Dr. Neal Krawetz reported on his blog, The Hacker Factor, that he identified problems in the Tor browser that may be working against the anonymity network’s stated goals. These issues cause the browser to disclose information that could potentially allow threat actors to profile Tor users.

One Size Doesn’t Fit All

Krawetz looked beyond the user string information provided by the browser in routine communications. While this string information is the same in all Tor browsers to enhance privacy, he looked at other parameters that the browser shared with a site, including screen size, window size and scrollbar thickness. These factors can vary depending on the OS, but it’s possible to ascertain user patterns by observing them.

For example, a normal browser setting has a window size that is less than the size of the screen; but Tor sets them equal to each other as part of its security stratagem. If a browser communicant notes that the two parameters have equal value, it are more likely to infer that it is dealing with a Tor setup. Krawetz also noted that the macOS Tor browser miscalculates the window size because of the dock menu on the screen.

Additionally, the scrollbar size value is unique for each version of Tor. Bleeping Computer reported that there is a default scrollbar thickness in macOS of 15 pixels, while scrollbars are 17 pixels thick in Windows 7, 8 and 10. Linux can vary between 10 and 16 pixels.

Is the Tor Browser Really Anonymous?

In 1883, Auguste Kerckhoffs formulated six principles for his military cryptography theory. One aspect states that a system “must not rely upon secrecy, and it must be able to fall into the enemy’s hands without disadvantage.”

The principle has been widened in use throughout the security field and remains as relevant as ever. In cybersecurity parlance, making some part of a system obscure will not, in turn, make it secure. If just finding something can defeat the system, you have already lost, and your system is not as secure as you believed.

Krawetz identified patterns that could tell an attacker that Tor is being used for communication. Kerckhoff would likely say, “So what? I’m using Tor and you still can’t identify me.”

While Krawetz’s threat model can be productive, Tor was never truly designed to hide the fact that it was being used. Rather, it was developed to conceal individuals’ use patterns.

Even with these parameters invoked, each OS variant of the Tor browser should look like any other. Ultimately, the Tor browser will still function the way it is supposed to.

More from

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…