[ebf6]

If you analyze malware for a living, then the assembly is the source code. :)

It's really not that much of an issue. It makes things more fun.

I am curious about whether they developed the malware in-house or if they hired a contractor. Is there any information out there on this? I wouldn't be surprised if they cut out parts, which may hint at a particular contractor having developed the malware.

Also, I still do not understand why TOR Browser Bundle allows scripts by default.

[sirsar]

> Also, I still do not understand why TOR Browser Bundle allows scripts by default.

The best diet is the one you can actually stick to. The best birth control is the one comfortable enough to use. The best anonymity software must be usable enough for Joe Average.

If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and randomly change your physical location.

[ebf6]

> If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and randomly change your physical location.

You are absolutely correct about practicing good opsec, however I have to challenge the usability argument. TOR is already less usable due to many sites blacklisting TOR exits nodes and latency (although connecting to a hidden service is a better idea, and avoids the blacklisting issue. And yet hidden services tend to avoid the JS requirement as well). If Joe Average is willing to put up with that in order to stay anonymous, I'm sure Joe would be willing to disable scripts.

On the other hand, if Joe doesn't understand why having scripts enabled is a security risk, then this might be a better reason to have scripts off by default, anyway.

[21]

Average Joe probably worries about Average Hacker/Average Stalker

If he's up against the government, he's going down.

[ebf6]

That's assuming that average hackers don't use script browser exploits...

And the FUD about there the government being so competent that it's impossible to hide from them has to stop. It's just so entirely useless and devoid of reality. If you were going down, for example Snowden would be an unknown name to us.

[belorn]

I remember reading on the Tor project blog that the malware was based on a reverse engineered security patch. The browser bundle was afterward changed to aggressively prompt the user to update when a new version is out in order to prevent a similar scenario.