#Tor for android 2.3.5 update#
#Tor for android 2.3.5 software#
#Tor for android 2.3.5 download#

#Tor for android 2.3.5 software#

It also enables software developers to create new communication tools with built-in privacy features. See the newest article on mobile Tor browsers from June 28th for more information about the IP leakage problem.Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. Also, a change in the spelling of Tor was made because sometimes it was called TOR which is in fact useful to distinguish between the German translation and the Tor Project.Ĭaution: This information was brought to you by xordern.

Some paragraphs were renewed to make the problem more clear. To my knowledge the filtering has never been brought to the PlayStore. This means multimedia tags still bypass the Tor connection on most platforms.Ĭall commented out in revision 26a8b47e (, diff) Moreover, the tags could be added again with JavaScript if enabled.įiltering in removeUnproxyeableElements ofĭespite this won't work, the function isn't called anymore. Nevertheless, it won't fix the issue because video would still get a valid

#Tor for android 2.3.5 update#

UPDATE 2 : Android 2.3.5 (Gingerbread) and 4.2 are also vulnerable. Finally, this leads to DNS and HTTP GET requests being performed outside Tor with the user-agentĪpache-HttpClient/UNAVAILABLE (java 1.5).

#Tor for android 2.3.5 download#

Some downloads are also performed outside Tor because the browser finally uses the internal Android Download Manager Second problem occurs via Media Download:ĭownloads being performed without Tor - extended check The latter had the same problem with enabled HTML5 multimedia elements and it has some issues ( 1, 2) until now. The apps ' Connect Tor' (Android) and the ' Onion Browser' (iPhone) are also affected by the same issues as Orweb. However, this won't help much against other specific http header side information. UPDATE 3 (June 18th, 2014): If you had a rooted smartphone, an alternative solution to address the leak would be setting specificly Orweb for transparent proxying in Orbot. For really 'secret' operations you might want to use another device than your personal smartphone. One alternative might be to use the Firefox for Android Add-On 'proxy mobile' which is also provided by the authors of Orweb and is not affected by this problem. Don't use Orweb (– despite it is called the most private and anonymous web browser – ) until this critical issue has been fixed. → perform your own check of your ORWEB browser. This might be true but we were still able to reproduce it on at least Android 4.1.2 and 4.3 which might be the platform of several installations. In addition, it has been stated that the problem doesn't exist on all platforms. Please keep in mind that this might expose your real ip over your current connection (which should be performed via Orbot through Tor).Īdditional information provided by the PlayStore (up to 5 million installs) You may perform your own check with the live-test. Unfortunately, the problem is still unfixed. What happened here? - After an additonal check it was clear that it was my real ip. This is what never should have happened - the real ip address is visible on a webpage requested via Tor by only having video elements on it. The only exception is if the whole traffic is routed through Tor - what is something I don't recommend, but this is another story. This could help a malicious person to get your actual ip address by inserting specific elements into your traffic. Therefore, the proxy (Orbot) is ignored for HTML5 video or audio elements. The problem is the behaviour of the internal browser view. It is based on the Android WebView which doesn't handle proxy settings of the internal stagefright player correctly. Anyone who has access to the raw html traffic ( especially website owners and, at least for unprotected connections, as well the operator of the exit node and the people inbetween) could modify the server response in order to get the real ip of the user.Īfter the bug showed up in the bug tracker, a blog post was released immendiately but no change was made to the official releases available from the Google PlayStore. Unfortunately, it has one really strange security flaw. The tool Orbot, which is available for Android, is a Tor proxy to allow applications to connect through the Tor network.Ī browser which is fully compatible with Orbot is the Orweb: Private Web Browser. One way to do this would be to use Tor, maybe also on the smartphone. In times where spying operations become more and more public, people are interested in protecting their data against analysis – either from huge companies or from some governments.