Opened 5 weeks ago

Last modified 4 weeks ago

#31716 new defect

Harden obfs4proxy.exe shipped with Tor Browser

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-rbm, tbb-security
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Right now we have something like

Checking obfs4proxy.exe for /DYNAMICBASE... FAIL
Checking obfs4proxy.exe for /NXCOMPAT... FAIL
Checking obfs4proxy.exe for /SAFESEH... PASS
Checking /obfs4proxy.exe ImageBase (0x400000 < 4GB)... FAIL

for 64bit versions and a similar output for 32bit ones. We should get rid of the FAILs.

Child Tickets

Change History (3)

comment:1 Changed 5 weeks ago by gk

For posterity here comes the 32bit output

Checking obfs4proxy.exe for /DYNAMICBASE... FAIL
Checking obfs4proxy.exe for /NXCOMPAT... FAIL
Checking obfs4proxy.exe for /SAFESEH... FAIL

comment:2 Changed 5 weeks ago by gk

Closed #16417 as a duplicate for this more specific one. Yawning's comment, however is probably still valid:

Anything that's Go based won't ever have either, because the upstream Go maintainers place way too much faith in their compiler and runtime to allow for such things. I think this is shortsighted and stupid (Golang binaries are also statically linked so ASLR seems somewhat less useful).

comment:3 Changed 4 weeks ago by cypherpunks

obfs4proxy.exe is a legacy /SUBSYSTEM:CONSOLE,4.0 app without .reloc section, running in a virtualized, "Windows NT 4.0"-compatible mode (as tor.exe).

https://github.com/golang/go/issues/27144 and https://github.com/golang/go/issues/27583

Last edited 4 weeks ago by cypherpunks (previous) (diff)
Note: See TracTickets for help on using tickets.