Penetration Test Report (iSEC): Tor Browser Bundle iSEC Deliverable 1.3 2

Tor Project
Tor Browser Bundle
Research Engagement
Prepared for:
Prepared by:
Tom Ritter — Principal Security Engineer
Andy Grant — Principal Security Engineer
iSECPartnersFinalReport—TorProjectTorBrowserBundle Page  of   
©     ,iSECPartners,Inc.
PreparedbyiSECPartners,Inc.forTorProject.Portionsofthisdocumentandthetemplatesusedinitsproduction
arethepropertyofiSECPartners,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,iSECPartners,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
containedherein. UseofiSECPartnersservicesdoesnotguaranteethesecurityofasystem,orthatcomputer
intrusionswillnotoccur.
May   ,     TorProjectConfidential Version  . 
iSECPartnersFinalReport—TorProjectTorBrowserBundle Page  of   
Table of Contents
ExecutiveSummary ........................................................ 
.  ProjectSummary ............................................................. 
.  RecommendationsSummary................................................... 
EngagementStructure ..................................................... 
.  InternalandExternalTeams ................................................... 
.  ProjectGoalsandScope ....................................................... 
DetailedResearchFindings................................................  
.  BugClassification.............................................................  
.  ExploitAnalysis ..............................................................  
.  SecuritySliderThoughts.......................................................  
.  CompilerHardening ..........................................................  
.  EnablingAssertions...........................................................  
.  MemoryAllocatorReplacement ................................................  
.  MediaFormats ...............................................................  
.  ProtocolHandlers ............................................................  
.  ExposedDOMObjectsEnumeration ............................................  
.   PreferenceComparison........................................................  
.   TBBTests....................................................................  
.   browser.fixup.alternate ........................................................  
Acknowledgments .........................................................  
Appendices ....................................................................  
A BugClassificationGlossary ................................................  
B TorBrowserBundleDOMTests............................................  
C CreateFixupURLCalls......................................................  
D ConfigurationSettingtoBlockAllRemoteJARFiles......................  
E EnableAssertionsPatches .................................................  
E.  SystemAssertions ............................................................  
May   ,     TorProjectConfidential Version  . 
iSECPartnersFinalReport—TorProjectTorBrowserBundle Page  of   
E.  nsCOMPtrAssertions .........................................................  
E.  JavaScriptEngineAssertions ...................................................  
F MemoryAllocatorReplacementPatches ..................................   
F.  ReplacementSample..........................................................   
F.  CTMallocReplacementLibrary.................................................   
G JavaScriptPreferenceOptions .............................................   
May   ,     TorProjectConfidential Version  . 
iSECPartnersFinalReport—TorProjectTorBrowserBundle Page  of   
Executive Summary
.  Project Summary
Open Technology Fund (OTF) engaged iSEC Partners for work with the Tor Project to evaluate Tor
BrowserBundle. AfterdiscussionswithMikePerryatTorProject,itwasdeterminedthatthebestuse
oftimewouldbetoconductamoreresearch-orientedengagement,lookingathowexploitationmay
bemademoredifficultonTorBrowserBundle,aimingtoproviderecommendationsforanupcoming
``SecuritySlider''feature. 
Note: Tor Browser Bundle is based on the Firefox browser. In this document, iSEC has used ``Tor
BrowserBundle''whenitisspeakingspecificallyaboutthebrowserdistributedbytheTorProject,and
``Firefox''whenspeakingaboutfeaturesthatapplytobothdistributions.
TheSecuritySliderwillaimtodisablecertainfeaturesofTorBrowserBundleathigherlevelsofsecurity.
To this end, iSEC was granted access to many private bugs on the Mozilla bug tracking software to
catalogpastvulnerabilitiesofFirefoxbytypeandcomponent. Duringthisprocess,iSECalsoanalyzed
severalpublicandprivateexploitsagainstTorBrowserBundleandFirefoxtoinvestigateiftherewere
anysignificantcommonalitiesthatcouldguidehardeningrecommendations.
Firefox has a robust set of preferences for controlling features through the about:config interface.
Several preferences relevant for the security slider are enumerated later in this report. While many
ofthefeaturesTorProjectmaywishtodisableorcontrolareexposedthroughthesesettings, many
are not. Therefore, iSEC examined different approaches to add these settings to the codebase, and
developedpatchesincertaininstances.
iSECalsolookedatmoregeneralhardeningoptionsthatcanbemadetoTorBrowserBundle.Compiler
settingsthatincludestrictmemorychecksarebeingexploredbytheTorProjectalready,andinclude
buildingTorBrowserBundlewithAddressSanitizer  -twoitemsthatcanbeaddedtothislistarethe
WindowssettingEnableTerminationOnHeapCorruptionandanexperimentalfeatureinGCCnamed
VirtualTableVerification. Additionally,iSECconfirmedthatAddressSpaceLayoutRandomization,a
best-practicefeatureformakingexploitationmoredifficult,iscurrentlyomittedonWindowsandMac
builds.
AnothergeneralhardeningoptioniSECinvestigatedwasreplacingTorBrowserBundle'smemoryal-
locator,jemalloc,withahardenedallocator. PartitionAlloc,  developedbytheChromeSecurityteam
appearstobeagoodbaseforimprovingsecuritythroughitsfeature-set.
Severalothertaskswereperformed,includingsuggestingwaystodetectregressionsinexposedDOM
objects that may aid in user fingerprinting, and developing patches to enable assertions in specific
criticalcomponents.
https://trac.torproject.org/projects/tor/ticket/9387
https://trac.torproject.org/projects/tor/ticket/10599
https://chromium.googlesource.com/chromium/blink/+/master/Source/wtf/PartitionAlloc.h
May   ,     TorProjectConfidential Version  . 
iSECPartnersFinalReport—TorProjectTorBrowserBundle Page  of   
.  Recommendations Summary
Browsershaveevolvedincomplexitytremendouslyoverthepastdecade,andtheTorProjectisinavery
difficult situation with regards to it. Their ultimate goals of preventing fingerprintability and proxy
leaks are not universally shared by Mozilla and the Tor Project development team is much smaller.
The aggressive release of Firefox versions is offset by their Extended Support Releases, but this still
necessitatesalargeevaluationofnewfeaturesandpatch-reconfiguringevery   months.Furthermore,
theTorProjectisintheprocessofdevelopingsignificantfeaturesontopofTorBrowserBundle-the
newTorLauncher,automaticupdates,andtheSecuritySlider.
In short, the road Tor Project is embarking on will be difficult to continue while maintaining high
securitystandardswithoutconsiderablecooperationwithMozilla,asustainabledevelopmentgroup,
andperiodicinvolvementfromspecializedindividuals.
ShortTerm
Forthepurposeofthisresearchdocument,short-termrecommendationsaremeanttobeundertaken
onthe  -  monthtimeline. Whileallrecommendationsinthisreportarelongerterminrelationto
typicalvulnerabilityremediation,thisareaisasummaryofstrategicrecommendationsthatshouldbe
takenintheshorttermtoguidedevelopmenteffortsandprotectusers.
Re-enable Address Space Layout Randomization on Windows and Mac builds. Currently Tor
Browser Bundle builds for Windows or Mac do not have ASLR enabled universally. ASLR is a best-
practiceforbrowsers,andomittingitmakesitsignificantlyeasierforattackerstobypass