EFF: Phony HTTPS Everywhere Extension Used in Fake Tor Browser

Phony HTTPS Everywhere Extension Used in Fake Tor Browser

ESET researchers recently discovered a false “trojanized” version of Tor Browser that collectively stole $40,000 USD in Bitcoin.

This does not mean that Tor or Tor Browser itself is compromised in any way. It only means that attackers found a new, insidious way to create and distribute a fake version of the Tor Browser. In this case, attackers also faked EFF’s own HTTPS Everywhere extension using a modified manifest.json file with a few settings changes. The attackers used a fake HTTPS Everywhere extension in their campaign because Tor does in fact package the HTTPS Everywhere and No Script extensions into its browser. Including details like normal extensions in the trojanized version of Tor could prevent eagle-eyed users from catching red flags that indicate they’re using a fake browser.

Nefarious HTTPS Everywhere Code

The manifest.json file in web extensions states explicit permissions and scope of activity the web extension will commit. In this attack, this modified file widened the scope by adding content scripts. This allows the extension to load scripts into the browser and potentially modify what the user sees and interacts with on various web pages.

HTTPS Everywhere Manifest Comparison Photo Credit:  https://www.welivesecurity.com/2019/10/18/fleecing-onion-trojanized-tor-browser/

Left: Real manifest.json  Right: Fake manifest.json


In this case, this content script notified the attacker's C&C (Command and Control) server and in return loaded further scripts that modify the user's experience: in this case, changing wallet addresses on the commonly used Russian money transfer service QIWI, or on Bitcoin wallets located on various Darknet markets.

Trojanized Tor Browser

This malicious download of Tor is older (version 7.5) with its xpinstall.signatures.required settings set to false, which disables a digital signature check for installed Tor Browser add-ons and bypasses the HTTPS Everywhere signature check.

This modified version of the Tor Browser targeted Russian-speaking users and presented them with “out of date” warnings. This prompted some to click a button to “update” to the trojanized Tor browser at the fake domains tor-browser[.]org and torproect[.]org. (The authentic domain is torproject.org.)


Researchers discovered advertisements promoting the fake Tor Browser in spam messages on Russian forums, covering topics such as darknet markets, cryptocurrencies, internet privacy and censorship circumvention. The advertisements falsely promised to help users bypass CAPTCHA and Roskomnadzor, a Russian censorship body in media and telecommunications.

Spam message in forum Photo Credit: https://www.welivesecurity.com/2019/10/18/fleecing-onion-trojanized-tor-browser/

Spam message promoted in Russian Forums

The most insidious part of these advertisements was tricking people into believing that the trojanized Tor Browser would guarantee anonymity. In fact, the attackers behind this trojanized Tor Browser set a unique identifier in the modifications: a custom user-agent, a text-based identifier that allows other hosts to see what software and operating system the user has. So even though the real Tor proxy was still present in this browser, ultimately anonymizing user’s I.P. addresses, this custom user-agent allowed the attackers to create and track a very specific fingerprint on their victims. That also means that any victims using this malicious browser could still be fingerprinted and tracked by a myriad of other observers.

Conclusion

This campaign relied on the user not catching a few red flags that indicate a potentially fake or malicious Tor Browser but are easy to miss. Some of these red flags include:

  • Fake domains for downloading Tor browser
  • Unverified signature for the download
  • Outdated Tor Browser version
  • Non-AMO (Mozilla Add-ons Store), unverified HTTPS Everywhere extension
  • Modified scope of HTTPS Everywhere permissions and activity
  • Likely no NoScript extension present to block Javascript (Assumed from report)

Even though this was a targeted, atypical attack, it may still concern some users. With these red flags in mind, here are some tips and helpful links to ensure you are using the proper Tor Browser:

  • Tor also normally announces updates via their blog: https://blog.torproject.org/new-release-tor-browser-90
  • Which add-ons are allowed in Tor currently?
    • At the time of this post, the only add-ons bundled with Tor are the HTTPS Everywhere and No Script extensions. Installing any other add-on could de-anonymize you.

Comments

Post a Comment

Popular posts from this blog

EFF: No Digital Surveillance of Iranians at the U.S. Border—or Within the U.S.

No Digital Surveillance of Iranians at the U.S. Border—or Within the U.S. Only days into heightened tensions between the United States and Iran, media outlets have published disturbing reports of increased scrutiny of people of Iranian descent at U.S. borders, including in at least one case involving a traveler’s phone. EFF strongly opposes any targeting of people for digital surveillance based on their race, religion, or nationality, at our border and in our interior. And we remind all members of the public to practice surveillance self-defense. Disturbing Reports from the Border On January 5, media outlets reported that more than 60 people of Iranian descent, including U.S. citizens, were held at the border between Canada and Washington state for many hours and questioned about their perceived connections to Iran. U.S. Customs and Border Protection (CBP) denied that it detained or refused entry to Iranians based on their national origin, a claim contested by accounts f
Read more

EFF: Corporate Speech Police Are Not the Answer to Online Hate

Corporate Speech Police Are Not the Answer to Online Hate A coalition of civil rights and public interest groups issued recommendations today on policies they believe Internet intermediaries should adopt to try to address hate online. While there’s much of value in these recommendations, EFF does not and cannot support the full document. Because we deeply respect these organizations, the work they do, and the work we often do together; and because we think the discussion over how to support online expression—including ensuring that some voices aren’t drowned out by harassment or threats—is an important one, we want to explain our position. We agree that online speech is not always pretty—sometimes it’s extremely ugly and causes real world harm. The effects of this kind of speech are often disproportionately felt by communities for whom the Internet has also provided invaluable tools to organize, educate, and connect. Systemic discrimination does not disappear and can even be ampl
Read more

Living on the (IT) Edge: Schneider Electric at HPE Discover 2018

Image
We’re here at HPE Discover 2018 , proudly sponsoring the event and enjoying a jam-packed few days in Las Vegas. The data center industry has experienced tremendous disruption in the last decade. The fourth Industrial Revolution, with its IT/OT convergence, the proliferation of IoT, and insatiable demand for digital connectivity, is creating the opportunity to push the envelope of performance beyond the obvious and create new business value. And there’s no bigger opportunity right now than at the edge. At the same time, these new paradigms are also driving more complexity: companies today are trying to manage a combination of environments, from large centralized data centers on-premises or in the cloud, regional edge data centers, to local edge data centers. We have more data centers, intertwined across more locations, and with more data, than ever before. All of this adds up to promising opportunities on the horizon for our customers – but an equally daunting number of new challenges
Read more