Opened 11 months ago

Last modified 2 months ago

#31716 new defect

Harden obfs4proxy.exe shipped with Tor Browser

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-rbm, tbb-security, gitlab-tb-tor-browser-build
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Right now we have something like

Checking obfs4proxy.exe for /DYNAMICBASE... FAIL
Checking obfs4proxy.exe for /NXCOMPAT... FAIL
Checking obfs4proxy.exe for /SAFESEH... PASS
Checking /obfs4proxy.exe ImageBase (0x400000 < 4GB)... FAIL

for 64bit versions and a similar output for 32bit ones. We should get rid of the FAILs.

Child Tickets

Change History (7)

comment:1 Changed 11 months ago by gk

For posterity here comes the 32bit output

Checking obfs4proxy.exe for /DYNAMICBASE... FAIL
Checking obfs4proxy.exe for /NXCOMPAT... FAIL
Checking obfs4proxy.exe for /SAFESEH... FAIL

comment:2 Changed 11 months ago by gk

Closed #16417 as a duplicate for this more specific one. Yawning's comment, however is probably still valid:

Anything that's Go based won't ever have either, because the upstream Go maintainers place way too much faith in their compiler and runtime to allow for such things. I think this is shortsighted and stupid (Golang binaries are also statically linked so ASLR seems somewhat less useful).

comment:3 Changed 11 months ago by cypherpunks

obfs4proxy.exe is a legacy /SUBSYSTEM:CONSOLE,4.0 app without .reloc section, running in a virtualized, "Windows NT 4.0"-compatible mode (as tor.exe).

https://github.com/golang/go/issues/27144 and https://github.com/golang/go/issues/27583

Last edited 11 months ago by cypherpunks (previous) (diff)

comment:4 Changed 3 months ago by cypherpunks

Since Go 1.13: The Windows version specified by internally-linked Windows binaries is now Windows 7 rather than NT 4.0.

comment:5 Changed 3 months ago by cypherpunks

Since Go 1.14: Go binaries on Windows now have DEP (Data Execution Prevention) enabled.

comment:6 Changed 3 months ago by cypherpunks

Since Go 1.15: Go now generates Windows ASLR executables by default.
ticket:29694#comment:4

comment:7 Changed 2 months ago by gk

Keywords: gitlab-tb-tor-browser-build added

Add magic gitlab keyword.

Note: See TracTickets for help on using tickets.