That [title] is a weird thing to take as main message from that advisory. The Firefox exploit that was used would have worked on Linux just as well; it was simply only targeted at Windows this time.
I agree that switching away from Windows is generally a good idea, but only a hardware-based router, or a software based VM isolation solution like Whonix or Qubes OS would have defended the user in this case. Even Tails, the Tor live USB distribution could have gotten owned by this exploit, had the NSA/FBI/hackers chosen to target them.
How exactly does a hardware based router help? Is the idea that TOR is running on separate hardware, and despite the local system being compromised, the attacker can't "phone out" to find the real IP address?
I was surprised that Windows was the target OS -- I had figured that most Tor users were using Tails at this point. I'm sure that whoever targeted the user group they meant to capture, though, had a good idea of their general usage patterns.
Wouldn't disabling JavaScript have also prevented this exploit? I don't know if FireFox still runs JavaScript through an interpreter if the user has disabled it; I'd assume not, but it wouldn't come as a shock to me if it did.
Does the Qubes Tor container egress filter non-Tor traffic? If it does not, it would still be susceptible to a linux-specific version of this same attack.
Does this mean that Linux, and other Unix variants (but not Mac OS of course, because Apple plays ball), will be classified as a "Hacker Tool" in the eyes of the law?
[+] [-] computer|12 years ago|reply
I agree that switching away from Windows is generally a good idea, but only a hardware-based router, or a software based VM isolation solution like Whonix or Qubes OS would have defended the user in this case. Even Tails, the Tor live USB distribution could have gotten owned by this exploit, had the NSA/FBI/hackers chosen to target them.
[+] [-] doctorfoo|12 years ago|reply
[+] [-] rmrfrmrf|12 years ago|reply
Wouldn't disabling JavaScript have also prevented this exploit? I don't know if FireFox still runs JavaScript through an interpreter if the user has disabled it; I'd assume not, but it wouldn't come as a shock to me if it did.
[+] [-] Torgo|12 years ago|reply
[+] [-] negativity|12 years ago|reply
[+] [-] sobkas|12 years ago|reply
[+] [-] pessimizer|12 years ago|reply
[+] [-] conexions|12 years ago|reply
[+] [-] shmerl|12 years ago|reply
[+] [-] blahbl4hblah|12 years ago|reply
[deleted]