[tor-bugs] #26212 [Applications/Tor Browser]: Use digital signature verification to prevent modification of omni.ja

[Tor Bug Tracker & Wiki]

#26212: Use digital signature verification to prevent modification of omni.ja
--------------------------------------+-----------------------------------
 Reporter:  indigotime                |          Owner:  tbb-team
     Type:  enhancement               |         Status:  needs_information
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:                            |  Actual Points:
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+-----------------------------------

Comment (by indigotime):

 Replying to [comment:4 gk]:
 > Rather you seem to be worried about an attacker taking one our our
 bundles (e.g. the Linux one), extracting the `omni.ja` files, inserting a
 backdoor and then redistributing that as Tor Browser? Is that reading of
 your bug report correct?
 Yes, that reading of my bug report is correct.

 > And why just the `omni.ja` files because the Firefox binary or any
 library could get corrupted as well serving malware?
 1) It's easier to modify omni.ja JavaScript modules rather than patching
 binaries/DLLs.
 2) For antivirus scanners, it's easier to detect malware in binary files.
 But you're right, DLL's signatures also should be verified at Tor Browser
 startup.

 >And as a side-effect: messing with those files will invalidate the GPG
 signature.
 I assume that many Tor Browser users are often ignorant about GPG
 signatures, and I don't see any way to make them verify those signatures.
 > So, I am not seeing how we win anything by deploying some elaborate
 signature scheme for omni.ja files.
 We can't protect Tor Browser executable from modification, but we can make
 Tor Browser files modification harder.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26212#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online