Tor Project Asks For First Time Donations

The Tor Project, the organization that maintains the Tor network and Tor Browser, asks Internet users for the first time running for donations. The website had been a button present to donate, but now it is actively sought donors wishing to contribute to the development of the Tor network.

A large part of the revenue of the Tor Project comes from the US government. To avoid too much of this funding only depend now decided a crowdfunding campaign launch. Since no restrictions on crowdfunding can sit the money thus brought to projects which are spent according to the Tor Project are most important and can react quickly to changing circumstances.

Through the Tor network, Internet users can hide their IP address and visit censored websites. It is used daily by 2.5 million people, including in totalitarian regimes. The Tor Project is self-described as an American non-profit organization that focuses on research, development and education of online anonymity and privacy. Although many people daily surf the Internet via Tor Browser and the Tor network, the donation button on the website has been used in previous years no 8,000 times.

FBI Would Have Paid For College Attack On Tor

The FBI would have last year an American university paid $ 1 million for attacking Tor users in order to find people that they could accuse of crimes, reports the Tor Project, the organization that maintains the Tor network.

Every day, 2.5 million people use the Tor network to protect their IP addresses and online privacy. In July last year there were several Tor servers discovered that had been put down to identify Tor users. Eventually, it turned to a study conducted by Carnegie Mellon University. According to the Tor Project were likely to be a dragnet that investigators throw out, to gather as much information about users which could then be used by the FBI.

In addition, the action was aimed not only against criminal users of the Tor network, but for all users. "This attack exceeds the critical line between research and endangerment of users," said Roger Dingledine, co-developer of Tor. He argues that the attack also sets a precedent where civil liberties are under attack by law enforcement agencies that outsource their police work in universities.

"As such an FBI-attack is accepted via a university proxy, no one has on the Internet, the protection of the amendment and 4th runs anyone risk." Dingledine argues that investigative agencies Tor can use for their police work, but that police investigation is not complete violation of people justifying their privacy and certainly not as legitimate research 'can be labeled. The vulnerability that the researchers used was already addressed last year. In addition, the Tor Project has a number of rules for ethical research published to the Tor network.

Wired approached the university, who denied the allegations, but said that there was a lack of evidence. "I would like to see a substantiation of their claim," said a PR staff. "I'm not familiar with any payment," as he announced. The employee declined to comment further.

Extra Secure Tor Browser For Linux Launched

The creators of Tor Browser, the software for browsing through the Tor network, have released a security-enhanced version of Linux. It is the first time that the Tor Project offers a "hardened" version of Tor Browser. This browser includes a customized version of Firefox and Tor software.

The extra secure Tor Browser is based on the Tor Browser Alpha series. These are test versions of the browser that appear in the final versions. In addition, extra protection is added which should offer protection against memory exploits. For this are both the Tor software, and Firefox version Address Sanitizer compiled. This should give users a safer Tor Browser, especially if JavaScript is partially or completely disabled. It also helps to find problems earlier and to remedy them in the alpha and stable versions.

The additional security does have several disadvantages. Thus, this version is slower, consumes more memory and is slightly larger than the normal version. In addition, the added security of Address Sanitizer not perfect. An attacker who successfully back halls which it is practiced can still via JavaScript certain types of attack vulnerabilities. To date, the high-security Tor Browser only for Linux available, but is being given to versions for Mac OS X and Windows.

Tor Browser lets Internet users hide their IP address and visit censored websites. Every day, over two million people from all over the world using the Tor network, such as activists, people in totalitarian regimes and Internet users who value their privacy. The software is also used by criminals. Two years ago, users of legacy Tor Browser still the target of an attack allegedly by the FBI conducted. The attack users of the real IP address could be traced. To avoid Tor Browser Users with outdated versions meanwhile continue surfing is an automatic updater added to the browser.

Tor Protects Users From Identification Through Fonts

Each day, some 2.5 million people use the Tor network to protect their privacy and identity on the Internet. The easiest way to browse through the Tor network Tor Browser. This software consists of a modified Firefox version and software that connects to the Tor network.

Tor users get the advice , for example, not logging into websites or other identifying information on websites leave behind.Additionally Tor Browser warns the user maximizes his browser window. The maximum resolution of a display can namely be used for tracking. Another way to track Internet users is on the basis of the fonts used. Something that investigators earlier this year have shown ( pdf ).

In a new test version of Tor Browser 5 was therefore decided to use the same fonts for all supported platforms. According to the developers of Tor, it is a "experimental protection". These new privacy measures will also be included in the final version of Tor Browser 5, which is scheduled for next week.

Tor Project Not Worried About Another Attack On Hidden Services

Scientists have found two ways to hidden services on the Tor network and its users, identify, but according to the Tor Project is the impact of the attacks it. Hidden services include websites that can be hosted on the Tor network. The address of the website is generally known only to the administrator and the website itself can only be accessed through the Tor network.

The well-known marketplace Silk Road was an example of a hidden service. According to scientists from MIT and the Qatar Computing Research Institute (QCRI) there is a vulnerability ( pdf ) present in the design of Tor, which can be established that makes a Tor user of a hidden service use. Hidden services themselves could be identified with an accuracy of 88% and a comparable rate could be determined which sites a user has visited.
Tor network

The Tor-network consists of several nodes, also known as relays, on which the traffic runs. It is in this case for servers of the user's request, for example to ask a website via the Tor network to forward. For example, the first node is the "entry guard" that the request of the Tor-user to the "relay node" forward. Then it goes from this node to the "exit node", which sends the request to the Internet. An attacker or intelligence can add one or more servers in the Tor network. However, the attacker can not determine which node the user will use.

According to Tor developer Roger Dingledine consists attack the scientists of three phases, so he lets in a blog posting know. During the first phase, the attacker must have the luck that his server as entry guard is used by the user that he has in mind. During the second phase, the user loads a web site via the Tor network and investigators use a classifier to guess whether it is a web site on the Tor network or on the "ordinary" internet.

Next, a second classifier is used to determine which site-Tor was. According Dingledine is the extent to which the classifier used by the researchers to identify websites is accurate. The research was based on a thousand websites, but according to previous research would be millions of websites are hosted on the Tor network. In this case, the researchers would in most cases not been able to establish the identity of a web site.

In addition, there are also steps which may take the Tor network which make it more difficult for an attacker to determine or create a target site with a gate-connection or not. Altogether Dingledine is pleased with the study because it raises some interesting questions, however, the impact of the attacks described in the really easy.

FBI Cyber Crime Forum Taken Offline Back Online

A popular forum for cyber criminals that two weeks ago by the FBI offline was removed has announced his comeback. In addition, the security will be tightened to thwart a new operation by investigators. Darkode the forum, according to the FBI an important place where criminals services, tools and exchange ideas to attack systems.

During an international operation where twenty countries participated were 70 Darkode members arrested, indicted or are still being sought. Including a trainee of security FireEye was arrested for activities at the forum. It was about to take offline a forum for cyber criminals largest international operation of investigative services.

Rentree

But the forum's administrator was not arrested and has now announced the comeback of Darkode. According to the administrator is the largest part of the administrators and other senior members are not picked up. The operation of the investigators would focus on new members or people who have long been nothing more with the "scene" had to do. The new version of Darkode will again be hosted through the Tor network and are by invitation only.

In addition, each member will receive their own onion address to visit the website. Thus have visited the administrators more control over who the website and offers more log information to identify informants for example. In addition, a user of the bitcoin-wallet will be linked to his account. Even if the user's account was hacked, an attacker can not use the account unless the private key of the user bitcoin wallet knows, reports Malware Tech .

Hacking Team Had Conceived Attack On Tor Users

The Italian developer of government spyware Hacking Team had thought an attack on users of the Tor network, according to a presentation that was captured at the company and analyzed by the Tor Project. The Italian company said recently that it had an exploit for Tor Browser, the browser used to connect to the Tor network can be made.

Based on a preliminary analysis of the data by Hacking Team were stolen this turns out not to be the case. This week published an attacker about 400GB of files were from Hacking Teams network. Including a presentation on attacking encrypted connections and Tor users were found. The attack Hacking Team had thought comes down to that first briefly a target had to be chosen.

Next to be determined is how users connect to the internet. After this, the hardware would Hacking Team on the local network, such as the ISP, be put down. Next, wait until the user was using it with a different browser. By adding an exploit on the pages visited by the user, for example via the Adobe Flash Player flaw which Hacking Team disposal, the computer might be infected with malware.

If the control was obtained over the computer users of the Tor Browser could be set to use a socks proxy on a remote server that is owned by Hacking Team. This way, the user would not use the Tor client that is part of the Tor Browser, but the Tor client Hacking Team. Thus Hacking Team can view traffic before it goes to the Tor network.

Scalable

According to Tor Project, the organization that maintains the Tor network, the attack of the Italian company is not very scalable. In addition, attackers who control over a user's computer also have many other ways have to fall further users. At issue in this case mass surveillance but targeted surveillance. As a solution, the Tor Project recommends Tails, an operating system focused on privacy that does not use local "resources".

"Ultimately, security down here on having secure browsers. That's why we work hard to Tor Browser to create more resistant to attacks, but the lesson in this case is that they attack the weakest link in your system, and in the case of Hacking Team Tor Browser is not the weakest link, " says Tor developer Roger Dingledine.

Chinese Tor - And VPN Users Exposed Via JavaScript

A select group of Chinese users of VPN services and the Tor network has become the target of a JavaScript attack that attempted to discover their true identities. Reported security Alien Vault Labs .The company took a "watering hole" attack where, with several Chinese-language websites of NGOs, Uighur and Muslim organizations were hacked.

Watering holes are so called because potential victims to visit the websites of itself. In most of these attacks, the attackers put malicious code on the hacked website that visitors often try to infect via an exploit with malware. Researchers at the Chinese-language websites hacked observed a new technique not previously been applied to watering holes.

The websites had placed a malicious JavaScript file which users through " JSONP hijacking "vulnerabilities in more than 15 major Chinese-language websites are attacking. Through JSONP requests the attackers could steal private data from users if they were logged on a vulnerable websites. It involves major Chinese portals like Baidu, Sina and QQ. Then, the JavaScript code sends the information to a server of the attackers.

It may then go to the real user's name and his email address. According Alien Vault Labs was a small group of people the campaign of the target, which aims to unmask users who visit these sites, even if they come through Tor or a VPN. Researchers call the Chinese websites in question to remedy the JSONP vulnerabilities. In addition, users advised to avoid visiting sensitive sites after they have logged on to another website.

Schneier: Most People Will Never Use Tor Or PGP

Despite all the fuss about the revelations of Edward Snowden and the NSA surveillance in practice most people will never take anti-surveillance measures. In fact, most surveillance tools such as Facebook, Google and a smartphone are voluntarily used by people because they are like "handy", says security expert Bruce Schneier opposite Wired .

When asked how he ordinary, honest Internet users would convince tools like Tor or PGP or use your own mail server, he says this is not possible. The surveillance tools, he says, convenient and free. "That's why we use them. Most technical solutions to avoid surveillance to use tedious and difficult. And they only work to a certain level."

Schneier gives as an example the cell phone, which he describes as an "incidental tracking device". "If that was not the case, the system could not deliver phone calls. Metadata is very intimate and the surveillance data can not be encrypted." When it comes to addressing surveillance should therefore not be given to technical solutions, Schneier says.

The important thing is just to talk about it with each other, he says. "These are political issues that require political solutions, and it will be no political issues if we do not make Currently surveillance yet not showy,. We do not notice it because it happens automatically in the background Snowden left us. see what happens when people notice it. People should notice whatsoever of the lake. "

Frisian USB Stick For Anonymous Surfing Costs 999 Euros

A Frisian company has launched a USB flash drive 999 which users can go online anonymously and encrypted communication. The Crypto Boss, as the stick is called, comes with a browser, photo editing suite, accounting, email client and an office suite. Also, there PGP encryption software included to be able to e-mail. It therefore seems to privacy operating system Tails.

By default, the operating system of the Crypto Boss using the Tor network, which users can go online anonymously. Data is stored on the USB drive, so there are no traces on the hard drive of the computer. Furthermore, all data is encrypted by default. To use the Crypto Boss, users must also specify a password.

"The big advantage of Crypto Boss versus others is that we provide a combination of hardware and software that is immediately ready for use. Other privacy-centric operating systems must be downloaded by the user and installed in a very roundabout way to a USB stick. The Crypto Boss is much more user friendly and actually used by everyone from the box, "said the Frisian company behind the stick located in Drachten.

The Crypto Boss comes in three versions. The 32GB version costs $ 999, while versions of 64GB and 128GB respectively cost 1199 euro and 1399 euro. If USB drive seems to be using the Corsair Flash Survivor Stealth. For users who are looking for a similar, cheaper solution is the aforementioned Tails . This is also an operating system to the Internet with anonymous and encrypted communication which also contains various tools like LibreOffice, GIMP and Audacity. It is also free to download and use.

Criticism Of Assange And Appelbaum Because Sony-Mails

Both WikiLeaks founder Julian Assange as Tor developer Jacob Appelbaum said to be in favor of privacy and internet freedom, but this does not seem to hold true for the employees of Sony. WikiLeaks recently published an archive of e-mails and documents that were stolen by Sony.

Appelbaum, who in addition to his role as a developer of the Tor software also volunteered with WikiLeaks is involved , was recently interviewed by Fusion . There he lets first know that any form of surveillance is illegal. "Everyone has the right to privacy and should know that his emails are not read, even if the horrible people like the police in Ferguson."

For large enterprises has Appelbaum less understanding. He thinks it is right that WikiLeaks published the stolen Sony emails. As Appelbaum puts the Sony summit as "racist bastards" who have been "negligent". The statements of the Tor developer as the actions of Julian Assange to put the stolen Sony-mails online can count on criticism of the media. Both columnists Business Insider as The Guardian denounced the double standard that seem to handle the two privacy activists

WikiLeaks Publishes, Thousands Of Stolen Sony-Mails

Whistleblower site Wikileaks has once again thousands of e-mails late last year at Sony Pictures Entertainment were stolen published. The e-mails have been added to an online archive that WikiLeaks last month put online and that all 30,000 documents and more than 173,000 e-mails to and from more than 2,200 Sony email addresses contained. That made ​​the whistleblower site known via Twitter .

According to WikiLeaks, the stolen e-mails and documents newsworthy and the online archive offers a special glimpse into the workings of a large "mystery" multinational ties with both the White House and the US military-industrial complex would have. After the online publication of the " Sony Archive "Sony responded furiously condemning WikiLeaks.

WikiLeaks Weather Accepts Submissions Fom Whistleblowers

WikiLeaks yesterday evening put a new system online so that it can receive further submissions from whistleblowers. Through the system, which is still in beta and the Tor network uses, according to WikiLeaks people can upload files anonymously.

The announcement late WikiLeaks founder Julian Assange know there was going to be four possible solutions examined which whistleblowers can upload files. Previous solutions, however, would not provide sufficient protection against government surveillance. One of the problems with public systems, "bootstrapping" writes Assange, who still resides in the Embassy of Ecuador in London.

"The fact that a source for instructions see how they can upload material can be used as evidence against him as the SSL key is cracked. To avoid this we have complete instructions and keys placed on millions WikiLeaks pages," said Assange .Moreover, using the "submit" button for uploading files would hardly generate network traffic because the data are downloaded every time someone looks at a WikiLeaks page.

Tor-Mail Service Attack Suspects By Intelligence

On the Tor-based e-mail service SIGAINT has warned users that it has become a target of a suspected intelligence, which were deployed in a total of 70 malicious servers. The attacking party would also recent months several attacks carried out against the infrastructure of the service. According to the managers of SIGAINT the attacks had failed, however.

SIGAINT only through the Tor network and accessible on the Internet to protect journalists and activists against the large-scale surveillance. The website sigaint.org state the address of the Tor website where SIGAINT is found. According to the manager, the alleged intelligence tried to change this address, so that Man-in-the-middle attacks could carry on users could spy on them in real time.

Probably therefore some passwords stolen, but it would have been the attackers not to do. "We get less than one user in the three months complaining that their account has been hijacked," said the manager. SIGAINT would have a total of 42,000 users. Because the e-mail service of the Tor network uses it depends on the servers in the network.

The Tor network consists of several servers on which the traffic passes. The last server in the chain is the exit node or exit relay. Through this server, which is added by volunteers to the Tor network, the request of the Tor user is sent to the Internet.The attackers had put in this case 70 of such servers. Because of this large number of suspects administrator SIGAINT that he has been the target of an intelligence service.

He leaves the Tor-mailing list that can be used for the website sigaint.org an SSL certificate to ensure that the content, and also the address of the Tor website is adjusted. An intelligence service might work, according to him so through using the key from a certificate authority from the country. The malicious Tor servers proved to be not only against SIGAINT deployed, but also can be used for other dubious affairs. All 70 servers have been placed on a blacklist.

Tor-Flyer For Police And Citizens On The Internet Anonymously

Every day, hundreds of thousands of people using the Tor network to protect their online identity and privacy. Yet there is still much confusion about how the Tor network and the importance of online anonymity. Therefore, the Tor Project has several informative flyers ( pdf ) made ​​for police and citizens explaining the operation of the Tor network and the importance of anonymous internet.

Through the Tor network users can hide their IP address such as "hidden" visit websites that are only accessible through the Tor network. In recent months, several of these sites by the authorities off the air. The most Tor users are ordinary citizens who want to keep control over their privacy, so the Tor Project has announced in the flyer for police and investigative services.

The network is also used by journalists, activists and people in countries with totalitarian regimes or internet censorship. It is also handy for police and undercover operations. So use investigative services also the Tor network for their research."Because of the identity and location of hiding researchers Tor can be a valuable tool for successful online undercover operations," so let the flyer.

There is created a flyer for citizens showing the importance of anonymous Internet and online freedom is explained. According to the Tor Project is anonymity under fire as never before, allowing the ability to share free information on the Internet is undermined. "Countries monitors on each other and their citizens, block websites, watching the contents of traffic and reduce important world news." Organizations that deal with internet freedom can also order the flyers.

New Video Shows Importance Of Tor Anonymous Internet

The developers of the Tor anonymizing network together with a development studio a short animated video created that shows the importance of the Internet Gate and anonymous. Through the Tor network Internet users can protect their IP address and example visit censored websites.

According to the video walk Internet users in the use of a normal browser is a risk that they are all leak personal information without that they see this immediately. Tor, however, would protect users' privacy and identity. "Tor protects your connection with three encryption layers and let it through three managed servers run by volunteers around the world. This allows us to communicate anonymously on the Internet."

Because Tor users look exactly the same, it is difficult for parties that monitors to identify users, which provides anonymity.The more people use Tor, the stronger the network, since it is easier to hide in a group of people who look the same, according to the video. In addition, Internet activists and bloggers help repressive regimes by also using Tor or run a Tor server.

Almost 97% Of Tor Traffic Goes To 'Normal' Websites

Almost 97% of the traffic that will generate Tor users to 'normal' websites over the internet anyone can visit, according to research from the Tor Project. Tor is a software that allows users not only to hide their IP address, but also makes it possible to visit Tor sites that are only accessible through the Tor network.These are the so-called "hidden services".

The Tor Project wanted to know how many of the Tor traffic goes to these hidden services. For this was the collaboration of several volunteers to share data from their Tor server. This enabled the Tor Project a small proportion (2% - 5%) of activities in hidden view services. Establish on the basis of current calculations, the researchers found that each day 30,000 hidden services are active. These websites generate every day 400 to 600Mbit per second of traffic, which amounts to about 5 terabytes of data per day.

Furthermore, it appears that is the Tor traffic from Tor users to these hidden services 3.4% of the total Tor traffic. This means that 96.6% of the Tor traffic to "normal" websites is that anyone can access through a browser. Tor came last year regularly negative in the news because Tor would mainly be used for visiting criminal Tor sites. Now it appears that the most traffic to websites is that outside Gate to visit.

The researchers suggest that it is still to preliminary results in that regard are established on the basis of a limited data set, and with a grain would have to be taken. The study was conducted over a period of several months, but the researchers plan to expand further in the future. They want to know how many people visit daily Tor sites and how often people try to visit a hidden service that no longer exists.

"Unfortunately, some of these questions with the current reporting infrastructure are not easy to answer, mostly because the collection in this way can reveal hidden information about specific services, as well as the results of the current system include excess  dates." The researchers are also looking at aggregation protocols for statistics that they can use in place of the current system, so they still safe to collect all kinds of statistics.

Cryptowall 3.0 - "Microsoft Sees Hundreds Of New Infections By CryptoWall"

After two months of silence, there is a new version of the CryptoWall-ransomware appeared that managed to infect one day 288 Windows computers, says Microsoft. CryptoWall 3.0 spreads the same way as previous versions, namely via drive-by downloads and installation by malware already present on computers. Once active encrypts CryptoWall kinds of files and then asks for an amount of 500 euros in bitcoin. Victims receive 167 hours to pay, and the price is increased. In previous versions it was then a sum of 1,000 euros.

Cryptowall Decrypt Service.

Communicated the older versions of CryptoWall still using the Tor network, CryptoWall 3.0 uses I2P, which stands for Invisible Internet Project (I2P), says researcher JuK of the blog Malware Do not Need Coffee . I2P is a network layer allowing application messages safely and pseudo-anonymous can exchange. 

Cryptowall 3.0 communications with C&C

The earlier versions of CryptoWall would be more than 830,000 computers have been infected, making it the most "successful" ransomware until now.

VirusTotal Report Zip File: c77a463c5f6481efee38bba2bc8bf085

VirusTotal Report: 6c3e6143ab699d6b78551d417c0a1a45

VirusTotal Report: 47363b94cee907e2b8926c1be61150c7