Brave has fixed a privacy issue in its browser that sent queries
for .onion domains to public internet DNS resolvers rather than
routing them through Tor nodes, thus exposing users’ visits to dark
web websites.
The bug was addressed in a hotfix release[1] (V1.20.108) made
available yesterday.
Brave ships with a built-in feature called “Private Window with Tor[2]” that integrates the
Tor[3]
anonymity network into the browser, allowing users to access .onion
websites, which are hosted on the darknet, without revealing the IP
address information to internet service providers (ISPs), Wi-Fi
network providers, and the websites themselves. The feature was
added in June 2018[4].
This is achieved by relaying users’ requests for an onion URL
through a network of volunteer-run Tor nodes. At the same time,
it’s worth noting that the feature uses Tor just as a proxy and
does not implement most of the privacy protections offered by Tor
Browser.
But according to a report first disclosed on Ramble, the
privacy-defeating bug in the Tor mode of the browser made it
possible to leak all the .onion addresses visited by a user to
public DNS resolvers.
“Your ISP or DNS provider will know that a request made to a
specific Tor site was made by your IP,” the post read[5].
DNS requests, by design, are unencrypted, meaning that any
request to access .onion sites in Brave can be tracked, thereby
defeating the very purpose of the privacy feature.
This issue stems from the browser’s CNAME[6]
ad-blocking feature that blocks third-party tracking scripts that
use CNAME DNS records to impersonate the first-party script when it
is not and avoid detection by content blockers. In doing so, a
website can cloak third-party scripts using sub-domains of the main
domain, which are then redirected automatically to a tracking
domain.
Brave, for its part, already had prior knowledge[7]
of the issue, for it was reported on the bug bounty platform
HackerOne on January 13, following which the security issue was
resolved in a Nightly release 15 days ago.
It appears that the patch was originally scheduled[8]
to roll out in Brave Browser 1.21.x, but in the wake of public
disclosure, the company said it’s pushing it to the stable version
of the browser released yesterday.
Brave browser users can head to Menu on the top right > About
Brave to download and install the latest update.