May 4, 2017 By Larry Loeb 2 min read

Dr. Neal Krawetz reported on his blog, The Hacker Factor, that he identified problems in the Tor browser that may be working against the anonymity network’s stated goals. These issues cause the browser to disclose information that could potentially allow threat actors to profile Tor users.

One Size Doesn’t Fit All

Krawetz looked beyond the user string information provided by the browser in routine communications. While this string information is the same in all Tor browsers to enhance privacy, he looked at other parameters that the browser shared with a site, including screen size, window size and scrollbar thickness. These factors can vary depending on the OS, but it’s possible to ascertain user patterns by observing them.

For example, a normal browser setting has a window size that is less than the size of the screen; but Tor sets them equal to each other as part of its security stratagem. If a browser communicant notes that the two parameters have equal value, it are more likely to infer that it is dealing with a Tor setup. Krawetz also noted that the macOS Tor browser miscalculates the window size because of the dock menu on the screen.

Additionally, the scrollbar size value is unique for each version of Tor. Bleeping Computer reported that there is a default scrollbar thickness in macOS of 15 pixels, while scrollbars are 17 pixels thick in Windows 7, 8 and 10. Linux can vary between 10 and 16 pixels.

Is the Tor Browser Really Anonymous?

In 1883, Auguste Kerckhoffs formulated six principles for his military cryptography theory. One aspect states that a system “must not rely upon secrecy, and it must be able to fall into the enemy’s hands without disadvantage.”

The principle has been widened in use throughout the security field and remains as relevant as ever. In cybersecurity parlance, making some part of a system obscure will not, in turn, make it secure. If just finding something can defeat the system, you have already lost, and your system is not as secure as you believed.

Krawetz identified patterns that could tell an attacker that Tor is being used for communication. Kerckhoff would likely say, “So what? I’m using Tor and you still can’t identify me.”

While Krawetz’s threat model can be productive, Tor was never truly designed to hide the fact that it was being used. Rather, it was developed to conceal individuals’ use patterns.

Even with these parameters invoked, each OS variant of the Tor browser should look like any other. Ultimately, the Tor browser will still function the way it is supposed to.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today