A recent Tor code security audit, conducted by Radically Open Security, has unearthed more than a dozen vulnerabilities, with a particularly high-risk flaw identified in the Onion Bandwidth Scanner (Onbasca). This comprehensive audit, executed between April and August 2023, delved into various components of the Tor anonymity network, covering the Tor browser, exit relays, exposed services, infrastructure, and testing tools. Among the 17 security issues detected, the most critical vulnerability involves a cross-site request forgery (CSRF) bug in Onbasca, allowing unauthenticated attackers to inject bridges into the database. This flaw poses significant risks, enabling potential attacks such as daemonizing the application or executing further malicious activities.
The identified security concerns span across medium- and low-risk categories, presenting potential threats like denial-of-service (DoS) attacks, security downgrades, and unauthorized access to information. The audit emphasizes the urgency of addressing these vulnerabilities promptly to enhance Tor’s overall security posture. This revelation follows a trend of heightened scrutiny on Tor’s security measures, with the audit highlighting the significance of protecting against emerging threats and ensuring the robustness of the network’s infrastructure. The findings underscore the importance of continual vigilance and proactive measures to secure Tor against potential exploits and attacks.
Of particular concern is the CSRF flaw affecting Onbasca, a bandwidth scanner used by directory authorities in maintaining a list of currently-running relays. Attackers could exploit this vulnerability by luring Directory Authorities victims to their site and executing a successful CSRF attack, injecting attacker-controlled IPs into the database. This revelation signifies the evolving landscape of cybersecurity threats and the need for the Tor community to stay vigilant and responsive to emerging vulnerabilities, emphasizing the critical role security audits play in maintaining the integrity of the anonymity network.
