FBI Would Have Paid For College Attack On Tor

The FBI would have last year an American university paid $ 1 million for attacking Tor users in order to find people that they could accuse of crimes, reports the Tor Project, the organization that maintains the Tor network.

Every day, 2.5 million people use the Tor network to protect their IP addresses and online privacy. In July last year there were several Tor servers discovered that had been put down to identify Tor users. Eventually, it turned to a study conducted by Carnegie Mellon University. According to the Tor Project were likely to be a dragnet that investigators throw out, to gather as much information about users which could then be used by the FBI.

In addition, the action was aimed not only against criminal users of the Tor network, but for all users. "This attack exceeds the critical line between research and endangerment of users," said Roger Dingledine, co-developer of Tor. He argues that the attack also sets a precedent where civil liberties are under attack by law enforcement agencies that outsource their police work in universities.

"As such an FBI-attack is accepted via a university proxy, no one has on the Internet, the protection of the amendment and 4th runs anyone risk." Dingledine argues that investigative agencies Tor can use for their police work, but that police investigation is not complete violation of people justifying their privacy and certainly not as legitimate research 'can be labeled. The vulnerability that the researchers used was already addressed last year. In addition, the Tor Project has a number of rules for ethical research published to the Tor network.

Wired approached the university, who denied the allegations, but said that there was a lack of evidence. "I would like to see a substantiation of their claim," said a PR staff. "I'm not familiar with any payment," as he announced. The employee declined to comment further.

Large Illegal Marketplace Offline For Tor-Vulnerability

A large illegal market on the Tor network has decided to temporarily offline due to vulnerabilities in the Tor network, so have the managers through Pastebin announced. It is Agora, the largest illegal market on the Tor network.

Through the website is handled in narcotics. The Agora administrators point to recent studies showing that web servers can be identified on the Tor network. These so-called "Tor hidden services" are only accessible via the Tor network and should not be localized. Recently, researchers showed that they were able to identify 88% of the hidden services in a test set-up.

According to the Tor Project, the developers of the Tor software and the Tor network, the impact of the attack revealed that bad. Yet the reason for the administrators of the Agora marketplace to temporarily pull the plug on the website. In a statement they say that it is unsafe to allow visitors to the website, since they are at risk. It is now working on a solution, but it is unknown when they will appear.

Tor Project Not Worried About Another Attack On Hidden Services

Scientists have found two ways to hidden services on the Tor network and its users, identify, but according to the Tor Project is the impact of the attacks it. Hidden services include websites that can be hosted on the Tor network. The address of the website is generally known only to the administrator and the website itself can only be accessed through the Tor network.

The well-known marketplace Silk Road was an example of a hidden service. According to scientists from MIT and the Qatar Computing Research Institute (QCRI) there is a vulnerability ( pdf ) present in the design of Tor, which can be established that makes a Tor user of a hidden service use. Hidden services themselves could be identified with an accuracy of 88% and a comparable rate could be determined which sites a user has visited.
Tor network

The Tor-network consists of several nodes, also known as relays, on which the traffic runs. It is in this case for servers of the user's request, for example to ask a website via the Tor network to forward. For example, the first node is the "entry guard" that the request of the Tor-user to the "relay node" forward. Then it goes from this node to the "exit node", which sends the request to the Internet. An attacker or intelligence can add one or more servers in the Tor network. However, the attacker can not determine which node the user will use.

According to Tor developer Roger Dingledine consists attack the scientists of three phases, so he lets in a blog posting know. During the first phase, the attacker must have the luck that his server as entry guard is used by the user that he has in mind. During the second phase, the user loads a web site via the Tor network and investigators use a classifier to guess whether it is a web site on the Tor network or on the "ordinary" internet.

Next, a second classifier is used to determine which site-Tor was. According Dingledine is the extent to which the classifier used by the researchers to identify websites is accurate. The research was based on a thousand websites, but according to previous research would be millions of websites are hosted on the Tor network. In this case, the researchers would in most cases not been able to establish the identity of a web site.

In addition, there are also steps which may take the Tor network which make it more difficult for an attacker to determine or create a target site with a gate-connection or not. Altogether Dingledine is pleased with the study because it raises some interesting questions, however, the impact of the attacks described in the really easy.

Hacking Team Had Conceived Attack On Tor Users

The Italian developer of government spyware Hacking Team had thought an attack on users of the Tor network, according to a presentation that was captured at the company and analyzed by the Tor Project. The Italian company said recently that it had an exploit for Tor Browser, the browser used to connect to the Tor network can be made.

Based on a preliminary analysis of the data by Hacking Team were stolen this turns out not to be the case. This week published an attacker about 400GB of files were from Hacking Teams network. Including a presentation on attacking encrypted connections and Tor users were found. The attack Hacking Team had thought comes down to that first briefly a target had to be chosen.

Next to be determined is how users connect to the internet. After this, the hardware would Hacking Team on the local network, such as the ISP, be put down. Next, wait until the user was using it with a different browser. By adding an exploit on the pages visited by the user, for example via the Adobe Flash Player flaw which Hacking Team disposal, the computer might be infected with malware.

If the control was obtained over the computer users of the Tor Browser could be set to use a socks proxy on a remote server that is owned by Hacking Team. This way, the user would not use the Tor client that is part of the Tor Browser, but the Tor client Hacking Team. Thus Hacking Team can view traffic before it goes to the Tor network.

Scalable

According to Tor Project, the organization that maintains the Tor network, the attack of the Italian company is not very scalable. In addition, attackers who control over a user's computer also have many other ways have to fall further users. At issue in this case mass surveillance but targeted surveillance. As a solution, the Tor Project recommends Tails, an operating system focused on privacy that does not use local "resources".

"Ultimately, security down here on having secure browsers. That's why we work hard to Tor Browser to create more resistant to attacks, but the lesson in this case is that they attack the weakest link in your system, and in the case of Hacking Team Tor Browser is not the weakest link, " says Tor developer Roger Dingledine.

The Tor Network Is Under Attack

Tor users in the coming days may have problems with the use of its services. As representatives warn Tor, detected an attempt to take control of specialized servers, referred to as directory Authorities that support this network. They did not disclose what the hacker group or organization is behind this attack. "We have taken steps to ensure the safety of users of our services. Tor already uses redundancy mechanisms that will keep their anonymity, even if the planned attack will be executed. Tor is safe "provides" arma "on the blog associated with the project . "Arma" is a nickname associated with the project leader Roger Dingledine.

The Tor network packets are exchanged directly between the source and the receiver, and pass through several randomly selected relay servers, which mask the path of the flow of information and thus allow the anonymity of the users of the network. "Even if the attacker take control of the majority of servers, they will not be able to force the Tor client software to resign from the other relays communication and as a result will still be safe and anonymous "provides" arma ".

If you use Tor - you may want to note down and temporarily avoid these affected mirrors in a below pic

Affected Mirrors

Currently, Tor uses 9 servers to manage traffic in the network. They are located in the USA and Europe. At the moment (Monday 22/12/2014) there was no information about the planned attack on Tor. Representatives of the project promise that all information on the current situation will be immediately posted on the blog design . -providing anonymity on the Internet.

Tor network is used by users who want to avoid censorship and track their content published by the secret services, especially in non-democratic countries. Representatives say the Tor project, the network is also used by millions of people who want to ensure the security of the communication itself when connecting to the Internet in public areas. Unfortunately, it is also used by criminals, such as drug trafficking network Silk Road. It was closed down in October 2013 years by the US police, but there is another version - Silk Road 2.0. Despite these controversies, Tor network is one of the symbols of freedom and privacy of Internet communication and any attempt to attack this system probably will lead to big stir among users global network.