8 ms·

The FBI Is Classifying Its Tor Browser Exploit

128 points by ashitlerferad 10y ago

giardini 10y ago
If the exploit is classified, how can it be verified that the exploit actually extracted the evidence claimed? That is, how can the FBI prove that it did not obtain the evidence by other, illegal means (as they have instructed other agencies to do)? Provenance of evidence is everything in criminal cases.
- x5n1 10y ago
  Because the FBI wouldn't lie about stuff like this. And parallel reconstruction does not exist. I meant honestly, if there were any real hard rules, other than do whatever you can get away with, much if not all criminal case evidence would be highly suspect, demanding at the least a retrial.
  - Allower 10y ago
    >Because the FBI wouldn't lie about stuff like this This is sarcasm right? Otherwise you are an idiot
  - jonathankoren 10y ago
    https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law
- IgorPartola 10y ago
  "I just know he's guilty, your honor. I just know it in my heart of hurts. Just trust me on this, OK? Just, like, trust me. I mean I am here busting my balls working 14 hour days keeping our people safe, your honor, and I just really need a win right now. So can you just, like, find him guilty? Like, I've never asked you for any personal favors. And I totally have the evidence, but who needs that. I mean I just not it, just by looking into his eyes. Look at him, doesn't he just look guilty to you, your honor?"
  - tropo 10y ago
    The obvious solution is to have a court that can handle classified material.
    - JoshTriplett 10y ago
      The defendant has a legal right to be present, and to see all the evidence presented against them, even if they're neither allowed to receive "classified" information nor bound to not disclose it. So no, classified evidence is not evidence. If you can't make a case against someone without classified information, decide which you care more about: the classification of the information, or the conviction.
      - tropo 10y ago
        There would be lawyers with security clearances, and the defendant would usually have to rely on his lawyer. It's not perfect, but it balances the conflicting needs better than any alternative I've ever seen. Note that this isn't 1-sided in favor of the government. Consider what happens today. People working at Area 51 tried to sue over being exposed to toxins, but were stopped by the state secrets privilege. That privilege would die if we had classified courts.
      - kabdib 10y ago
        Can the defendant insist on a jury trial if some of the evidence is classified? What happens then?
        burfog 10y ago
        There really shouldn't be any trouble finding people with security clearances to be on the jury. If anything, this is a far superior "jury of peers". It's people who do the same sort of work.
        JoshTriplett 10y ago
        > It's people who do the same sort of work. Exactly the problem. "People with security clearances" seems like a set of people more likely on average to favor the government point of view, to the point that a defense attorney that allowed twelve people with security clearances to form a jury has utterly failed at voir dire.
- serge2k 10y ago
  Closed binary demonstrates they can pull data.
  - fweespeech 10y ago
    It doesn't verify the data is accurate and correct at the time of collection. Without that evidence is literally worthless.
    - Consultant32452 10y ago
      How is this concern different for any form of evidence? At some point you're trusting that a person collected evidence in the way they claim to have collected it. To help me understand, could you make an analogy for a drug bust? Theoretically an officer could plant drugs on you. And that does happen from time to time, but we don't just ignore all evidence because that might have happened.
      - AnthonyMouse 10y ago
        The difference between a lie and "that's classified" is that you can disprove a lie.
        Consultant32452 10y ago
        You can disprove the claims made from classified sources. "A classified source said you bought 50 kilos of cocaine. We searched your house and found 50 kilos of cocaine." You're still going to jail. If no cocaine turns up, then you should be in the clear.
        AnthonyMouse 10y ago
        The claim you're going to want to challenge there isn't the existence of the cocaine, it's the existence of probable cause to search your house for it. Yes, the exclusionary rule means the bad guys win when the good guys can't prove they followed the rules. That's how the exclusionary rule gets the good guys to follow the rules.
- tptacek 10y ago
  You can say pretty much the same thing about all electronic evidence. Ultimately it comes down to people involved in the chain of custody for the evidence signing affidavits, whether the evidence is an exploit or a simple log file.
  - saosebastiao 10y ago
    Except the chain of custody involved easily MITM-able unencrypted data: http://motherboard.vice.com/read/fbi-our-malware-sends-unencrypted-evidence-and-thats-a-good-thing http://motherboard.vice.com/read/fbi-our-malware-sends-unenc...
    - tptacek 10y ago
      Again not sure how arguments like that don't apply to most collected electronic evidence. Defendants can raise that argument in court; evidence is routinely disputed.
  - EdHominem 10y ago
    There's a huge difference between the chain of custody and the methods used to extract information. If I'm allowed to use a classified system to extract information (say from an encrypted drive) I could really just be creating that information instead. The defendant can't or won't decrypt the drive so they can't dispute the claim.
    - tptacek 10y ago
      I guess I don't understand how this isn't trivially true of the simplest log file introduced into evidence.
      - EdHominem 10y ago
        Log files are cleartext. We can both see what it says on day 1 and that won't change. But if there's a classified evidence-gathering program it can be upgraded to "find" whatever they want at any date.
- rotrux 10y ago
  but it's not everything in situations outside the rule-of-law. Just because something isn't legally provable doesn't make it false. I suppose the existence of the exploit could be a very VERY elaborate set of smoke and mirrors, but I doubt it. DC shoots from the hip just like everyone else. "never attribute to malice that which can be attributed to incompetence." -Some Smart Guy IDK...Google it.
- gozur88 10y ago
  The FBI has two different, and sometimes opposed, missions. The primary mission is security - it's supposed to stop terrorists from terrorizing, spies from spying, saboteurs from... well, whatever. After-the-fact law enforcement is secondary. It may be this is a tool they intend to use to attack spy and terrorist networks where breaking up the network is more important than getting prosecutions.
  - pdkl95 10y ago
    The FBI dropped law enforcement from their mission statement several years ago, and now considers their mission to be intelligence work only.
    - dragonwriter 10y ago
      > The FBI dropped law enforcement from their mission statement several years ago, and now considers their mission to be intelligence work only. That's an interesting claim, but utterly untrue: "The mission of the FBI is to protect and defend the United States against terrorist and foreign intelligence threats, to uphold and enforce the criminal laws of the United States, and to provide leadership and criminal justice services to federal, state, municipal, and international agencies and partners; and to perform these responsibilities in a manner that is responsive to the needs of the public and is faithful to the Constitution of the United States." https://www.justice.gov/jmd/organization-mission-and-functions-manual-federal-bureau-investigation https://www.justice.gov/jmd/organization-mission-and-functio...
  - hackuser 10y ago
    > The primary mission is security ... After-the-fact law enforcement is secondary. I'm not sure that's true. Where do you get that?
    - deleted 10y ago
      [deleted]
    - gozur88 10y ago
      https://www.fbi.gov/about-us/quick-facts https://www.fbi.gov/about-us/quick-facts
_audakel 10y ago
The FBI and other government institutions often ask for the help of the tech industry, and act like they want to build bridges but actions like this show a double standard. They are like your annoying needy friend. Always asking you for stuff but never bothering to return the favor.
- mhurron 10y ago
  > show a double standard No they don't. Assistance that industry would provide would also be classified and honestly a penalty would probably be levied if the found issues were ever fixed. So they found it on their own, results classified so they can't be fixed. Needed help finding it, threaten penalties if the issue is ever fixed. They're not trying to build bridges, they're trying to gain control of another source of information.
Allower 10y ago
In the name of 'security' we are making things less secure. Yeah sounds like government logic
rotrux 10y ago
Contrary to my usual opinion about the US Federal Government's "cyber-tactics," this actually seems like a good thing. I'd rather that fewer people understand how to break tor, as opposed to more. There's a middle ground which may be better, but on the open-source/classified spectrum I'm a little right-leaning on this one. Thoughts?
- MaxfordAndSons 10y ago
  Yea as a sibling indicated, the obvious better middle ground is the exploit just not existing any more. If the exploit were in the protocol itself then that might not have been viable, but the facts of the case suggest it's an implementation level exploit, in which case the FBI choosing to hoard it actually does increase the chance of more people (even outside of the American intel community) gaining access to the exploit.
- godgod 10y ago
  Not me. I'd rather have many people know how to break TOR so that it actually gets fixed. Having one entity with the knowledge of a vulnerability helps no one but themselves.
- SparkyMcUnicorn 10y ago
  It should be patched. Am I wrong? The entire reasoning behind using tor is for anonymity, and we don't know what this exploit is exactly or how serious it is.
  - rotrux 10y ago
    I remember reading an doctoral paper from MIT about it, and the general principal involved a combination of large swaths of man-in-the-middle tor nodes, combined with algorithms resembling physics formulas which use statistical mechanics to model fluid dynamics. If that's the case the exploit is intrinsically linked to the way tor works, and there may be no patching possible. I'ma need someone to fact-check me because I'm semi-busy right now and I don't have the article on-hand.
    - 10y ago
deleted 10y ago
[deleted]
f00_ 10y ago
Why is Tor Browser still using FF instead of Chrome or something? A sandbox is necessary, and I'm 100% sure there are a ton of 0-days in all browsers.
- kolme 10y ago
  Chrome is not even open source. They can't use it. If you're referring to Chromium, well, what makes you think it's more secure than Firefox? Also, don't you think that the developers of the Tor browser are pretty security-aware? That they might make very well informed decisions?
  - munin 10y ago
    chromium still has a sandbox
    - fapjacks 10y ago
      And mystery binary blobs have made an appearance[0] [0] https://www.reddit.com/r/linux/comments/3a0rz0/chromium_unconditionally_downloads_binary_blob/ https://www.reddit.com/r/linux/comments/3a0rz0/chromium_unco...
      - lima 10y ago
        Distros can choose to disable that feature. Also note that the blob runs _inside_ the sandbox.
  - f00_ 10y ago
    "developers of the Tor browser" probably not, lots of incompetent people in infosec. Tor itself has decent devs, but even they have seen leadership troubles recently, pressure from feds etc. Check the mailing-list. Reminder, this isn't a vulnerability in Tor, but an IP leak in Firefox, or at least the way it's configured in TBB. Maybe a sandbox is irrelevant to an IP leak though, idk.
  - lima 10y ago
    Chromium is a magnitude more secure than Firefox. If you find a 0day in the Firefox renderer, bam, code execution with full user permissions. A 0day in Chromium renderer code is pretty much worthless. Firefox has zero additional layers of security. Chromium has a battle-tested sandbox which kills 99% of all exploits in the absence of an additional kernel exploit. Also note how none of the recent Flash 0days was exploitable on Chrome.
kstenerud 10y ago
So write a bot that browses bad sites on tor and see what infections it picks up, then examine what vulnerabilities they exploit.

128 points by ashitlerferad 10y ago

If the exploit is classified, how can it be verified that the exploit actually extracted the evidence claimed? That is, how can the FBI prove that it did not obtain the evidence by other, illegal means (as they have instructed other agencies to do)? Provenance of evidence is everything in criminal cases.

x5n1 10y ago
Because the FBI wouldn't lie about stuff like this. And parallel reconstruction does not exist. I meant honestly, if there were any real hard rules, other than do whatever you can get away with, much if not all criminal case evidence would be highly suspect, demanding at the least a retrial.
- Allower 10y ago
  >Because the FBI wouldn't lie about stuff like this This is sarcasm right? Otherwise you are an idiot
- jonathankoren 10y ago
  https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law
IgorPartola 10y ago
"I just know he's guilty, your honor. I just know it in my heart of hurts. Just trust me on this, OK? Just, like, trust me. I mean I am here busting my balls working 14 hour days keeping our people safe, your honor, and I just really need a win right now. So can you just, like, find him guilty? Like, I've never asked you for any personal favors. And I totally have the evidence, but who needs that. I mean I just not it, just by looking into his eyes. Look at him, doesn't he just look guilty to you, your honor?"
- tropo 10y ago
  The obvious solution is to have a court that can handle classified material.
  - JoshTriplett 10y ago
    The defendant has a legal right to be present, and to see all the evidence presented against them, even if they're neither allowed to receive "classified" information nor bound to not disclose it. So no, classified evidence is not evidence. If you can't make a case against someone without classified information, decide which you care more about: the classification of the information, or the conviction.
    - tropo 10y ago
      There would be lawyers with security clearances, and the defendant would usually have to rely on his lawyer. It's not perfect, but it balances the conflicting needs better than any alternative I've ever seen. Note that this isn't 1-sided in favor of the government. Consider what happens today. People working at Area 51 tried to sue over being exposed to toxins, but were stopped by the state secrets privilege. That privilege would die if we had classified courts.
    - kabdib 10y ago
      Can the defendant insist on a jury trial if some of the evidence is classified? What happens then?
      - burfog 10y ago
        There really shouldn't be any trouble finding people with security clearances to be on the jury. If anything, this is a far superior "jury of peers". It's people who do the same sort of work.
        JoshTriplett 10y ago
        > It's people who do the same sort of work. Exactly the problem. "People with security clearances" seems like a set of people more likely on average to favor the government point of view, to the point that a defense attorney that allowed twelve people with security clearances to form a jury has utterly failed at voir dire.
serge2k 10y ago
Closed binary demonstrates they can pull data.
- fweespeech 10y ago
  It doesn't verify the data is accurate and correct at the time of collection. Without that evidence is literally worthless.
  - Consultant32452 10y ago
    How is this concern different for any form of evidence? At some point you're trusting that a person collected evidence in the way they claim to have collected it. To help me understand, could you make an analogy for a drug bust? Theoretically an officer could plant drugs on you. And that does happen from time to time, but we don't just ignore all evidence because that might have happened.
    - AnthonyMouse 10y ago
      The difference between a lie and "that's classified" is that you can disprove a lie.
      - Consultant32452 10y ago
        You can disprove the claims made from classified sources. "A classified source said you bought 50 kilos of cocaine. We searched your house and found 50 kilos of cocaine." You're still going to jail. If no cocaine turns up, then you should be in the clear.
        AnthonyMouse 10y ago
        The claim you're going to want to challenge there isn't the existence of the cocaine, it's the existence of probable cause to search your house for it. Yes, the exclusionary rule means the bad guys win when the good guys can't prove they followed the rules. That's how the exclusionary rule gets the good guys to follow the rules.
tptacek 10y ago
You can say pretty much the same thing about all electronic evidence. Ultimately it comes down to people involved in the chain of custody for the evidence signing affidavits, whether the evidence is an exploit or a simple log file.
- saosebastiao 10y ago
  Except the chain of custody involved easily MITM-able unencrypted data: http://motherboard.vice.com/read/fbi-our-malware-sends-unencrypted-evidence-and-thats-a-good-thing http://motherboard.vice.com/read/fbi-our-malware-sends-unenc...
  - tptacek 10y ago
    Again not sure how arguments like that don't apply to most collected electronic evidence. Defendants can raise that argument in court; evidence is routinely disputed.
- EdHominem 10y ago
  There's a huge difference between the chain of custody and the methods used to extract information. If I'm allowed to use a classified system to extract information (say from an encrypted drive) I could really just be creating that information instead. The defendant can't or won't decrypt the drive so they can't dispute the claim.
  - tptacek 10y ago
    I guess I don't understand how this isn't trivially true of the simplest log file introduced into evidence.
    - EdHominem 10y ago
      Log files are cleartext. We can both see what it says on day 1 and that won't change. But if there's a classified evidence-gathering program it can be upgraded to "find" whatever they want at any date.
rotrux 10y ago
but it's not everything in situations outside the rule-of-law. Just because something isn't legally provable doesn't make it false. I suppose the existence of the exploit could be a very VERY elaborate set of smoke and mirrors, but I doubt it. DC shoots from the hip just like everyone else. "never attribute to malice that which can be attributed to incompetence." -Some Smart Guy IDK...Google it.
gozur88 10y ago
The FBI has two different, and sometimes opposed, missions. The primary mission is security - it's supposed to stop terrorists from terrorizing, spies from spying, saboteurs from... well, whatever. After-the-fact law enforcement is secondary. It may be this is a tool they intend to use to attack spy and terrorist networks where breaking up the network is more important than getting prosecutions.
- pdkl95 10y ago
  The FBI dropped law enforcement from their mission statement several years ago, and now considers their mission to be intelligence work only.
  - dragonwriter 10y ago
    > The FBI dropped law enforcement from their mission statement several years ago, and now considers their mission to be intelligence work only. That's an interesting claim, but utterly untrue: "The mission of the FBI is to protect and defend the United States against terrorist and foreign intelligence threats, to uphold and enforce the criminal laws of the United States, and to provide leadership and criminal justice services to federal, state, municipal, and international agencies and partners; and to perform these responsibilities in a manner that is responsive to the needs of the public and is faithful to the Constitution of the United States." https://www.justice.gov/jmd/organization-mission-and-functions-manual-federal-bureau-investigation https://www.justice.gov/jmd/organization-mission-and-functio...
- hackuser 10y ago
  > The primary mission is security ... After-the-fact law enforcement is secondary. I'm not sure that's true. Where do you get that?
  - deleted 10y ago
    [deleted]
  - gozur88 10y ago
    https://www.fbi.gov/about-us/quick-facts https://www.fbi.gov/about-us/quick-facts

_audakel 10y ago

The FBI and other government institutions often ask for the help of the tech industry, and act like they want to build bridges but actions like this show a double standard. They are like your annoying needy friend. Always asking you for stuff but never bothering to return the favor.

mhurron 10y ago
> show a double standard No they don't. Assistance that industry would provide would also be classified and honestly a penalty would probably be levied if the found issues were ever fixed. So they found it on their own, results classified so they can't be fixed. Needed help finding it, threaten penalties if the issue is ever fixed. They're not trying to build bridges, they're trying to gain control of another source of information.

Allower 10y ago

In the name of 'security' we are making things less secure. Yeah sounds like government logic

rotrux 10y ago

Contrary to my usual opinion about the US Federal Government's "cyber-tactics," this actually seems like a good thing. I'd rather that fewer people understand how to break tor, as opposed to more. There's a middle ground which may be better, but on the open-source/classified spectrum I'm a little right-leaning on this one. Thoughts?

MaxfordAndSons 10y ago
Yea as a sibling indicated, the obvious better middle ground is the exploit just not existing any more. If the exploit were in the protocol itself then that might not have been viable, but the facts of the case suggest it's an implementation level exploit, in which case the FBI choosing to hoard it actually does increase the chance of more people (even outside of the American intel community) gaining access to the exploit.
godgod 10y ago
Not me. I'd rather have many people know how to break TOR so that it actually gets fixed. Having one entity with the knowledge of a vulnerability helps no one but themselves.
SparkyMcUnicorn 10y ago
It should be patched. Am I wrong? The entire reasoning behind using tor is for anonymity, and we don't know what this exploit is exactly or how serious it is.
- rotrux 10y ago
  I remember reading an doctoral paper from MIT about it, and the general principal involved a combination of large swaths of man-in-the-middle tor nodes, combined with algorithms resembling physics formulas which use statistical mechanics to model fluid dynamics. If that's the case the exploit is intrinsically linked to the way tor works, and there may be no patching possible. I'ma need someone to fact-check me because I'm semi-busy right now and I don't have the article on-hand.
  - 10y ago

deleted 10y ago

[deleted]

f00_ 10y ago

Why is Tor Browser still using FF instead of Chrome or something? A sandbox is necessary, and I'm 100% sure there are a ton of 0-days in all browsers.

kolme 10y ago
Chrome is not even open source. They can't use it. If you're referring to Chromium, well, what makes you think it's more secure than Firefox? Also, don't you think that the developers of the Tor browser are pretty security-aware? That they might make very well informed decisions?
- munin 10y ago
  chromium still has a sandbox
  - fapjacks 10y ago
    And mystery binary blobs have made an appearance[0] [0] https://www.reddit.com/r/linux/comments/3a0rz0/chromium_unconditionally_downloads_binary_blob/ https://www.reddit.com/r/linux/comments/3a0rz0/chromium_unco...
    - lima 10y ago
      Distros can choose to disable that feature. Also note that the blob runs _inside_ the sandbox.
- f00_ 10y ago
  "developers of the Tor browser" probably not, lots of incompetent people in infosec. Tor itself has decent devs, but even they have seen leadership troubles recently, pressure from feds etc. Check the mailing-list. Reminder, this isn't a vulnerability in Tor, but an IP leak in Firefox, or at least the way it's configured in TBB. Maybe a sandbox is irrelevant to an IP leak though, idk.
- lima 10y ago
  Chromium is a magnitude more secure than Firefox. If you find a 0day in the Firefox renderer, bam, code execution with full user permissions. A 0day in Chromium renderer code is pretty much worthless. Firefox has zero additional layers of security. Chromium has a battle-tested sandbox which kills 99% of all exploits in the absence of an additional kernel exploit. Also note how none of the recent Flash 0days was exploitable on Chrome.

kstenerud 10y ago

So write a bot that browses bad sites on tor and see what infections it picks up, then examine what vulnerabilities they exploit.