13 ms·
Did the FBI Pay a University to Attack Tor Users?
- probdist 11y agoI assume the CMU folks didn't break into any one elses nodes. It seems like one of the principles of Tor node operation is that you can run your nodes however you want. I don't think there is any binding agreement or even strong implication that someone operating a Tor node agrees to not be hostile to users. Perhaps it was unethical by the standards of university research, but I wouldn't be bothered by the government doing this. If the government or a university researcher idled in your irc channel and logged the communications I would think that was okay. I kinda view this the same way.
- ikeboy 11y agoThey did something with the nodes that should have been impossible, basically exploiting a vulnerability in tor. That seems worse than just passively observing.
- mtgx 11y agoThe government would probably need a warrant to do that. The university doesn't, and the gov may have use it as a proxy for its attack, while calling it "research". If this sort of thing isn't stopped now in a loud way, it may become the new normal in academia.
- gwright 11y agoThis wasn't done by 'academia'. It was apparently done by a Federally Funded Research and Development Center sponsored by the Department of Defense. That doesn't mean there isn't room for criticism regarding the activities but that would be criticism regarding government activities and not academic activities.
- XorNot 11y agoThere's broad protections for reporting crimes incidentally observed. It's why parallel construction exists in the first place - to avoid the absurdity of happening to observe a murder, but then grant immunity to the victim due to how it was initially identified even if you later find the body, weapon, and DNA evidence. In the case of Tor, when you go probing hidden services it would be very easy to find a lot of crime you'd definitely want to report if you knew who was doing it.
- doktrin 11y agoThe SEI is funded by the DoD and many among its staff and leadership are former military. It's not really 'academia' in the way you're imagining it. Rather, think of it as a government contractor that only does R&D.
- ikeboy 11y agoSee also http://motherboard.vice.com/read/court-docs-show-a-university-helped-fbi-bust-silk-road-2-child-porn-suspects http://motherboard.vice.com/read/court-docs-show-a-universit...
- justcommenting 11y agoIt would be great if CMU alumni, faculty, and students petitioned the university's IRB to investigate and its administration to return the funding. CMU Research Ethics Reporting: https://www.cmu.edu/research-compliance/report-problem/index.html https://www.cmu.edu/research-compliance/report-problem/index... CMU Research Misconduct hotline: https://www.cmu.edu/research-compliance/research-misconduct/ https://www.cmu.edu/research-compliance/research-misconduct/ or call 877-700-7050 for 'anonymous' reporting CMU IRB contacts: https://www.cmu.edu/research-compliance/human-subject-research/contact.html https://www.cmu.edu/research-compliance/human-subject-resear... CMU Office of the President contact page: https://www.cmu.edu/leadership/president-suresh/contact/index.html https://www.cmu.edu/leadership/president-suresh/contact/inde... Also of note - Ethical Tor Research Guidelines: https://blog.torproject.org/blog/ethical-tor-research-guidelines https://blog.torproject.org/blog/ethical-tor-research-guidel...
- minimaxir 11y agoCMU alum here. Let's just say there are quite a few rants happening in my network on Facebook.
- dopamean 11y agoIt'd be great if it was more than rants on facebook.
- TeMPOraL 11y agoThat's how it starts, usually.
- dev1n 11y agoand ends, unfortuantely.
- TeMPOraL 11y agoDepends. First of all, before people go out to the streets they need to coordinate somehow, and Facebook seems to be a good way of doing that recently. Second of all, the rants that are done publicly have a chance of creating a huge PR shitstorm for CMU when some journalist gets a wind of it. Sadly, in this age media pressure is the only thing that actually works (usually for worse).
- bumbledraven 11y agopatio11 wrote on Twitter (https://www.twitter.com/patio11/status/664551822120476672 https://www.twitter.com/patio11/status/664551822120476672): > Tor is having a fit of institutional pique that researchers are compromising the network's privacy guarantees by, well, looking at it. > If you write security software, and you're not praying that loyal opposition hits you with everything they've got, you're not doing security > Tor is intended to be, and is marketed as, robust against nation state adversaries. It cannot possibly be so if it worries about academics.
- bri3d 11y agoIf, as the Tor blog post insinuates, the product of the CMU research was "targeted data dump to the Feds to investigate criminal activity," I could see the hand-wringing being warranted. That's paying a university to do law enforcement work. If the product was (as it seems based on public information) "paper about how to attack Tor along with a couple of case studies," I really don't see the problem. The kerfuffle around the talk and paper's release is certainly interesting in its own right, though.
- gwright 11y ago> That's paying a university to do law enforcement work. Not really. The organization involved is SEI, a Federally Funded Research and Development Center sponsored by the Department of Defense. Not at all the same thing as CMU. Mentioning this for clarity, not as a statement about the actually activities.
- zurn 11y agoSo it's FBI paying the military to do law enforcement work. Not really better.
- ikeboy 11y agoThere's a difference between white hat and black hat. Working for the other side is not white hat, and arguably security software writers should only welcome white hat research.
- trhway 11y agoRussia had official government contract awarded to a research institution to de-anonymize Tor users. The contract has been canceled by the institution recently. English version: http://www.bloomberg.com/news/articles/2015-09-22/russia-s-plan-to-crack-tor-crumbles http://www.bloomberg.com/news/articles/2015-09-22/russia-s-p...
- ousta 11y agoand yet some hn users were questionning wether russia was the worst with hiring an army of trolls on the basis that "Kremlin propaganda wants you to believe: everybody is lying, we are no different. No it's not."
- brazzledazzle 11y agoWhy can't they both be bad?
- smoyer 11y agoI'm not sure that CMU needs a warrant to collect the data passing over TOR. It certainly violates my ethical principles but perhaps the threshold is lower for others?
- ikeboy 11y agoIirc the attack involved setting up an exit and a relay, then sneaking a message through, so it could tell when a circuit connected to both, and thereby deanonymize users.
- ISL 11y agoCMU doesn't need a warrant to scrape or transmit Tor traffic, and neither do you. Intent will matter very much in this instance: If the FBI paid someone to do something for them that the FBI would need a warrant to do, then there's a problem. The same would be true if a warrant-less sheriff paid a private investigator to eavesdrop on a suspect. Otherwise, if, in the course of their research, no matter who funded them, CMU researchers found someone doing something illegal and reported it to the Man, that's generally regarded as good citizenship. If, in the course of my research, I happen to unmask a bike-theft ring, you can be rather certain that I'll call the cops. Tor is a good invention that needs our support, but it isn't a license to do illegal things. Tor is, in many ways, an encrypted Twitter. You know that everyone can read what you send and some people will actively attempt to crack it. You bet everything on the encryption and network structure to avoid interception and localization. I don't think there ought to be any inherent presumption of privacy attached to the protocol; to assume that there is one is to be exposed to any breach in the protocol's design.
- ikeboy 11y agoThey exploited a vulnerability in the tor protocol. There's an argument to be made that connecting to the tor network but not complying with the protocol is a violation of the CFAA, if done in a malicious way. If you wiretap your entire neighborhood, find a bike-theft ring, and call the cops, you'll also get in trouble.
- brazzledazzle 11y ago
- deleted 11y ago[deleted]
- vox_mollis 11y agoDoes anybody know why the researchers pulled their BlackHat presentation?
- ikeboy 11y agoMy guess is that the government saw it, then made them an offer conditional on them pulling it.
- vox_mollis 11y agoI'm sure that's likely, I just have a crazy wistful idealism that the hacker manifesto is still an ethical driver of the computer security industry and academia. I know it's not the CMU students' fault, but part of me is glad the Plaid Parliament of Pwning lost DCCTF this year. It's really saddening that blind deference to authority is now the norm in the industry.
- TazeTSchnitzel 11y agoThey stated the reason at the time: CMU hadn't cleared it for release. Presumably they wanted to keep the vulnerability secret so they could keep exploiting it.
- arianvanp 11y agoThis is no different from selling an exploit on the black market for $1m . It's sad that a university is going black hat. A university should be a safe place with great respect to ethics in the field the university does research.
- sarciszewski 11y agoCan we please stop decrying black hats without nuance? Because that whole "CMU is blackhat now" thing? That's not what happened here. Selling exploits exclusively to assist the government is very much like a large swath of white hats. What do you think Infragard is? It's Feds rubbing elbows with crooked pro-government technologists. But they're the white hats, remember. At the end of the day, you only have green hats (the color of money), and people who don't wear hats at all. The black/white distinction has become meaningless. Recommended reading: http://www.thoughtcrime.org/blog/saudi-surveillance/ http://www.thoughtcrime.org/blog/saudi-surveillance/
- ikeboy 11y agoSurely selling to a government is at least grey hat? In my book, white hat never does offense. If you're creating an exploit that isn't proof of concept and that harms someone, you're not white hat anymore.
- sarciszewski 11y agos/grey/green/ and I agree with you. Do you know what your entire government is up to? Even if you sell it to the NSA, how do you know it won't end up in the hands of the DEA to spy on a large number of people just to find a couple of drug traffickers? We don't know. We can't know. There's nothing grey about that choice. They're the ones that call themselves white.
- chejazi 11y agoGreat article by Moxie, thanks for sharing. > If I absolutely have to frame my choices as an either-or, I’ll choose power vs. people. I would not have expected him to say that.
- tacojuan 11y agoWith the apparent ethical chops these CMU researchers had, they certainly chose the wrong deal. Extorting SR2 would've made them quite a bit more than just 1 million. ;)
- zmanian 11y agoTor should be robust against strong adversaries unconstrained by ethics. Part of the way this strength will be achieved is researchers in public interest settings behaving ethically.
- twblalock 11y agoIf Tor should be robust against strong adversaries unconstrained by ethics, it needs to be tested by strong adversaries unconstrained by ethics.
- htns 11y agoIt's been known from the beginning Tor's design can't defend against these sorts of attacks.
- twblalock 11y agoIf it has always been known, then why is it making so much news? Tor's purpose is to anonymize traffic. What is it good for, if it can't do that?
- georgerobinson 11y agoTor can anonymize traffic but only against passive attackers who cannot perform traffic flow confirmation on a global scale. > A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers. (https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf https://svn.torproject.org/svn/projects/design-paper/tor-des..., Page 4) I read an interesting article in the ACM last month, titled "Seeking Anonymity in an Internet Panopticon" (http://cacm.acm.org/magazines/2015/10/192387-seeking-anonymity-in-an-internet-panopticon/fulltext http://cacm.acm.org/magazines/2015/10/192387-seeking-anonymi...). > The most well known global-traffic-analysis attack—"traffic confirmation"—was understood by Tor's designers but considered an unrealistically strong attack model and too costly to defend against. They explain a number of attacks against Tor (both active and passive) and introduce Dissent, "a project at Yale University that expands the design space and explores starkly contrasting foundations for anonymous communication".
- Umn55 11y ago"but that they were launching active attacks and using the results in an unethical manner, i.e. to conduct possibly-illegal criminal investigations." That's the history of the US in an nutshell. You really need to bone up on your history... http://williamblum.org/essays/read/overthrowing-other-peoples-governments-the-master-list http://williamblum.org/essays/read/overthrowing-other-people... Our brains are much worse at reality and thinking than thought. Science on reasoning: https://www.youtube.com/watch?v=PYmi0DLzBdQ https://www.youtube.com/watch?v=PYmi0DLzBdQ Protectionism for the rich and big business by state intervention, radical market interference. https://www.youtube.com/watch?v=WHj2GaPuEhY#t=349 https://www.youtube.com/watch?v=WHj2GaPuEhY#t=349 Energy subsidies https://www.imf.org/external/pubs/ft/survey/so/2015/NEW070215A.htm https://www.imf.org/external/pubs/ft/survey/so/2015/NEW07021... Intereference in other states when the rich/corporations dont get their way https://www.youtube.com/watch?v=8mxp_wgFWQo&feature=youtu.be&list=PLKR2GeygdHomOZeVKx3P0fqH58T3VghOj&t=724 https://www.youtube.com/watch?v=8mxp_wgFWQo&feature=youtu.be... From war is a racket: "I helped make Mexico, especially Tampico, safe for American oil intersts in 1914. I helped make Haiti and Cuba a decent place for the National City Bank boys to collect revenues in. I helped in the raping of half a dozen Central American republics for the benefits of Wall Street. The record of racketeering is long. I helped purify Nicaragua for the international banking house of Brown Brothers in 1909-1912. I brought light to the Dominican Republic for American sugar interests in 1916. In China I helped to see to it that Standard Oil went its way unmolested."[p. 10] "War is a racket. ...It is the only one in which the profits are reckoned in dollars and the losses in lives." [p. 23] "The general public shoulders the bill [for war]. This bill renders a horrible accounting. Newly placed gravestones. Mangled bodies. Shattered minds. Broken hearts and homes. Economic instability. Depression and all its attendant miseries. Back-breaking taxation for generations and generations." [p. 24] General Butler is especially trenchant when he looks at post-war casualties. He writes with great emotion about the thousands of tramautized soldiers, many of who lose their minds and are penned like animals until they die, and he notes that in his time, returning veterans are three times more likely to die prematurely than those who stayed home. http://www.amazon.com/War-Racket-Antiwar-Americas-Decorated/dp/0922915865/ http://www.amazon.com/War-Racket-Antiwar-Americas-Decorated/... Blum: http://williamblum.org/aer/read/137 http://williamblum.org/aer/read/137 US distribution of wealth https://imgur.com/a/FShfb https://imgur.com/a/FShfb http://www2.ucsc.edu/whorulesamerica/power/wealth.html http://www2.ucsc.edu/whorulesamerica/power/wealth.html The Centre for Investigative Journalism http://www.tcij.org/ http://www.tcij.org/ Some history on US imperialism by us corporations. https://kurukshetra1.wordpress.com/2015/09/27/a-brief-history-of-imperialism-and-state-violence-in-colombia/ https://kurukshetra1.wordpress.com/2015/09/27/a-brief-histor... The real news http://www.therealnews.com http://www.therealnews.com Manufacturing consent: https://www.youtube.com/watch?v=KwU56Rv0OXM https://www.youtube.com/watch?v=KwU56Rv0OXM https://vimeo.com/39566117 https://vimeo.com/39566117
- meowface 11y agoI really don't like the idea of targeting all Tor users, but as far as I can tell, that's not what this is. For this to work, wouldn't the FBI have to have provided a list of hidden services they were interested in to CMU? Based on Tor's description of the traffic confirmation attack, an encoded version of a specific hidden service has to be injected: https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack/ https://blog.torproject.org/blog/tor-security-advisory-relay... Isn't it plausible they could have received a warrant for each of those hidden services? They probably didn't, but targeting specific services isn't that abhorrent to me, especially the ones engaged in highly unethical behavior (child porn, theft, scams). I don't think drug markets should be illegal, but that's a separate issue entirely.
- tptacek 11y agoEverything else aside, if $1MM is all it takes to unmask a Tor user, we have bigger problems than CMU.
- doktrin 11y agoThis is the truth. With little exaggeration, we're talking about the work of two engineers over the course of a year. That needs to sink in.
- ENOTTY 11y agoCERT falls under the Software Engineering Institute, which is a Federally-Funded Research and Development Center sponsored by the Department of Defense. CMU administers the SEI in the same way MIT administers Lincoln Laboratory. This kind of thing happens in private industry as well. For example some CMU professors also hold positions at Google (while still remaining active CMU professors doing public research, i.e., not on sabbatical) and do work that might not get released to the public. Admittedly, the line between SEI and CMU is rather fuzzy, so the line between contract work for the government (or whoever else) and academic research is fuzzy. Should there be a brighter line between contract work and academic work?
- deleted 11y ago[deleted]
- gwright 11y agoThe article isn't really clear, but the alleged activities were attributed to SEI, which is not at all the same thing as CMU, although they are obviously related. reporting: http://www.post-gazette.com/business/technology/2014/07/31/2-CMU-experts-said-to-unmask-surfing-software/stories/201407310210 http://www.post-gazette.com/business/technology/2014/07/31/2... About SEI: http://www.sei.cmu.edu/about/organization/workingwithanFFRDC.cfm http://www.sei.cmu.edu/about/organization/workingwithanFFRDC... Lots of room for discussion about these activities but it probably should be done in the context of expectations for a Federally Funded Research and Development Center (and one funded by the Department of Defense) and not in the context of expectations for a private university.
- appleflaxen 11y agowhen you are a subdomain on cmu.edu, I am going to hold cmu.edu responsible for your actions (regardless of the formal legal relationship between the two)
- gwright 11y agoWhy? Should bit.ly be held responsible for the actions of the Libyan government? Should customers of heroku be held responsible for Heroku's corporate actions (customer.herokuapp.com)? The domain hierarchy doesn't actually tell you much about the relationships between entities and certainly doesn't tell you enough on its own to discern culpability between entities.
- mlonkibjuyhv 11y agoI believe you got the hierarchy backwards.
- gwright 11y agoI believe you are right about the direction. :-) Point still stands, DNS hierarchy doesn't imply culpability or legal responsibility in either direction.
- mirimir 11y agoAnyone paying attention has been aware of this since last fall. It's common knowledge that CMU/SEI works for the US military. And the timing was a total giveaway. They pulled the Black Hat talk, and SR2 etc went down not long thereafter. But it's not surprising that CMU/SEI would do this. Legal niceties aside, it's arguably part of their mission. The focus here, in my opinion, ought to be on the Tor Project's role in this. Although they did speak up last summer, and have blogged this update, I'm not impressed. They ignored the CMU attack for five months last spring. Maybe they did get blindsided by a new kind of attack. Maybe they just weren't paying enough attention. Or maybe, as they've noted, there aren't many devs who focus on onion services. But so far there's been no mea culpa from the Tor Project. It's disingenuous to whinge about unethical researchers and investigators. It's stuff like this that fuels conspiracy theories about Tor and the US military. The Tor Project needs to take a stand.
- mirimir 11y agoEdit: The Tor Project didn't see the CMU/SEI attack while it was happening. Maybe it was too subtle. Maybe the network is too chaotic. But I have no basis for saying that they ignored it. Still, maybe the Tor network needs an IDS.
- ENOTTY 11y ago> We actually noticed these relays when they joined the network, since the DocTor scanner reported them. We considered the set of new relays at the time, and made a decision that it wasn't that large a fraction of the network. It's clear there's room for improvement in terms of how to let the Tor network grow while also ensuring we maintain social connections with the operators of all large groups of relays. Sounds like they did know?
- eadz 11y agoNo, it sounds like they knew new nodes joined the network. Not that they knew what they were doing - they seemed to have suspected something, but made the decision that it was a small enough fraction of the network to not worry about, but obviously in hindsight they were wrong about that.
- diecrypt 11y agoThis would not surprise me at all, oh yeah let's not forget about where the funding is coming from ^_^
- kennydude 11y agoI never hear anything positive about Carnegie Mellon ever. Do they even do good things? :/
- jokoon 11y agoCould someone tell me why freenet and similar project are not as popular as tor ? And is they're more or less secure than tor ?