[tor-bugs] #16347 [Tor Browser]: TOR Browser Favicon.ico IP leak

[Tor Bug Tracker & Wiki]

#16347: TOR Browser Favicon.ico IP leak
-----------------------------+---------------------------------
     Reporter:  torleak      |      Owner:  tbb-team
         Type:  defect       |     Status:  reopened
     Priority:  critical     |  Milestone:
    Component:  Tor Browser  |    Version:  Tor: unspecified
   Resolution:               |   Keywords:  Favicon.ico IP leak
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+---------------------------------
Changes (by torleak):

 * status:  closed => reopened
 * resolution:  invalid =>


Comment:

 Yes, I understand that any unrelated application may leak source IP
 address, under condition that user voluntarily specified a target IP
 address in this application.

 I also understand that embedded TOR Browser plugin may leak source IP
 address, because it can obtain target IP address from TOR Browser itself.

 But the situation described in the ticket is different. SnagIT is an
 external application for taking screenshots. It is not embedded as a
 plugin into TOR Browser. Obviously, user didnt provide target IP Address
 to SnagIt voluntarily. User just took screenshots from an area of TOR
 Browser window which contained a certain part of target website. When user
 took screenshots of different parts of the same website, no IP leaks
 occurred.

 It means that external application requested target IP address from TOR
 Browser by parsing somehow a target website area inside TOR Browser, or
 requesting IP Address from TOR Browser. And TOR Browser divulged target IP
 Address.

 Please confirm that such situation is normal and valid. If so, then you
 probably would want to update TOR Browser FAQ where a danger of taking
 screenshots of TOR Browser window content via any external application
 should be mentioned.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16347#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online