|
Vulnerability anonymous Web surfing services Affected Anonymizer, Aixs, LPWA, etc. Description Richard M. Smith found very serious security holes in all of the major anonymous Web surfing services (Anonymizer, Aixs, LPWA, etc.). These security holes allow a Web site to obtain information about users that the anonymizing services are suppose to be hiding. This advisory provides complete details of the problem and offers a simple work-around for users until the security holes are fixed. This is more of a browser/Java issue. The best known of these services is the Anonymizer. However all four services tested (Anonymizer, Bell Labs, Naval Research Laboratory and Aixs) basically work in the same manner. They are intended to hide information from a Web site when visited by a user. The services prevent the Web site from seeing the IP address, host computer name, and cookies of a user. All the services act as proxies fetching pages from Web sites instead of users going directly to Web sites. The services make the promise that they don't pass private information along to Web sites. They also do no logging of Web sites that have been visited. Note that following was tested with Netscape 4.5. Unfortunately, it is possible get all four systems to fail when using Netscape 4.5. The most alarming failures occurred with the Anonymizer and Aixs systems. With the same small HTML page one is able to quietly turn off the anonymzing feature in both services. Once this page runs, it quickly redirects to a regular Web page of the Web site. Because the browser is no longer in anonymous mode, IP addresses and cookies are again sent from the user's browser to all Web servers. This security hole exists because both services fail to properly strip out embedded JavaScript code in all cases from HTML pages. With the Bell Labs and NRL systems it was found a different failure. With a simple JavaScript expression one is able to query the IP address and host name of the browser computer. The query can be done by calling the Java InetAddress class using the LiveConnect feature of Netscape Navigator. Once JavaScript has this information, it can easily be transmitted it back to a Web server as part of a URL. A demo on the use of Java InetAddress class to fetch the browser IP address and host name can be found at: http://www.alcrypto.co.uk/java/ Solution If you are a user of any these services, it is recommend that you turn off JavaScript, Java, and ActiveX controls in your browser before surfing the Web. This simple precaution will prevent any leaks of your IP address or cookies.