A serious Tor browser flaw leaks users' real IP addresses

A newly-discovered bug exposes the real-world IP addresses of those who are using the Tor browser, used by millions for anonymity and private browsing.

The bug, called TorMoil by security firm We Are Segment, which discovered it, is triggered when a user clicks on a local file-based address, like file://, rather than http:// or https://. If a user clicks on a specially crafted web page, "the operating system may directly connect to the remote host, bypassing Tor Browser," said the short vulnerability disclosure report.

The Tor Project, which maintains the anonymity-focused browser app, issued a security release for macOS and Linux users, which are largely affected by the vulnerability.

But the non-profit group said it was "only partially fixed" by blocking access to users who navigate to file:// addresses in the browser.

The bug stems from a Firefox bug (the bug report remains private while a permanent fix is found), which shares code with the Tor Project. Details of the bug are being kept under wraps, by both Tor and the security researchers, until the majority of users update the software.

Tor said that there has been no evidence that the vulnerability is being exploited in the wild.

A permanent bug fix is expected to be released later Monday.

ZDNET INVESTIGATIONS

Researchers say a breathalyzer has flaws, casting doubt on countless convictions

Lawsuits threaten infosec research — just when we need it most

NSA's Ragtime program targets Americans, leaked files show

Leaked TSA documents reveal New York airport's wave of security lapses

US government pushed tech firms to hand over source code

Millions of Verizon customer records exposed in security lapse

Meet the shadowy tech brokers that deliver your data to the NSA

Inside the global terror watchlist that secretly shadows millions

198 million Americans hit by 'largest ever' voter records leak

Britain has passed the 'most extreme surveillance law ever passed in a democracy'

Microsoft says 'no known ransomware' runs on Windows 10 S — so we tried to hack it

Leaked document reveals UK plans for wider internet surveillance

• Researchers say a breathalyzer has flaws, casting doubt on countless convictions
• Lawsuits threaten infosec research — just when we need it most
• NSA's Ragtime program targets Americans, leaked files show
• Leaked TSA documents reveal New York airport's wave of security lapses
• US government pushed tech firms to hand over source code
• Millions of Verizon customer records exposed in security lapse
• Meet the shadowy tech brokers that deliver your data to the NSA
• Inside the global terror watchlist that secretly shadows millions
• 198 million Americans hit by 'largest ever' voter records leak
• Britain has passed the 'most extreme surveillance law ever passed in a democracy'
• Microsoft says 'no known ransomware' runs on Windows 10 S — so we tried to hack it
• Leaked document reveals UK plans for wider internet surveillance