6 ms·

Tor is no longer secure; the U.S. government paid Carnegie Mellon (CMU) to research ways of de-anonymizing users by inserting specially designed packets into To

by trendia 10y ago

Tor is no longer secure; the U.S. government paid Carnegie Mellon (CMU) to research ways of de-anonymizing users by inserting specially designed packets into Tor user data at controlled nodes. [1] Nearly a year-and-a-half after CMU canceled a Black Hat presentation, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk. Included in the information handed over to Farrell's legal representative was the following: On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0. [1] https://www.techdirt.com/articles/20160225/07295633707/silk-road-20-court-docs-show-us-government-paid-carnegie-mellon-researchers-to-unmask-tor-users.shtml https://www.techdirt.com/articles/20160225/07295633707/silk-...

zmanian 10y ago
The CMU attack required setting up a very large number of malicious relays on the Tor network. It was bad that Tor didn't notice the large number of new relays joining the network but greater vigilance is being shown. Tor is effective against many threat models and yet many attacks are known. Further work is required.
- pyre 10y ago
  People do pay attention to these things: https://www.profwoodward.org/2016/02/what-just-happened-on-tor-network.html https://www.profwoodward.org/2016/02/what-just-happened-on-t...
atdt 10y ago
This was covered by Motherboard[1]. The Tor Project put out the following statement in response: "the Tor network is secure and has only rarely been compromised. The Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU) compromised the network in early 2014 by operating relays and tampering with user traffic. That vulnerability, like all other vulnerabilities, was patched as soon as we learned about it. The Tor network remains the best way for users to protect their privacy and security when communicating online." [1] http://motherboard.vice.com/en_au/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds http://motherboard.vice.com/en_au/read/carnegie-mellon-unive...
- trendia 10y ago
  I think that Tor, like Bitcoin, will always be vulnerable if a particularly powerful entity is able to obtain a majority of nodes. (Or, in the case of Bitcoin, a majority of hashing power). And the more troubling aspect is that the courts have accepted the government's arguments that no warrant is required to disclose IP addresses: > ... Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under those circumstances. If both of these statements are true (that the government could easily run a majority of Tor relays, and that the government does not need a subpoena), then any particular vulnerability being patched is irrelevant to the inherent insecurity of the network.
  - cjbprime 10y ago
    Though note that Tor is also vulnerable to someone who doesn't control a majority of nodes, but can monitor the traffic of a majority of nodes from upstream. This is probably easier to achieve for a global adversary than actual control of the nodes' computation. This doesn't make it bad software; it's the best we have, and being able to monitor traffic across the entire Internet is a huge ask of an attacker.
    - nbraud 10y ago
      Also, remember that the NSA has had that kind of capabilities for a while, yet what came out of the Snowden leaks was “Tor stinks” (read: “We don't know how to break it in any practical sense”).
      - WilliamDhalgren 10y ago
        yup. Though apparently they could deanonymize some folks, but couldn't target the users they wanted. But I'd expect that to change, a low-latency network like tor that also doesn't create cover traffic just architecturally isn't equipped to deal with something approaching a global passive adversary. Though networks for even that can be built..
awqrre 10y ago
I would not trust Tor (by itself) to hide from the Government but I would trust it if I wanted to hide my IP address from a particular website, for example.
- zipwitch 10y ago
  If all you're concerned with is keeping basic information out of the hands of comparatively low-resource adversaries (such as hiding your IP address from single website and its authors/owners) there are low-cost and comparatively simple solutions. For examples, a decent VPN or visit to Starbucks costs <$10. (And there are also free proxies, within limits.) I thought the whole point of Tor was that it would work against highly capable or motivated adversaries?
  - awqrre 10y ago
    I'm just saying that if I was trying to hide data from the government, I would be much more paranoid (in some cases it might be a good idea to use a device not owned by you on somebody's else network, for example)... but in cases where you are facing a low-resource adversary, I would not bother with a non-free VPN when you can have Tor for free which have the potential to be better then a VPN.
    - semi-extrinsic 10y ago
      Surely, if you're paranoid about hiding data from the government, it should be easy enough to handle by using a secondhand diskless laptop with a USB live distro with no RW filesystem, and then wardriving for people running WEP or WPS on their wifis? Especially WPS is still common and can be cracked quite quickly. With one of those big-patch-antenna USB wifi cards that go for $40 on ebay, you can use an AP from several hundred yards easily.
      - dj_axl 10y ago
        > diskless laptop with a USB live distro with no RW filesystem Which distro? One known problem is that browsers still transmit their location. If the network and the laptop are hundreds of yards distant, that's an instant red flag. Once that problem is corrected, there may be unknown problems to deal with.
hackuser 10y ago
> Tor is no longer secure Secure against what or who? Nothing is completely secure. Your browser isn't secure, and most Tor users are using browsers over it to visit websites. All an attacker has ever needed to do is compromise your browser.
- ultramancool 10y ago
  This is why you should use Tor only with a series of VMs, one with internet and tor access to act as a router and the other which can only access the router vm. This lowers the attack surface to just that of Tor's proxy interface and your VM isolation. A physical implementation of this could be done for increased security.
  - chakalakasp 10y ago
    AKA Whonix.
    - nbraud 10y ago
      Or Tails
      - chakalakasp 10y ago
        TAILS is not designed to be run in a VM. You can do it but it's not recommended. Whonix on the other hand is designed with VMs in mind. Qubes running Whonix isn't a half bad solution, though a live CD of TAILS is probably best becuause your system will have relatively few traits that can be uniquely profiled to you. https://panopticlick.eff.org https://panopticlick.eff.org

by trendia 10y ago

zmanian 10y ago

The CMU attack required setting up a very large number of malicious relays on the Tor network. It was bad that Tor didn't notice the large number of new relays joining the network but greater vigilance is being shown. Tor is effective against many threat models and yet many attacks are known. Further work is required.

pyre 10y ago
People do pay attention to these things: https://www.profwoodward.org/2016/02/what-just-happened-on-tor-network.html https://www.profwoodward.org/2016/02/what-just-happened-on-t...

atdt 10y ago

This was covered by Motherboard[1]. The Tor Project put out the following statement in response: "the Tor network is secure and has only rarely been compromised. The Software Engineering Institute ("SEI") of Carnegie Mellon University (CMU) compromised the network in early 2014 by operating relays and tampering with user traffic. That vulnerability, like all other vulnerabilities, was patched as soon as we learned about it. The Tor network remains the best way for users to protect their privacy and security when communicating online." [1] http://motherboard.vice.com/en_au/read/carnegie-mellon-university-attacked-tor-was-subpoenaed-by-feds http://motherboard.vice.com/en_au/read/carnegie-mellon-unive...

trendia 10y ago
I think that Tor, like Bitcoin, will always be vulnerable if a particularly powerful entity is able to obtain a majority of nodes. (Or, in the case of Bitcoin, a majority of hashing power). And the more troubling aspect is that the courts have accepted the government's arguments that no warrant is required to disclose IP addresses: > ... Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under those circumstances. If both of these statements are true (that the government could easily run a majority of Tor relays, and that the government does not need a subpoena), then any particular vulnerability being patched is irrelevant to the inherent insecurity of the network.
- cjbprime 10y ago
  Though note that Tor is also vulnerable to someone who doesn't control a majority of nodes, but can monitor the traffic of a majority of nodes from upstream. This is probably easier to achieve for a global adversary than actual control of the nodes' computation. This doesn't make it bad software; it's the best we have, and being able to monitor traffic across the entire Internet is a huge ask of an attacker.
  - nbraud 10y ago
    Also, remember that the NSA has had that kind of capabilities for a while, yet what came out of the Snowden leaks was “Tor stinks” (read: “We don't know how to break it in any practical sense”).
    - WilliamDhalgren 10y ago
      yup. Though apparently they could deanonymize some folks, but couldn't target the users they wanted. But I'd expect that to change, a low-latency network like tor that also doesn't create cover traffic just architecturally isn't equipped to deal with something approaching a global passive adversary. Though networks for even that can be built..

awqrre 10y ago

I would not trust Tor (by itself) to hide from the Government but I would trust it if I wanted to hide my IP address from a particular website, for example.

zipwitch 10y ago
If all you're concerned with is keeping basic information out of the hands of comparatively low-resource adversaries (such as hiding your IP address from single website and its authors/owners) there are low-cost and comparatively simple solutions. For examples, a decent VPN or visit to Starbucks costs <$10. (And there are also free proxies, within limits.) I thought the whole point of Tor was that it would work against highly capable or motivated adversaries?
- awqrre 10y ago
  I'm just saying that if I was trying to hide data from the government, I would be much more paranoid (in some cases it might be a good idea to use a device not owned by you on somebody's else network, for example)... but in cases where you are facing a low-resource adversary, I would not bother with a non-free VPN when you can have Tor for free which have the potential to be better then a VPN.
  - semi-extrinsic 10y ago
    Surely, if you're paranoid about hiding data from the government, it should be easy enough to handle by using a secondhand diskless laptop with a USB live distro with no RW filesystem, and then wardriving for people running WEP or WPS on their wifis? Especially WPS is still common and can be cracked quite quickly. With one of those big-patch-antenna USB wifi cards that go for $40 on ebay, you can use an AP from several hundred yards easily.
    - dj_axl 10y ago
      > diskless laptop with a USB live distro with no RW filesystem Which distro? One known problem is that browsers still transmit their location. If the network and the laptop are hundreds of yards distant, that's an instant red flag. Once that problem is corrected, there may be unknown problems to deal with.

hackuser 10y ago

> Tor is no longer secure Secure against what or who? Nothing is completely secure. Your browser isn't secure, and most Tor users are using browsers over it to visit websites. All an attacker has ever needed to do is compromise your browser.

ultramancool 10y ago
This is why you should use Tor only with a series of VMs, one with internet and tor access to act as a router and the other which can only access the router vm. This lowers the attack surface to just that of Tor's proxy interface and your VM isolation. A physical implementation of this could be done for increased security.
- chakalakasp 10y ago
  AKA Whonix.
  - nbraud 10y ago
    Or Tails
    - chakalakasp 10y ago
      TAILS is not designed to be run in a VM. You can do it but it's not recommended. Whonix on the other hand is designed with VMs in mind. Qubes running Whonix isn't a half bad solution, though a live CD of TAILS is probably best becuause your system will have relatively few traits that can be uniquely profiled to you. https://panopticlick.eff.org https://panopticlick.eff.org