8 ms·
German foreign spy agency BND attacks the anonymity network Tor
- KGIII 9y agoI thought it was well established that timing attacks could identify the user? My understanding is that if you remain on the network, domains ending with .onion, you're still able to remain anonymous.
- ZirconCode 9y agoI haven't seen much discussion in defending against timing attacks, is it really that difficult? If we introduced long delays and artificial data sizes shouldn't it be possible? A constant stream not withstanding. Of course it makes things clumsier, but that's always the price.
- KGIII 9y agoI'm not sure how effective that would be. They see you go in and they see you go out. If they can use the process of elimination, if nothing else, you can be unmasked. Those types of things would probably only make it more difficult, but not impossible. If you're going to do illegal things, or want anonymity, remain on the network - domains ending with .onion. The regular web is inherently not anonymous.
- hackermailman 9y agoThe gist of the longer translated article is BND believes the majority of Tor relays are run by spy agencies, aka a global adversary that can watch most of the traffic. So you connect to the NSA run bridge that routes you to the GCHQ/NSA/CSIS/ASIO run farm of internal relays.
- KGIII 9y agoIf I understand correctly, and I may not, that still only matters if you're leaving the network. If you use Tor to browse the regular web, a country-level adversary can unmask you. If you remain on the network, and don't do silly things like use scripting, you should be okay. Should be...
- gpm 9y agoIf they control all the nodes from your computer to the secret service you are connecting to, they can trivially deanonymize you. Staying in the network doesn't protect you. Also the case if they are missing a few nodes in the middle, as long as they control the entrance, exit, and never miss two in a row.
- kpcyrd 9y ago> So you connect to the NSA run bridge that routes you to the GCHQ/NSA/CSIS/ASIO run farm of internal relays. This isn't possible. Your tor daemon fetches the consensus from a directory server and picks the relays and exits itself. The directory server can't tamper with that consensus because its signed by the directory authorities, a small set of servers that are necessary because of this attack.
- jacquesm 9y agoYou are right in principle but if the vast majority of the nodes are run by adversaries then to all intents and purposes it might as well be true because that directory of relays and exits contains such a large percentage of adversaries your chances of hitting one of the 'good guys' are nil.
- hackermailman 9y agoPart of their reasoning for this warning is BND claims vast majority of relays are in 5 Eyes Alliance countries, and BND claims they told the 5 Eyes Alliance a few years ago they should just run relays themselves until the odds are favored a Tor user ends up using spy agency relays.
- yborg 9y agoI've always assumed that once Tor was sufficiently popular that the majority of nodes would end up being attackers. NSA gets whatever money it wants, there must be entire server farms running Tor nodes for them. What has always surprised me is that someone hasn't tried to install Tor nodes into compromised IoT devices, etc. If a virus is installing millions of nodes in the wild, that might be enough to keep the network majority non-attacker. As it stands, NSA or China, or whoever just ends up buying the whole network.
- kuschku 9y agoYou just need to take Raspberry Pi Zero’s, install TOR nodes on them, and drop them anywhere with free WiFi and a working charger – so you can hide them in streetlights near starbucks, etc. That would be enough to get thousands of nodes. (And probably a bit less illegal, although still not legal)
- matt4077 9y agoI may be wrong (and invite correction if so), but I believe .onion addresses do not guarantee anonymity. Servers on the tor network aren't some magical machines. They sit in the same datacenter as any other server, and all their traffic reaches them via the internet. Controlling the nodes connected to them should give you a pretty good idea of at least the magnitude of traffic they're seeing. And even without running any nodes, attacking blocks of IPs suspected to include the service while measuring any potential impact on its latency allows you find their public IP (given enough resources and/or time). Then, there's the attack of try
- jfaucett 9y agoFor those who can read German, here's the original with a lot more information including cited documents and graphs and charts. https://netzpolitik.org/2017/geheime-dokumente-der-bnd-hat-das-anonymisierungs-netzwerk-tor-angegriffen-und-warnt-vor-dessen-nutzung/ https://netzpolitik.org/2017/geheime-dokumente-der-bnd-hat-d...
- CommentCard 9y agoCouldn't you circumvent this by using a VPN to access TOR? It would obfuscate the entry point.
- nomel 9y agoIf you have an anonymous VPN, then what's the need for tor?
- freeflight 9y agoRedundancy, why use only one lock when you could use three different ones? That, of course, assumes that none of the locks come with a vulnerability which would allow an attacker to bypass all the locks at once.
- posterboy 9y ago> redundancy I always rot13 twice for good measure, too.
- kakarot 9y agoWouldn't your traffic then be compromised at the VPN level, opening you to snooping from your provider? Or do I not understand something about how TOR encrypts its requests?
- sillysaurus3 9y agoThis is correct. It's important to remember that everyone is just very, very bad at opsec. The ones who aren't usually don't comment. It's very hard and you spend most nights worrying the police will kick your door in. Not too worthwhile. Those who are serious should learn from the Whonix wiki. It's hard to find a more stellar source of unbiased and comprehensive information. They have pros and cons of both VPN to Tor and Tor to VPN, but that's like 2% of the overall concerns you have to worry about.
- 9y ago
- deleted 9y ago[deleted]
- tannhaeuser 9y agoOfficial translation at https://netzpolitik.org/2017/secret-documents-reveal-german-foreign-spy-agency-bnd-attacks-the-anonymity-network-tor-and-advises-not-to-use-it/ https://netzpolitik.org/2017/secret-documents-reveal-german-...
- yllaucaj 9y agoCould someone explain the bit about "The Internet for Dummies" at the beginning? Why is that quote there?
- matt4077 9y agoI'm not entirely sure, either. But I think the guy made a joke when testifying in parliament about the spy service being behind so far technologically that they had just recently bought a copy of "Internet for Dummies" to catch up. In this article, it's supposed to set up the surprise that they were not, after all, completely stupid. The translation is a bit off, I think. I can't really figure out what to make of all these apparently self-aggrandising statements, and I can assure you that no German bureaucrat would use the term "Yanks".
- musage 9y ago> I can assure you that no German bureaucrat would use the term "Yanks". Well then let me assure everybody your assurance is mistaken. Two examples: > Wir haben den Amis ja was versprochen und Mitte März ist AL [Harald Fechner] dort. and > Das, was wir jetzt haben, wäre ein guter Stand, um mit den Experten der Amis zu reden. When reading "Yanks", I automatically assumed it's a translation of "Ami". How would you translate it better? "Yankee" has negative and benign connotations, as does "Ami", and in this context they're clearly benign. While looking into the word I came across this: https://en.wikipedia.org/wiki/New_York_Yankees https://en.wikipedia.org/wiki/New_York_Yankees > New York Press Sports Editor Jim Price coined the unofficial nickname Yankees (or "Yanks") for the club as early as 1904, because it was easier to fit in headlines and because "Yankee" was and is a commonly-used synonym for "American". Where's the biggie? bonus rant: German bureaucrats use all sorts of words in all sorts of contexts. If you mean for public communications, you're right of course, but at the workplace and in internal emails all sorts of things are possible. It's not like repression and conformity generates civility, they just generates masks, a pretense of civility. That's why the stereotypical bureaucrat, nationality irrelevant, will sign off the murder of millions as long as the paperwork is in order, but apologize profusely if they spill their drink on your clothes, and that outwardly gentleman-like behavior is compensation supposed to ward off the inevitable collapse of a house of cards built on a sinkhole, not an actual expression of the inner reality. Ask any high ranking prostitute who has the weirdest kinks or the most destructive fantasies. Maybe it won't be German bureaucrats, but it will be people who behave the total opposite in real life, and are considered super proper or even admirable. It usually won't be the guy who spits on the ground all the time and calls everybody names. Okay, maybe because he can't afford a prostitute, but at any rate, the idea that a German bureaucrat is less likely to be abusive than the average person just doesn't sit at all with me.
- mirimir 9y ago> How exactly the spy agencies want to crack Tor remains vague. > Precisely how the BND plans to „chop“ Tor is unfortunately redacted in the document we obtained. But as before, the spy agency refers to public research. To implement the attack, it is likely that the spies runs their own servers in the Tor network. M.S. points to passive snooping servers, which are presumably operated by the NSA, and emphasizes the „protection of the anonymity“ of the spy agencies. And indeed, there are no specifics. Tor Project acknowledges that Tor is vulnerable to global adversaries. With enough intercepts, they can correlate traffic at various relays, and connected users and servers. There's nothing magic about onion services. It's just that there are seven relays between users and servers, rather than just the normal three for Tor. But hey, it provides better anonymity than any alternative. Other than meeting in remote locations, anyway. And you can add VPNs to the mix. I always use Tor through nested VPN chains. That adds misdirection. But perhaps most importantly, it adds latency and jitter, which mitigate traffic correlation attacks. Edit: As a fun science project, you can play with traffic correlation between you and your private onion service. You use unlisted private bridges as entry guards, both locally and for the onion service. So it's only your traffic that gets analyzed. And you don't need sophisticated software. Wireshark and a spreadsheet are enough. So you have packet captures from your local machine, and from the VPS running the onion service. Using Wireshark, you export bitrate in millisecond bins. Then in the spreadsheet, you have two columns, one with each bitrate series. Just create a third column for the product. Each sheet will hold 1E6 lines, or 1000 seconds. Excel works best, because it uses multiple cores. R would be better, because you could crunch segments in parallel.
- microcolonel 9y agoYou can also set up fragile directional radio links pretty cheap with off the shelf devices from Ubiquiti. If set up carefully, they can be basically impossible to follow if they are not aligned when they are observed by the adversary; and at least a little difficult even when they are. You can also use a tamper detecting opaque enclosure to (visually) hide the orientation. We are in the middle of a golden age for surveillance, and a golden age for the avoidance of surveillance.
- 9y ago
- jpelecanos 9y agoBased on the article, it seems that the German government combined foreign and signals intelligence into one agency, the BND. In the US, however, Truman separated them into the CIA [0] and the NSA [1], respectively. Thus, is there a specific reason for BND's dual role? [0] https://www.cia.gov/library/center-for-the-study-of-intelligence/kent-csi/vol20no1/html/v20i1a02p_0001.htm https://www.cia.gov/library/center-for-the-study-of-intellig... [1] https://www.nsa.gov/news-features/declassified-documents/truman/ https://www.nsa.gov/news-features/declassified-documents/tru...
- guitarbill 9y agoThe BND (Bundesnachrichtendienst) is civilian federal foreign intelligence, the BfV (Bundesamt für Verfassungsschutz) is civilian federal domestic intelligence. It was probably not a great idea for e.g. diplomacy if Germany had loads of foreign intelligence agencies after WW2. In the US, you have way more agencies. The five most famous are Central Intelligence Agency (CIA), National Security Agency (NSA), Defense Intelligence Agency (DIA), National Geospatial-Intelligence Agency (NGA), and National Reconnaissance Office (NRO) [0]. Germany does have other military intelligence agencies, such as Kommando Strategische Aufklärung or Militärischer Abschirmdienst (domestic military intelligence). They are subdivisions of the German military (Bundeswehr). Some of the US agencies are child agencies of the DoD. So arguably it's similar? And because Europe is countries but the US is states, it isn't really comparable in size, so splitting these roles into different agencies makes less sense. There are benefits of having only one agency/organisation, e.g. re-assigning personnel and easier cooperation (inner-agency vs inter-agency). [0] https://en.wikipedia.org/wiki/United_States_Intelligence_Community#Organization https://en.wikipedia.org/wiki/United_States_Intelligence_Com...
- tryingagainbro 9y agoSo BND and NSA (+ five eyes) can do this. It's probably super-safe to use in smaller countries, unless you talk about stuff that DEA /CIA /Counter Terror might be interested in.