|15 Dec 2009||#1|
| || |
Google Chrome bug outs users seeking anonymity
A bug in the latest version of the Google Chrome browser could leak the identity of users trying to surf anonymously, developers warn.
The flaw means that domain-name queries are made by a user's local network even when Chrome is configured to used a third-party proxy. Users typically use proxies to conceal their local IP address in an attempt to browse anonymously. When the feature is set up, domain-name queries are supposed to be funneled through the proxy, rather than being made by a user's local network.
"This presents a serious risk for the users of the services such as Tor, as their DNS data and the little anonymity they have with Tor is leaked outside and in the clear," according to an advisory published Monday on the Full-Disclosure mailing list.
Short for the onion router, Tor is a free service that routes internet connections through an unpredictable series of IP addresses to prevent the true source of a user's connection from being detected. It is used by configuring a browser or other internet-facing application to use an IP address that belongs to the Tor project. Those using Chrome 220.127.116.11, the most recent version of the Google browser, receive no such protection.
There seems to be some confusion about what's causing the bug. According to the Full-Disclosure advisory, a feature known as DNS pre-fetching, which is enabled by default, is responsible for the loss of anonymity. But some developers participating in this discussion in a forum for Google's open-source Chromium browser say the vulnerability exists even when pre-fetching is disabled.
It's unclear when the hole might be patched.
"We're looking into fixing this issue," a Google spokesman said, "but it only potentially impacts a very small number of people who make use of anonymity services like Tor."
Those looking for more dependable anonymous browsing are better off using Firefox in concert with the Torbutton.
|My System Specs|
|Similar help and support threads for2: Google Chrome bug outs users seeking anonymity|
|Google to Give Chrome Users a Do-Not-Track Button||News|
|Google's Chrome Frame Lets IE Users Bypass Sysadmins||Security News|
|SpyEye Targets Opera, Google Chrome Users||System Security|
|Google Chrome v8 developer build hints at future of Chrome OS||News|
|Attackers prey on inexperienced Google Chrome users.||Security News|
|Zbot Desperately Seeking AIM Users.||Security News|
|Google Chrome bug outs users seeking anonymity.||Security News|
|Our Sites ||Site Links ||About Us ||Find Us |
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
All times are GMT -5. The time now is 08:54 PM.