Beware of fake TOR Browser

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiBt1QSL4HNFa20maeD7wyQDw2r2V4OHLUj5f8HZFqobA9UOzm1cs5sK2XQY5LjYLr0yRTjR3rmAHmXEZgZC4M374lwKSPLPDWMAeYjI3MKtAZdb9EtYBhMOkviwmdrVFwVTWCKM5OFj-k/s1600/fake+tor+browser.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhiBt1QSL4HNFa20maeD7wyQDw2r2V4OHLUj5f8HZFqobA9UOzm1cs5sK2XQY5LjYLr0yRTjR3rmAHmXEZgZC4M374lwKSPLPDWMAeYjI3MKtAZdb9EtYBhMOkviwmdrVFwVTWCKM5OFj-k/s1600/fake+tor+browser.png" width="320" /></a></div> Members of the Tor anonymity service are warning that a <a href="http://www.hackerschronicle.com/search/label/Tor">Tor</a> iOS app available in Apple's highly curated App Store since November is a fake that is laced with adware and spyware.<br /> <br /> "Tor Browser in the <a href="http://www.hackerschronicle.com/search/label/Apple">Apple</a> App Store is fake," a <a href="https://trac.torproject.org/projects/tor/ticket/10549">report ticket published two months ago</a> on the Tor website by high-ranking volunteer Phobos stated. "It's full of adware and spyware. Two users have called to complain. We should have it removed."<br /> <br /> The ticket went on to say that Tor officials notified Apple of the <a href="https://itunes.apple.com/us/app/tor-browser/id712805884?mt=8">fake Tor Browser app</a> in December. In the intervening time, the app has remained available, touching off a series of exchanges among Tor members about how to respond. Ars was unable to confirm the claims of <a href="http://www.hackerschronicle.com/search/label/Malware">adware</a> or spyware. Still, the incident highlights the lack of transparency in the way that Apple vets the reliability of security apps and responds to complaints of rogue titles.<br /> <br /> "Apple responded today with chance for author to defend their app," one volunteer wrote shortly after the ticket was opened. "Sent another email to appstorenotices@," Phobos replied a few weeks later.<br /> Early Wednesday, some two months later, yet another Tor member wrote: "I think naming and shaming is now in order. Apple has been putting users at risk for months now." Another member quickly replied: "I mailed Window Snyder and Jon Callas to see if they can get us past the bureaucracy. Otherwise I guess plan C is to get high-profile people on Twitter to ask Apple why it likes harming people who care about privacy. (I hope plan B works.)"<br /> <br /> (Window Snyder and Jon Callas are both highly respected security researchers who have worked for Apple in the past. Callas has since left the company and is an executive with Silent Circle. <strong>Update:</strong> Snyder still works for the Cupertino company. In the past, she has worked for both <a href="http://www.hackerschronicle.com/search/label/Microsoft" target="_blank">Microsoft</a> and <a href="http://www.hackerschronicle.com/search/label/Mozilla" target="_blank">Mozilla</a>.)<br /> <h3> Secret garden</h3> Apple's App Store has long been referred to by critics and fans alike as a walled garden. The metaphor is used to describe the highly controlled environment of the official iOS app bazaar. Presumably, apps submitted by third-party developers are carefully scrutinized before they become available. That's in sharp contrast to the official Google Play store for Android, which is much less selective and where rogue or malicious apps regularly slip through the vetting process.<br /> <br /> Apple has never described exactly what its process is for ensuring the titles in its App Store are safe. Although the comparatively fewer reports of rogue apps for iOS suggest that the review process is more stringent than Google's, the report ticket from Tor's high-ranking members suggests that Apple may not be doing everything it can or should do to protect iPhone and iPad users.<br /> <br /> Fortunately, the <a href="http://www.hackerschronicle.com/search/label/Tor%20Browser">Tor Browser</a> app at issue has been downloaded a relatively small number of times, and so far there are no reports one way or the other that its behavior represents a serious threat to the people who have installed it. Still, its availability raises questions about exactly what Apple does to ensure the security and authenticity of other apps it hosts on its own servers. This article will be updated if Apple officials, who are routinely silent on such matters, respond to our request for comment.</div>

Fake Tools Tor Tor Browser Beware of fake TOR Browser

Members of the Tor anonymity service are warning that a Tor iOS app available in Apple's highly curated App Store since November is ...

Read more »

Tor develops its own anonymous Messenger

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJzH6v0uRoXN15MFZggZepo4zm0mGk5KG2yYIm9aTnP-lqdVTdn1IeqQ1fZsKJmMhCI1QaUcm8uN7BdJRqZKzobT5SY2tsYHlErxF3srXaNBWJkJSrYUoVqSwh7nXPJ8lO4azOoLx6L9Do/s1600/TOR-Messenger.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="The Instantbird IM tool will be the basis of the Tor Project's new anonymizing IM client." border="0" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJzH6v0uRoXN15MFZggZepo4zm0mGk5KG2yYIm9aTnP-lqdVTdn1IeqQ1fZsKJmMhCI1QaUcm8uN7BdJRqZKzobT5SY2tsYHlErxF3srXaNBWJkJSrYUoVqSwh7nXPJ8lO4azOoLx6L9Do/s1600/TOR-Messenger.jpg" title="Service will force instant message traffic over Tor's network to evade surveillance." width="640" /></a></div> <br /> The Tor Foundation is moving forward with a plan to provide its own instant messaging service. Called the Tor Instant Messaging Bundle, the tool will allow people to communicate in real time while preserving anonymity by using chat servers concealed within Tor’s hidden network.<br /> In planning since last July—as news of the National Security Agency’s broad surveillance of instant messaging traffic emerged—the Tor Instant Messaging Bundle (TIMB) should be available in experimental builds by the end of March, based on a <a href="https://trac.torproject.org/projects/tor/wiki/org/meetings/2014WinterDevMeeting/notes/RoadmapTIMB" target="_blank">roadmap</a> published in conjunction with the <a href="https://trac.torproject.org/projects/tor/wiki/org/meetings/2014WinterDevMeeting" target="_blank">Tor Project’s Winter Dev meeting in Iceland</a>.<br /> TIMB will connect to instant messaging servers configured as Tor “hidden services” as well as to commercial IM services on the open Internet.<br /> The effort, which is funded by an <a href="https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorO" target="_blank">anonymous donor organization</a>, was originally called <a href="https://trac.torproject.org/projects/tor/wiki/org/sponsors/Otter/Attentive/Plan" target="_blank">Attentive Otter</a>. To ensure the anonymity of the user, TIMB will force all instant messaging traffic through the Tor network, regardless of whether it’s aimed at a server on the Tor network or not. TIMB will be based on <a href="http://www.instantbird.org/" target="_blank">Instantbird</a>, an open source instant messaging tool which is itself based on <a href="http://www.hackerschronicle.com/search/label/Mozilla" target="_blank">Mozilla’s</a> <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/XULRunner" target="_blank">XULrunner</a> cross-platform runtime environment.<br /> Instantbird was chosen after the TIMB team decided against using Pidgin or <a href="https://developer.pidgin.im/wiki/WhatIsLibpurple" target="_blank">libpurple</a>, the GPL open-source instant messaging library used by Pidgin and Adium, mostly because of the amount of effort that would have been required to audit and maintain the library, and also because of <a href="https://lists.torproject.org/pipermail/tor-dev/2013-October/005544.html" target="_blank">some concerns about how seriously Pidgin’s developers took security concerns</a>. The TIMB project will remove libpurple from Instantbird, a task that the Mozilla and Instantbird team were already working toward as they move the software to a pure JavaScript implementation.<br /> The first experimental release of TIMB won’t include “<a href="https://otr.cypherpunks.ca/" target="_blank">off the record” (OTR) capability</a>. OTR mode encrypts traffic further and uses an exchange of digital signatures to verify the identity of each party. But the signatures can’t be checked by anyone outside the instant messaging session and can’t be used to prove identity outside the session. The Tor team is hoping to develop OTR components for Instantbird and get them merged into future versions of the main Instantbird code line.</div>

Anonymous Mozilla News Tor Tor Instant Messager Tor develops its own anonymous Messenger

The Tor Foundation is moving forward with a plan to provide its own instant messaging service. Called the Tor Instant Messaging Bundle, ...

Read more »