better. I highly recommend it:. Honestly, same goes for Windows users, why not use tails? Like many others, I use Tails whenever possible. Simple enough to answer. Connections and bandwidth. Not everybody in the world, and especially in rural areas of one country in particular that prides itself on being a leader in technology, has access to broadband or even reasonably fast internet.

The large developer and security analysis community around Tails, compared to the voice-in-the-wilderness aspect of Whonix? If only they would pull their heads out of their asses and disable javascript by default. Spot on mate.

I always forget to update Tor. It would be nice if Tor had an auto update option. It appears as if the exploit was cut down from a broader attack. How sure are you of that, are you one of the experts who tried it themselves, or could you link a source please? In fact, get anything including index. It does not specifically check for a version. It even executes on FF If the malware can go through though..

I dont think anyone can actually test that practically. The iframe is injected in any mozilla-browser. The exploit in the iframe only runs on Firefox Cautiously assume all Firefox versions since 3. Make sure that you: - are checking for security updates whether automatically or manually at LEAST once-a-day - are downloading and installing said updates as soon as they become available - discontinue using anything as soon as security updates are no longer issued for it.

Also, updating should be a one-click affair. Please help! Forced updates are very, very bad as they can be exploited. Just think somebody breaking into the update mechanism could then attack all users successfully. One-click is about as bad. Security comes with some effort you need to invest and some level of constant vigilance. Still, many people will still not update unless forced to, even if there are very clear warnings that are hard to overlook. But forcing upgrades will put everyone at risk and is hence unacceptable.

There are people that will be careless under any circumstances and nothing can be done about that, it just has to be accepted that there are people that cannot be kept safe. Forced updates when done properly are very very hard to exploit What i mean is this This is nothing new I think the solution is to simply disable javascript and make a warning dialog popup whenever you try to enable it.

If you are stupid enough to enable javascript even with a big red warning dialog that warns you that you are fucking yourself up then you just deserve it. Also the program should warn the user that a new version is available but without links to automatic download any content.

So the user has to go to the official website and download the official release. How many of those who do carefully read-through all the code are expert enough to detect anything rogue in it? And, finally, how many of those who carefully read through all the code and are expert enough to detect anything rogue in it and are looking for such would ALSO report and publicize it should they find anything suspicious? I personally would love a hash checker that would check for several hashes.

It is much harder to fool several hashes than to only fool one by the length of one hash multiplied by the other s approximately.. Anyway I wish the load would generate the hash and allow you to check the hashes of other programs and check them with those found in whatever source s you wish to point them to. Who was it that said that difficulty directly reduces security. Yes I would consider running an update button before I would download a new version for a number of reasons.

Its not a case of doing it properly. It wouldnt be the first time, an auto updater updates malware without you knowing. And a company cant assure anyone that this wont happen any time. If they do, they simply lie to your face. This really sounds dumb. First you want to "force" your ineptitude with technology on other users, and then want to blame Tor developers by accusing them of not fulfilling a duty to others.

Man, you just love to play the blame game and evade responsibility for your own actions. These are decisions "you" make. Learn to live within your technical means, and let the rest of us live within ours. This is how I start off, and I then I make decisions on a site per site basis eg. Do I really trust this site?? Disabling JavaScript by default, then allowing a few websites to run scripts, is especially bad for your anonymity: the set of websites which you allow to run scripts is very likely to uniquely identify your browser.

The idea, I think, is that since TOR has javascript enabled by default, you can hide amongst all the other TOR users running their system on default by also keeping your JS enabled. Basically, you stay anonymous by hiding in a crowd. Keeping JS disabled everywhere makes you part of a smaller crowd of TOR users who have their JS disabled and selectively enabling for some sites and not for others makes your browser settings unique, giving you no crowd to hide in, which is very bad when you are trying to remain anonymous.

From an anonymity perspective, it makes sense. But I will agree, that definitely does not make you safer, especially if you are running a Windows OS on a privileged account. But that can also be avoided by running your OS on a low security setting, especially if that OS is not Windows. JS can deploy self-executing exploits all day long on a linux system running at a low security level and do nothing. But once as much as can be reasonably expected has been done to warn, then the responsibility rests upon the user who ignores the warning.

If the warning: a is practically impossible to miss, AND, b explicitly the conveys the danger of continuing to use the deprecated TBB,. You are strongly urged to update immediately. So i am running 2. So it took "them" about 4 weeks from the patch Firefox was patched a day earlier to an implemented larger-scale attack. Not too bad for a bureaucracy. But this also clearly says the Tor project is not to blame. Being 4 weeks behind with security patches is unacceptable for something like Tor, and the mozilla folks called the vulnerability "critical".

This vulnerability does not even really qualify as 0-day, even if the mozilla advisory just says "crash, can possibly be exploited". Through TOR. Oath Keepers then notified FBI. I use the Vidalia package form last year with a FF version 10x.

Is my setup at risk from this exploit? So for my question: Does the script just tell the server the site you got it from e. Tormail and your real IP or does it track all the browsing of the current session? Sorry for the stupid question, but one thing would be interesting for me: I had an older version of TBB installed until friday, but JavaScript was globally disabled.

Can i be affected? I wish Mozilla would take memory safety more seriously. Critical infrastructure and at least a great deal of the critical data that has been placed onto the Internet should never have been. Yet another example of what happens when you allow the "Free Market" to dictate; to be the arbiter, etc.

What about the pluggable transport version obfsproxy for Tor? I believe that version of firefox is Also, for us non-techs, would we actually know that the browser was affected, if something took place. Any explanation would help. Question: In a German newspaper they say that you tor-developers suggest not to turn off javascript.

The newspaper states that it would be more suspicous then protecting. What can you say about javascript. I disabled it for all sites because of possible attacks like this. The Tor Bundle ships with Firefox as the browser, and includes the NoScript extension to Firefox that blocks scripting if the site is not in a user-maintained whitelist.

The problem is that disabling JavaScript by default breaks browsing for people who want to access sites that require JavaScript to work correctly. Most Tor users are simply concerned with anonymity, which means not having their actual IP address available to the site they are viewing. When you go through Tor, the origin address the other side sees is your Tor exit node, not your real IP. If you run the Tor bundle, click Addons. In the Addons window, select NoScipt, and click the Options button.

Uncheck the "Scripts allowed globally" box. JavaScript will now be off by default. NoScript will warn you if it has blocked JavaScript execution when you visit a site. Great explanation, but one further note -- you say "if you trust the site", but if the site is giving you content over http, then you really mean "if you trust the site, and also the network connection between you and site".

Rough world out there. That said, raising the bar does help. Unfortunately those who trusted the sites hosted on Freedom Hosting, and added them to a white list, got caught by this exploit. After today, JavaScript must be off in TOR at all times, because new vulnerabilities like this will pop up in the future. If you want to be private, you have to disable JS, no matter how trusted and secure a site may be.

There is no way around it now. FH was a trusted, untraceable onion hidden service.. TOR must ban JS completely starting today. If you use JS you can be caught by such buffer overflow exploits, and your real identity will be revealed. One should consider if banning JS from all browsers is not the right thing to do. If any malicious executable code can be run at will by JS, imagine what this could do in the hands of criminals.

It could install a keylogger on your pc with ease and gain access to your bank accounts, or worse. Another enormous vector is svg and pngs -- it is absolute crazy-talk to just blindly accept images from websites and render them. No reasonable person would allow images to load in their browser. The number of recent vulnerabilities in libpng alone should be enough to convince you. That said, I sound like a paranoid maniac in the above paragraph. But hopefully it will make you stop and think. How did we get to this point in browser security, and how do we recover from it?

Problem is, you want a browser that the dumb masses can use in every dumb web site Re: How do we recover from it? The best defense is a good offense. It is probably impossible to prevent all hostile surveillance - either by government or the private sector. But, you might consider making it worthless.

Send me meaningless messages, and I will just ignore and delete them. Suppose you developed an application that waited for your computer to be dormant for a certain period, then composed totally junk email using random words from a dictionary, and sent those messages to random people who use the application by using the application, you would consent to randomly receiving a bunch of junk.

You would clog surveillance servers with nonsense. Again, the surveillance folks would be clogged with junk. Now, if you want to make things interesting, search "phony research papers" and you find a site at MIT where you can enter your name and it will crank out a phony technical research paper. Total nonsense. Use those for the email messages. Want to make it more interesting, encrypt all the email with PGP.

For those - like me - who are truly malicious, generate the phony research paper, then use a word processor to change one of key words in the paper to "uranium deuteride," "virtual cathode oscillator," "high purity fluorine," "10 guage, high purity aluminum tubing, 3 inch ID," etc. So, just to make it "easier" to browse, TBB effectively facilitated this attack by having JS on my default despite cries for it to be disabled? Tails devs refused point blank to even add a bootcode to start Iceweasel with javascript off!

Did I not read above that if you had the most recent release of the TBB that you were immune to this attack? What it means is users should always make sure that they are using the latest release. The secure mode would automatically be enabled for. If you select the risky mode on non-Tor sites you should get a warning "Are you sure? There is a decent chance you will be putting yourself at risk" with continue, cancel options.

The advice given in the final two paragraphs of the above post explicitly and completely contradicts that given in the Tor Project FAQ : all emphasis mine "we recommend that even users who know how to use NoScript leave JavaScript enabled if possible, because a website or exit node can easily distinguish users who disable JavaScript from users who use Tor Browser bundle with its default settings thus users who disable JavaScript are less anonymous.

I am absolutely appalled that arma not only effectively endorsed, in general , this post that so contradicts the FAQ maintained by her organization but actually went-on, in a subsequent post, to clearly imply endorsement, specifically , of selective enabling of JavaScript while using Tor:.

Thats bullshit that if you disable JS you will be less anonymous. Just check EFF site doing browser fingerpainting. You have roughly none of them with that set-up. Noscript should be enabled by default or javascript should be disabled by default in tor browser bundle. I would also say I thought the same thing but I realized something so now I am not so sure that this was true with the TBB, but it was true with Vidalia Bundle which for some insane reason you no longer maintain and i have to add Polio in myself.

I think that is the confusion. The default home page already does detect if you are actually using TOR and if better versions are available. You could at least add a JavaScript add to detect and inform people that it is enabled. It can be easy to forget right after an update yet could cost them dearly. If they prefer it disabled then a simple how to could help yes I know it takes about 2 clicks but many users are tech impaired. Having NoScript disabled by default does make a certain sense in that is more usable by the tech impaired, yet there is a disconnect here when you consider the current method of PGP checking not that I recall noticing much good instruction on your site to begin with.

Sure it is easy enough for the technically inclined like myself, but what is the point of the average user getting into TOR while being so vulnerable to a compromised client? Not all these people will understand how to know the difference and good luck to the non-English speaking activists trying to figure out how to use PGP. I am working on this myself - mentally at this point. I may slap something good together that will help the less tech adept.

It would be better though more trustworthy if you guys handed this. It would not really be that hard. Another thing you might consider is an installer which ASKS people if they prefer things more secure or more compatible with websites. Depending on the question, pre-configure TBB as they have chosen. As for "it would not be that hard" for the PGP thing, consider that our current instructions for WIndows users start with "download gnupg.

Windows users are screwed at a very deep level. If you have good answers, the world wants to know them. Waaait a minute. You acknowledge that TBB never shipped with Javascript disabled, but then you say that the old Vidalia bundle did? The Vidalia bundle never included a browser! And the old Torbutton Firefox extension never shipped with Javascript disabled by default.

I think a lot of the confusion stems from people very long ago being confused between Java and Javascript. Also, very long ago before Torbutton , there were open questions about what privacy-invasive things Javascript could using the legitimate API, I mean do to you. Torbutton addressed many of them. NoScript is is enabled by default in both Tor Browser Bundle as well as Tails but set to allow scripts globally. Even in this configuration, NoScript still provides certain protections, such as blocking cross-site scripting XSS attacks[1].

Obviously, allowing scripts globally cannot provide anywhere near the same level of protection as the selective whitelisting model that is the normal default behavior of NoScript. The primary reason that has been given is usability; the functionality of many-- if not most web sites-- is heavily dependent upon JavaScript, often critically so.

An additional reason that has been given both by Tor as well as Tails officials concerns "fingerprintability". I believe-- but am not certain-- that NoScript would protect against this threat-- even in the default Tails and TBB configuration where scripts are allowed globally. Not sure if I am right about this, but over the past few months, I have been closely watching the following conversations -- all quite public in blog. Maybe there is a need for a public funding campaign, perhaps, to address certain ongoing security issues discussed in that post?

Supposedly Tor is looking for a lead software engineer and would like to hire more people. People ask questions about Dingledine. I think one way to address this meaningfully is for the Tor project to lean more on crowdfunding mechanisms to and more frequent appeals to the user base through social fora to participate in financing efforts to support and fix Tor.

Or perhaps you did not read the context of my post above, which had nothing to do with whether or not someone is updating something and everything to do with the issues of torbugs of all kinds and the problem of how to fund the fixing of them over time whenever they occur, whatever they are.

Also, I suggest reading this -- just for fun relevant to both java and javascript issues, which I think will be a long running discussion and are in no way settled :. How is Javascript different than Java? What is NoScript? TBB is designed to be standalone and not care what else is on your system. If you mean "I hacked up some Chrome thing and hooked it up to Tor, am I safe? I have the latest TBB. Any idea what is going on?

I have a 2. I am a spaz. Thank you for your prompt reply and kind assistance. There was a message up about server maintenance, but that is gone. I read that the exploit only effected versions 17 and 18 of FF - I am running Is this a browser that would be effected by the exploit?

It seems that the US police state has learned the ip addresses of people all over the world who committed the non-crime of visiting a bunch of websites. The US police state has hacked into computers of people living all over the world. What is the US state planning to do with the information they stole? We do try to keep up with browser updates for TBB, yes.

People who updated were fine. Find the version you were using if you can, maybe its still hanging around somewhere - the compressed installer. Find those numbers attached to it and line them up with the content of this blog. On or around July 30, , while I was at a certain website, my Tor Browser displayed a yellow ribbon just below the menu bar. In order to implement a crucial fix, this update resets your HTTPS Everywhere rule preferences to their default values.

The version of the TBB that I was using at the time is the latest version. My OS is Microsoft Windows 8, bit. That message is completely harmless. Same here. Interested if anyone else saw this or knows what it is about. I got the same message! Why the need to "reset to default values"? What should one do if they cant remember whether or not they used TOR over the last couple of weeks? No there isnt any way. Tor is designed not to keep logs for your own safety. But seriously.

If you cant remember whether or not you have used tor in the last week you should see a doctor. That depends. If you are using Windows then Windows uses an NTFS file system. Assuming this is turned on, it will update with the last time you accessed a file. Right click on a file and choose properties. If it is turned off - the date will be the same as the created date. If it is turned on, it will be the last time you accessed the file.

In the case of TBB, the last time you ran it. That can tell you or anyone with access to your computer when it was last ran. This is turned on by default in XP and I cannot remember if this is true of later versions of Windows.

Mine is turned off though and I suggest everyone turn theirs off. It is better that someone getting a hold of your computer does not know when the last time you access files is. But disabling this "feature" also improves Hard Drive performance and longevity since you are cutting out a write operation from every file read operation! I expect disabling this would also help laptop battery life to some extent. It is a terrible "feature. I will add one more thing. If you use Truecrypt to protect sensitive information and you also utilize keyfiles music files are good but random recorded radio noise is better then this "feature" makes it very, very easy to figure out your keyfiles.

Disable it NOW. Great Tor I never even thought about jailbait before I found Tor but then I got curious and looked at freedom hosting site and now I go to jail and get ass raped. Thanks for entrapment asshole. Tor promised me hot teenage action and all I got was raided by the feds! It depends on their age you dirty bastard!

I have no sympathy for sick fuckers who get ass raped in prison for seeking child porn, not everyone who uses TOR is into this shit. Have you not noticed that a lot of 13 year old girls look like hot 20 year old sluts? When will the pretending that they are not attractive end? When will it end putting people in prison just for looking at such hotties showing off? Those are your thoughts in your own head and not what the actual child of 13 is thinking! Girls that age throw tantrums, bitch a lot, cry a lot, they are mouthy and like boys around their own age.

Do us all a favour and use your brain when you look at youngsters. A photo of a teenage boy model in underwear can, and has been called child porn. Thing is that there is really a big line between CP and JB. There is a ton of sick CP of toddlers and babies being raped and very underage kids being generally exploited. On the other hand there is also a ton of JB and it is considered CP only by legal technicality. In reality it consists almost entirely of teenagers taking pictures of themselves naked and uploading to the internet.

Some small percent of them are blackmailed into doing so, some larger percent of them shared pictures with a boyfriend who shared it with the internet, but none of them are really raped and absued and a lot of them willingly and knowingly uploaded their own pictures. The biggest problem with Tor is that sites that host JB mix it in with tons of very disturbing and disgusting other shit that very few people who care about JB even want to look at.

There are tons of clearnet sites for JB and the feds totally ignore them, but the people looking at JB on Tor are all going to be fucked by this operation because the feds cannot tell them apart from the people looking at 6 month old getting brutally raped. Anybody with any fucking logic in their mind at all knows this, but these emotional thinking idiots control the world. Jailbait is very addictive.

It is best to never look at it even one time. Once you see fresh young teenagers you never want to go back to looking at old generally very rough looking adults in legal pornography. I have many friends who use Tor for various reasons not related to CP at all, and many of them have claimed to become addicted to jailbait after first finding it on Tor. Beauty depends on the specific woman, as it does at any age, and also involves who she is as a person. As my wife ages I still find her very attractive.

I have to agree with this. Not only are jailbait girls typically at the peak of their sexual attraction, but the feeling of doing something so illegal is very addictive as well. It reminds me of being young looking at porn for the first part of my life, trying to hide it from my parents.

Something forbidden and secret but so attractive and good feeling. I think the forbidden aspect is half the fun with jailbait, but most surely it is not all of it because I do find actual child pornography to be very disgusting and would not look at it even though it is also forbidden. Peak sexual attraction, plus bringing the rush back to pornography Also censorship.

Whenever you want to impose some restrictions on internet-users, just do it "for the children" and accuse your opponents of supporting pedophilia. Works like a charm. For the gay community to imply that boy-love is not homosexual love is ridiculous. Years earlier, the ILGA itself had resolved that "Young people have the right to sexual and social self-determination and that age of consent laws often operate to oppress and not to protect.

Note that the "love" being referred-to in the above quotes is little more than an Orwellian euphemism for the buggering and sodomizing of tender youth by adult males. I as young adult find that young adults like jailbait and old ass adults think it is horrible. Hardly any of my IRL male friends have not made comments about being attracted to under 18 year old teenagers, many of my internet friends who know about Tor have said they have looked at jailbait on it.

But for most old people they seem to think it is totally horrible. Total disconnection between age groups, the same as it is for drugs. If you are innocently looking at girls your own age, why do you have to do it on the TOR browser??? Most of us old ass people have children and idiots like you are a threat to them, when you grow up and have children of your own, only then will you understand. Please stick to the normal web where you can happily watch naked 18yr olds and not young teens who are being exploited, used and abused for your own selfish needs.

Nonetheless: 1. Considering that the vast, overwhelming majority of the population-at-large in just about any society finds such imagery nothing less than utterly repugnant, revolting, repulsive and deeply disturbing. Or does it help people who might have those urges, relief them without acting upon them? Well he might be. Same as with somebody who watches gore-videos or even Dexter. Regardless of that what you are talking about here is thought crime. Just imagine US-government or any government for that matter being able to prosecute or even "flag" people for what they think.

Imagine all sorts of power abuse that would then happen. And it would be even worse once they actually had the technology to read your thoughts. It was always possible at least in theory for people living in dictatorships to keep at least their thoughts free and overthrow the tyrants when the time was right.

Open the powers that be the way into your thoughts and there will be no escape. It is scientifically proven that in all countries that legalize possession and viewing of child porn, there is a sharp drop in child molestation rates, in every single country ever studied. Results from the Czech Republic showed, as seen everywhere else studied Canada, Croatia, Denmark, Germany, Finland, Hong Kong, Shanghai, Sweden, USA , that rape and other sex crimes have not increased following the legalization and wide availability of pornography.

And most significantly, the incidence of child sex abuse has fallen considerably since , when child pornography became readily accessible — a phenomenon also seen in Denmark and Japan. Above commentator and some others here may wish to post there. No registration required, only valid email try disposable.

Especially to respond to comments like this: "The reason we punish those that possess and traffic is because they are now more than in the past the consumers that drive the creation of the child porn. For the stupid person 2 above saying that the rates of rape and molestation have gone down ,you know why that is??

I believe the feds are after the Darknet drug markets much more than CP. Would you deny them the little respite and relief they claim that marijuana provides them? Current drug policy in many places does just that, leaving such people-- in misery-- with no alternative but the very "black markets" that you refer-to.

What about "taking down" some of the legal, sanctioned, privileged mega corporations that promote, glamorize and glorify this poison? Re: "money laundering": Can whatever Tor may facilitate in this regard even hold a candle to the likes of the Wall Street banksters or even or especially the Federal Reserve, the World Bank, etc.

And the prison-industrial complex; the ways in which a number of entities directly benefit from a drug policy that results in mass incarceration is an absolutely critical aspect that cannot be overlooked in any discussion of these matters. A typical post from a typical Tor user.

You are guys are really experts in this stuff. I am sorry you were hacked ;. Or said another way, the larger and broader the Tor user base gets, the less relevant this little subset is. Why is that not mentioned in the article or in any articles for that matter? Why is this not investigated? There could have been another exploit, different from this one in that page, one that still works in the latest version. More data is needed. All the ones in red are bad news. And most of the ones in red came out after Firefox 10 was abandoned.

Not to be paranoid but how do we not know that old Tor versions are safe and the new versions are actually planted with back doors? Reproduce the build environment and build it on your own machine. Are you even sure that, should there be anything suspicious in the code, that you would recognize it? Browser versions less than 17 WERE exploited by this. Does anybody know the contents of that file? Exactly, there is a lot of misinformation being spread on all official channels.

But that is clearly not the case if you read the code. I wonder why it was never obtained? If my browser was safe but I had a separate instance of FF open elsewhere, can the malicious javascript bleed through and phone home to the FBI from there? In a vulnerable browser, somebody could have written an exploit to take over your computer, and from there it could mess with any other running or not yet running applications. Since malicious client side scripts have no direct access to the underlying filesystem or OS of the client, they can not be transmitted across browsers.

However, if you have malicious bookmarks or addons installed and voluntarily transfer them, perhaps in ignorance, then the other browser is also vulnerable. And it depends if "malicious scripts installed" are at an OS level, or at a browser level. If something infects your OS, any application is vulnerable. So, with a older version of TBB with javascript disabled and ex on linux, a user would not be affected by this? Any knowledge as to whether EMET would have prevented the exploit from running?

Nobody has talked about this but the enhanced mitigation features are useful under Windows and should be common practice. People know it affected us through Javascript, because specifically it was a Javascript attack when visiting those sites. Events happened in the order of. Visit infected site 2. Malicious Javascript code awaits you, it attempts to launch! No, I saw the same message a couple of days ago and I was prodding around FH to see what was going on but noscript was always on.

Thing is, I updated my TBB today to It says "to implement a crucial fix https has reset to default rules" or similar. This is 64bit linux. A few days ago I also had this bar showing up. IIRC it was displayed as soon as the browser started and visited the check. I also made screenshots of this event. Quoting the poster before me: all i want to know if this was sent from TOR or because of this exploit. That is what I wish to know too. I was using the latest version of TBB at the time when I received the above "crucial fix" message but with JavaScript enabled.

Did that bar pop up when you visited a know infected site? Or was it randomly some other time? I am unable to answer this question as there is no way for me to tell whether the site that gave me the "crucial fix" error has been infected or not. I read that the sub-bar was one of the indicators that the exploit had been run on your browser. Sorry, you might want to nuke your hard drives :. Probably it was part of the last update of the extension. I got that popup after getting the newest TOR bundle today.

I disabled JS and all the other things and did not visit the infected sites on this new bundle. Was the update official or it was an attack? I even clicked it. I use FF It is not related to any exploit. It is not put there by any website one visited. Sorry if this has been asked already, but I only downloaded the Tor Browser Bundle a few days ago, so I presume I had the latest browser version, I just checked, and Javascript was enabled.

For non-Tor browsing, I use Firefox Am I safe from this exploit? Anon: "Would running Tails with Iceweasel They do work with NSA but also many other government agencies source: I used to work for them! The link in that article to the robtex. Can Torproject please fix the check.

Also, the notion that half the hidden services were hosted by FH is likely bunk. This TOR exploit thingy. Will it grab the ip of your computer on that network, like It grabs your hostname e. There is no reason to let the Tor Browser process or indeed, any process run by that user speak to the Internet.

Is it another process vidalia? If so, yes a firewall blocking tor browser outbound would be a really good idea. I was assuming Tor Browser itself makes the connection. So to prevent future exploits of this type, could torproject maybe show downloaders how to set the Windows firewall properly to block all outgoing connections it allows all by default except allow tor.

And mention if a window ever pops up to allow tbb-firefox. The other answer is to run Tails in a VM on Windows, if you really need to be running Windows in the first place. Hi, Once again sorry for being redundant, but I thought I would ask a broader question hoping that it would answer a lot of questions. If someone had Windows 7, Tor Browser Bundle 2.

No, the exploit was fixed in One question.. I have the ESR version The vulnerability was fixed in firefox So you are not at risk. So if one had turned off javascript on ones pre v 17 browser, that would have stopped the exploit from executing? Do we know Has somebody tested it against this particular exploit? I know as a programmer myself we like to indicate a bug is "fixed" but it really needs to be tested by others.

Any law experts around? Assuming this illegal exploit worked, what could they do with the IP list? Is a couple random visits to FH sites like, exploring hidden wiki links enough to warrant raids? Just wondering what exactly was the purpose of this illegal exploit, because clearly not all affected are guilty, even if they did visit some of the illegal sites once or twice by mistake or due to curiosity.

A raid on them would destroy their lives nevertheless. Can this list be used against international citizens? Would international agencies accept tips obtained this way? The code did change multiple times, did it not? And parts of it are not yet obtained. I am positive that this exploit is a small part of an overarching federal project. The NSA are doing the fishing in order to be able to connect the dots at a later date. They are looking for a couple hundreds of big fish, not thousands of small fish.

Apparently nobody knows what was in it, because it was never obtained. Because the code did not exit but loaded this page, one has to assume another version of this, or another exploit was indeed executed on Firefox versions below Therefore all the news and security reports that specifically claim this attack targeted version 17 only, are wrong.

Would Request Policy block this attack? Or maybe Request Policy handled iframes differently than the main page? Somebody would need to investigate. For those of us just hearing about Tor for the first time, help me understand this in non computer tech terms And if someone used Tor Bundle on windows during this time frame but had that little S in the top left corner clicked so a circle with a line was through it, are they still at risk?

Or did that turn off their script stuff? The presumable owner of Freedom Host was arrested July 29th and the malicious code was first noticed on August 4th. If you have the little "S" with a red slash through it, it is blocking scripts from executing and you are highly unlikely to have been affected. When 2. Yes, but did the.

Read the advisory for details. While the TBB may have made it easier for people to use Tor a good thing it has also made Tor into one big honeypot. The situation before TBB was that Tor users had basically no chance to secure themselves against a wide array of known attacks at the browser level. At least in this case we learned about the issue, and put out a patch that users could upgrade to, more than a month before it was exploited.

If we lived in a world where there existed a mainstream browser Firefox, Chrome, Safari, IE, something that actually addressed these application-level privacy attacks, I think this would be a worthwhile discussion to have. That sure would be nice to fix.

In any any event, you and I agree on the fundamentals. Now they are real. I see them as all equally bad. I am, and have been, running it for some time now. Probably Unrelated, Huh. Whatever it was has also Killed my Relay setup entirely Perhaps worse than that, every time I attempt to access certain of the now defunct. TemplarKnight tormail. I guess you have some list that you think is the entirety of the Tor hidden service list, and not many of those are reachable for you?

But at the same time, it sounds like your computer is broken in all sorts of ways? Sounds like you might want a reinstall, and maybe with a safer operating system. B "why [ They just took our name to try to trick people into thinking they were legitimate. And then they did a good enough job at never being reachable when we tried to contact them about it. YES, I went through SIX lists and I do realize that they did not encompass the entirety of the Onion HS sites, but I have been doing this for several months on a weekly basis and my estimate is fairly accurate.

The fact of the matter is that TOR Mail did work well enough that it became the accepted standard for secure email communications in the world. TOR will never be compromised by the Intelligence Mega-plex, simply because they use it themselves That is correct. Tor has not and will not be compromised as long as big corporations, businesses and government agencies use it. I feel safe enough using Tor Browser Bundle by itself with scripts disabled.

I think I downloaded tor within the dates in the advisory, but not sure. Click here to go to the download page". Is there any way that the exploit could still have run, as the advisory states that "the attack appears to collect the hostname and MAC address of the victim computer, send that to a remote webserver over a non-Tor connection, and then crash or exit.

The exploit does attempt to run on I need to report that five customers and counting have similar issues with tor-browser: 1. They had tor-browser crashes and windows reboots reported in early July. Why assume it is unrelated to the attacks in late July. All of these systems had up-to-date browsers with the most secure setting script etc. All show, after the window OS rebooted, MS was eager to send you a possible fix.

Is MS involved in this matter? Why not? Remember, the FEDS have full access, and they are the good guys. All via MS. They know who might be using the tor browser, based on the Metadata gathered, and the OS used as well. None of them had this problem prior to using the tor-browser back one year or more.

All used the browser for the first time very recently, because of the Snowden leaks. Dear FBI, I hijacked your exploit and started loading CP sites through Tor, each time I had the exploit code delivered but firewall rules and other mitigation techniques prevented it from phoning home, simultaneously with this I injected your exploit in users traffic through their clearnet exit nodes, framing them for viewing the CP.

I did this a great many times, always taking care to clear cookies and use a new circuit to your compromised hidden services. I started doing this almost as soon as I recognized what was going on, and has added what I imagine must be significant noise to your database of suspected pedophiles. Fact, many FBI or alike agents that work with cp all day end up with problems, and many of them end up getting caught with possession of cp!

I would just like to clarify that I run multiple exit nodes, they are not part of a family and I will not name them. My exit nodes carry traffic for a great many Tor users every day, and I have randomly exposed them to your exploit during the duration of your operation. I am not going to reveal the exact way in which I did this, but suffice to say I have seriously contaminated your database of harvested IP addresses.

That said I would also like to warn all users of Tor that you are very possibly in the database of the FBI even if you never loaded a child porn hidden service. I did this in order to confound their operation and provide plausible deniability to all targeted Tor users. I apologize in advance if the FBI kicks your doors down, but perhaps after they realize a great many of their targets are in fact not involved with CP, they will realize that their operation was a failure. If someone was always using the then most current version of TBB, would they have been at risk on any day?

As a user of Tormail, is there any way to find out if my real IP information has leaked out? Freedom of information request to the FBI? Name address, bank account and any other info that they have. We have been royaly shafted. Right, true. Unfortunately I have missed the update and used But I have the script blocker activated an usually no script is carried out.

Is there a risk that this attack can overcome this mechanism? But I think cookies can be received without having script enabled. Because v I also saw one cookie, under Torbutton cookie Protections, but it was maybe 2 or 3 weeks ago. I was checking everything in settings and so I saw one cookie there and I moved it. I know that for sure by from the file modified date of when I extract it and checked the version.

Is it normal there ever be a cookie under the Torbutton cookie protections? Learn more about Teams. How to use Tor combine with Java [closed] Ask Question. Asked 7 years, 6 months ago. Modified 4 years ago. Viewed 16k times. Improve this question. DimaSan Leo Le Leo Le 3 3 gold badges 13 13 silver badges 32 32 bronze badges. There are either too many possible answers, or good answers would be too long for this format.

Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs. Hi RGraham, I appreciate your comment. Can you help me? Why close this question? Add a comment. Sorted by: Reset to default. Highest score default Trending recent votes count more Date modified newest first Date created oldest first.

Improve this answer. Chris Dennett Chris Dennett Please tick my answer as the best answer if it helped you : — Chris Dennett. How can I start Tor service? I just find how to install Tor Browser on Linux torproject.