12 ms·

Hackers breach FSB contractor, expose Tor deanonymization project

356 points by ga-vu 7y ago

jakear 7y ago
Last time Tor was mentioned here, a user posted this link [1], claiming Tor is a military financed destabilization project. Seems unbelievable, but there appear to be lots of supporting documents. [1]: https://surveillancevalley.com/blog/fact-checking-the-tor-projects-government-ties https://surveillancevalley.com/blog/fact-checking-the-tor-pr...
- mrtksn 7y ago
  The funding part is not really a secret and it's even on the Wikipedia page but the "military financed destabilization project" begs for evidence. The more likely scenario is, I believe, as soon as any government got concerned about the stuff going on on the internet they assigned people to take care of it and those people started to look for a ways to exploit anything and the Tor project was a good target.
- xfs 7y ago
  What is unbelievable in aiming "to aid democracy advocates in authoritarian states"? I think the State Department has funded plenty of other censorship circumvention projects like Tor. But you have to admit the funding for Tor was also meant to get the upper hand in the shadow battle across anonymous networks. I still remember how LulzSec was busted by the FBI with a timing attack on Tor. Without the ahead-of-time research on Tor it wouldn't be as easy for the FBI to get the same level of power against anonymous networks.
- solarkraft 7y ago
  I consider it very believable. Of course the US has the same interest in destabilizing other countries as other countries have in destabilizing the US. Russia gives controversial people a voice in the US, while the US finances TOR.
- AJ007 7y ago
  Wikipedia: “The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online.“ Recently, many or all of the US’s agents in China were captured and executed: https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-helped-blow-cover-chinese-agents-intelligence/ https://foreignpolicy.com/2018/08/15/botched-cia-communicati... https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie... This is why things like mandating Apple, Google, et al use breakable encryption is extremely bad. Anyone who follows information security knows Apple struggles to keep up with 0 day exploits. My opinion is that it is both in the interest of the United States government and all human-rights abiding democratically elected states to have as absolutely secure and anonymous communications systems as possible. I’m not the only one who believes this. In fact, I think this is very very much a CIA vs FBI situation, domestically. Is it really worth exchanging knowing what was on some dead nut jobs iPhone for the ability of government officials, the military, business executives (e.g. Jeff Bezos apparent breach by Israeli assisted Saudis), and every day common citizens to communicate securely?
  - turk73 7y ago
    Even when Tor was new I had my doubts about it due to its origins among other factors. My dissertation was on privacy technologies in that era (early '00s). I covered a lot of ground at the time. The most sinister change in information technology is cloud and the fact that you have no 4th Amendment protections for anything stored there. Our laws simply aren't keeping up. But it was a neat trick to get everyone using cloud and then pulling the rug out of privacy by say "oh, and by the way, since the files aren't on your property, you have no legal protections for them."
  - 420codebro 7y ago
    Good points. RE CIA v. FBI - I wouldn't be surprised if it ended up being a loose handshake that they (CIA/NSA/FBI) will allow Tor (benefits CIA), in exchange for technical assistance in investigations (benefits FBI) -- namely the ability to own an endpoint. Don't need to own the service/protocol if I can own the host it is running on.
- r721 7y ago
  >Yasha Levine "Yasha Levine is a Russian-American investigative journalist and author. Levine, who was born in the Soviet Union, is a former editor of Moscow-based satirical newspaper The eXile." https://en.wikipedia.org/wiki/Yasha_Levine https://en.wikipedia.org/wiki/Yasha_Levine
- 13415 7y ago
  This is a silly conspiracy. The facts about the initial funding of research on Tor have always been public and well-known, and the conspiracy is based on the idea that there was some grand scheme looking forward into the future for more than 16 years. It's much more likely that some researchers at some government agency implemented the known idea of onion routing in a proof of concept, their work was more successful than anticipated, and later some other researchers at some other government agency were told to try to de-anonymize their colleagues' invention again. However, I'd be more weary about more recent projects. A lot has happened during the past two decades in cryptography and privacy, and I do think it's credible that all kinds of agencies from all over the world nowadays have the task of subverting privacy projects right from the start. But back in the 90s? Unlikely.
  - kijin 7y ago
    Yeah, just because something was either invented or first implemented in the military doesn't mean it's tainted forever. SQLite was originally designed to be used on ballistic missiles. Heck, the internet itself was first developed by the DoD (ARPA). A lot of technologies have military origins.
    - uep 7y ago
      I read a few reviews of the author's (Yasha Levine) other work[1], and it makes me think he has credibility problems. [1] https://www.amazon.com/Corruption-Malcolm-Gladwell-Yasha-Levine-ebook/dp/B008VOJGE8 https://www.amazon.com/Corruption-Malcolm-Gladwell-Yasha-Lev...
- burtonator 7y ago
  I know Roger Dingledine personally and unless he's a VERY VERY good actor he would rather kill himself rather than go down this path. That is unless the state actors know something he doesn't and is still pushing it forward.
canada_dry 7y ago
> Tax-3 - a project for the creation of a closed intranet to store the information of highly-sensitive state figures, judges, and local administration officials, separate from the rest of the state's IT networks. So, is this intranet used for keeping official (confidential) records or for blackmail purposes?
- jammygit 7y ago
  Or is it the network they won’t pass laws requiring backdoors for? Literally segment society into those with power and privacy, and those with neither? Why on earth would they need separate infrastructure and the rest of us do not?
  - deaddrop 7y ago
    >Why on earth would they need separate infrastructure and the rest of us do not? I imagine they wanted to build their own version of SIPRNet. [0] - https://en.wikipedia.org/wiki/SIPRNet https://en.wikipedia.org/wiki/SIPRNet
- dmix 7y ago
  Probably a way to avoid the massive leak of the names of intel officers when that US gov employment database got leaked. The note about operating outside of the standard state IT network is the obvious indicator. Part of their job is counter intelligence not just offensive.
  - jwieczorek 7y ago
    Counter intelligence is FSB's pretty much the only job. If they do intelligence, it's in CIS (Commonwealth of Independent States) countries such as Belarus or Kazakhstan. It's SVR and GRU that are Russia's intelligence agencies.
    - dmix 7y ago
      Right, same with deanonyming Tor. That’s only useful for catching people/software trying to hide themselves which is more counter intelligence than purely offensive.
bin0 7y ago
As much as I hate to say this, we all knew it was happening, right? I'm still ninety percent sure they had to scramble to justify a non-tor-breaking reason they got Ulbricht. I don't know why people are still encouraging others to use it alone. You should also be using some kind of encryption of the content itself. Their goal is to figure out who you are and what you're saying; deny them either piece, and they're foiled (three-letters, that is).
- TazeTSchnitzel 7y ago
  Ulbricht was grossly incompetent, they didn't need a special attack on Tor to unmask someone who asks questions about connecting to Tor from a public StackOverflow account in their real name.
  - bin0 7y ago
    He really did that? Jeez, you're right. Still, such attacks have doubtless been used before. Even if they haven't broken the core protocol, I'd assume they've got a few zero-days sitting around.
    - TazeTSchnitzel 7y ago
      We do know that the US government used a Flash applet to deanonymise a lot of Tor Browser users. It was revealed in some lawsuit I think.
    - somethingnot 7y ago
      He did a lot of stupid stuff. Like logging into SilkRoad from a public library. FBI agents were at the next table.
      - dontbenebby 7y ago
        He logged in in public a lot. They were able to correlate him opening laptop/joining wifi with their suspect account signing into Silk Road.
    - 7y ago
Santosh83 7y ago
Nobody with an ounce of intelligence can believe for one moment that the most powerful intelligence agencies in the most powerful country of the world will stand idly by and watch a protocol/network be completely opaque for them. Whether there is evidence or not (in such cases there may never be enough evidence), it is safe to assume that many if not most Tor exit nodes are govt run (various govts), and one or more of the top intelligence agencies of the world can break Tor by more than one method. The only form of safe communication is one that relies on old fashioned and proven methods, utilising code and algo that has been scrutinised by researchers from many nations. People really wanting to be anonymous will do well to be wary of heavily 'promoted' solutions.
- onetimemanytime 7y ago
  How do various embassies contact the mothership? I heard that a lot of them use TOR, and for smaller countries it makes sense. Big countries I suppose have their brew (which is not necessarily safer.)
  - Santosh83 7y ago
    I'd be surprised if the big countries used plain Tor for their vital communication. They would be having their own secret networks or tunnel through Tor. Small countries have probably simply given up hiding their intelligence from the big ones at this point and are simply interested in ensuring their immediate rivals are kept out, which Tor can probably do.
    - Paul-ish 7y ago
      A custom protocol can potentially be fingerprinted. I wouldn't be surprised if they used something less sophisticated. Like (encrypted) direct messages on twitter/reddit/facebook. This way the traffic blends with the rest.
      - nameismypw 7y ago
        There's a companion project to Tor called obs4proxy which is designed to hide the protocol's implementation.
dontbenebby 7y ago
It sounds like the attack is not unusual or unknown - they're spinning up malicious nodes then trying to drive traffic to those nodes via DDOS. This is a common technique and unfortunately it's my understanding that aside from increasing the number of good nodes there's not much that can done about it. (Though monitoring for malicious behavior is much better nowadays, so bad nodes will quickly get kicked off the network)
- dmix 7y ago
  It said the attacks were detected by a Swedish University.
jammygit 7y ago
What is the risk of hosting an exit node? I have heard that you can be liable for facilitating illegal actions if yours gets used for it
- somebodythere 7y ago
  Hosting an exit node is not illegal (in the United States), and generally you cannot be held liable if the network was used for illegal actions as a consequence of being an exit node and not committed by you (this is not legal advice); however, you have to be able to prove that and it does not necessarily mean you are protected from being investigated, having your door kicked in, and/or your equipment seized.
  - lucb1e 7y ago
    > being investigated, having your door kicked in, and/or your equipment seized. True and good to be aware of (upvoted), but I think it is fair to note that this is a very small number of cases. It's not small odds like "win the lottery" odds, but it's also not likely that it'll happen to you. Definitely something to be aware of and plan for (e.g. don't also use that server for important stuff, say, your email and website).
- rocky1138 7y ago
  It's best left to universities and other large organizations.
- stordoff 7y ago
  As I understand it, part of the risk is proving that you didn't perform the illegal act, and that an investigation itself can be damaging (loss of equipment/public reporting that you are being investigated for being involved in illegal behaviour). If you maintain a strict separation between your traffic/equipment and the exit node, this may be less of a risk, but is subject to the laws of your jurisdiction. > In the USA, there have been no equipment seizures due to Tor exits, but there have been phone calls and visits. In other countries, people have had all their home computing equipment seized for running an exit from their home internet connection. https://blog.torproject.org/tips-running-exit-node https://blog.torproject.org/tips-running-exit-node > Jan Bultmann and David Robinson, a married couple from Seattle and well-known privacy activists in that city, were awakened early one morning last month by police with a search warrant for their home. The detectives from the Seattle Police Department demanded passwords to access the couple's computers, saying they were investigating child abuse imagery [...] The couple consented to the search and gave their passwords to police, who found no child abuse imagery, didn't seize any equipment, and made no arrests. https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-tor-exit-node-raided-by-cops-investigating-child-abuse/ https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-t... > The operator of a Tor [exit node] used by someone to download a pornographic image of a minor has been given a three-month suspended prison sentence by an Austrian court for abetting access to pornographic images of minors [but chats show that he was aware of this use and did not disapprove, so this is not necessarily a general ruling] https://www.pcworld.com/article/2452320/tor-exit-node-operator-convicted-of-abetting-spread-of-child-porn.html https://www.pcworld.com/article/2452320/tor-exit-node-operat...
burtonator 7y ago
I wish there was some sort of secure protocol to allow tor clients to create their own exit nodes using cloud services. I just don't see how it would really be possible reliably.
ineedasername 7y ago
hacked into SyTech's Active Directory Sure, why not? Active Directory doesn't really scream top-secret security to me. Maybe someone with more knowledge can chime in here: Is AD really considered best of breed for what it offers, esp. in terms of security? Or am I not giving it enough credit?
- thatfunkymunki 7y ago
  Is there any better solution for large scale AAA than Kerberos/AD? I think it does the job pretty decently for the large problem that it encompasses.
  - ineedasername 7y ago
    Maybe I'm just judging too much from personal experience working under a system that may be poorly implemented.
    - 420codebro 7y ago
      You are partially not wrong. I think the real issue is that MSFT AD is so bloody point-and-click-and-go easy to stand up that a lot of orgs didn't ever put any proper thought or design into it. Just "go" now and figure it out later (when we get owned).
class4behavior 7y ago
a) All that article states is that Russian intelligence runs their own servers to scan through the traffic. That isn't a huge threat; only when a party attempts to run a big majority of the entire network, it becomes an issue. b) There are merely around 7000 servers active. With more funding or contributors, the danger of any single party taking over would quickly diminish. Here's one way you could help: https://www.torservers.net/about.html https://www.torservers.net/about.html
INTPenis 7y ago
Yeah I mean if you have the budget of an intelligence agency, even a russian one, you could automatically deploy hundreds, thousands, of tor exit nodes all the time. Intelligence agencies could run a substantial part of the tor network with ease. That's why I'd like to see some sort of identification for tor exit node operators. Like keybase or github accounts that can verify who they are and that they have a "normal" presence on the internet.
xtat 7y ago
A reminder: Please run as many tor nodes as you can. They don't have to be exit nodes. This is a mostly free way to give back that has a big impact on privacy and free access and helps to prevent state actor attacks.

356 points by ga-vu 7y ago

Last time Tor was mentioned here, a user posted this link [1], claiming Tor is a military financed destabilization project. Seems unbelievable, but there appear to be lots of supporting documents. [1]: https://surveillancevalley.com/blog/fact-checking-the-tor-projects-government-ties https://surveillancevalley.com/blog/fact-checking-the-tor-pr...

mrtksn 7y ago
The funding part is not really a secret and it's even on the Wikipedia page but the "military financed destabilization project" begs for evidence. The more likely scenario is, I believe, as soon as any government got concerned about the stuff going on on the internet they assigned people to take care of it and those people started to look for a ways to exploit anything and the Tor project was a good target.
xfs 7y ago
What is unbelievable in aiming "to aid democracy advocates in authoritarian states"? I think the State Department has funded plenty of other censorship circumvention projects like Tor. But you have to admit the funding for Tor was also meant to get the upper hand in the shadow battle across anonymous networks. I still remember how LulzSec was busted by the FBI with a timing attack on Tor. Without the ahead-of-time research on Tor it wouldn't be as easy for the FBI to get the same level of power against anonymous networks.
solarkraft 7y ago
I consider it very believable. Of course the US has the same interest in destabilizing other countries as other countries have in destabilizing the US. Russia gives controversial people a voice in the US, while the US finances TOR.
AJ007 7y ago
Wikipedia: “The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online.“ Recently, many or all of the US’s agents in China were captured and executed: https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-helped-blow-cover-chinese-agents-intelligence/ https://foreignpolicy.com/2018/08/15/botched-cia-communicati... https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie... This is why things like mandating Apple, Google, et al use breakable encryption is extremely bad. Anyone who follows information security knows Apple struggles to keep up with 0 day exploits. My opinion is that it is both in the interest of the United States government and all human-rights abiding democratically elected states to have as absolutely secure and anonymous communications systems as possible. I’m not the only one who believes this. In fact, I think this is very very much a CIA vs FBI situation, domestically. Is it really worth exchanging knowing what was on some dead nut jobs iPhone for the ability of government officials, the military, business executives (e.g. Jeff Bezos apparent breach by Israeli assisted Saudis), and every day common citizens to communicate securely?
- turk73 7y ago
  Even when Tor was new I had my doubts about it due to its origins among other factors. My dissertation was on privacy technologies in that era (early '00s). I covered a lot of ground at the time. The most sinister change in information technology is cloud and the fact that you have no 4th Amendment protections for anything stored there. Our laws simply aren't keeping up. But it was a neat trick to get everyone using cloud and then pulling the rug out of privacy by say "oh, and by the way, since the files aren't on your property, you have no legal protections for them."
- 420codebro 7y ago
  Good points. RE CIA v. FBI - I wouldn't be surprised if it ended up being a loose handshake that they (CIA/NSA/FBI) will allow Tor (benefits CIA), in exchange for technical assistance in investigations (benefits FBI) -- namely the ability to own an endpoint. Don't need to own the service/protocol if I can own the host it is running on.
r721 7y ago
>Yasha Levine "Yasha Levine is a Russian-American investigative journalist and author. Levine, who was born in the Soviet Union, is a former editor of Moscow-based satirical newspaper The eXile." https://en.wikipedia.org/wiki/Yasha_Levine https://en.wikipedia.org/wiki/Yasha_Levine
13415 7y ago
This is a silly conspiracy. The facts about the initial funding of research on Tor have always been public and well-known, and the conspiracy is based on the idea that there was some grand scheme looking forward into the future for more than 16 years. It's much more likely that some researchers at some government agency implemented the known idea of onion routing in a proof of concept, their work was more successful than anticipated, and later some other researchers at some other government agency were told to try to de-anonymize their colleagues' invention again. However, I'd be more weary about more recent projects. A lot has happened during the past two decades in cryptography and privacy, and I do think it's credible that all kinds of agencies from all over the world nowadays have the task of subverting privacy projects right from the start. But back in the 90s? Unlikely.
- kijin 7y ago
  Yeah, just because something was either invented or first implemented in the military doesn't mean it's tainted forever. SQLite was originally designed to be used on ballistic missiles. Heck, the internet itself was first developed by the DoD (ARPA). A lot of technologies have military origins.
  - uep 7y ago
    I read a few reviews of the author's (Yasha Levine) other work[1], and it makes me think he has credibility problems. [1] https://www.amazon.com/Corruption-Malcolm-Gladwell-Yasha-Levine-ebook/dp/B008VOJGE8 https://www.amazon.com/Corruption-Malcolm-Gladwell-Yasha-Lev...
burtonator 7y ago
I know Roger Dingledine personally and unless he's a VERY VERY good actor he would rather kill himself rather than go down this path. That is unless the state actors know something he doesn't and is still pushing it forward.

canada_dry 7y ago

> Tax-3 - a project for the creation of a closed intranet to store the information of highly-sensitive state figures, judges, and local administration officials, separate from the rest of the state's IT networks. So, is this intranet used for keeping official (confidential) records or for blackmail purposes?

jammygit 7y ago
Or is it the network they won’t pass laws requiring backdoors for? Literally segment society into those with power and privacy, and those with neither? Why on earth would they need separate infrastructure and the rest of us do not?
- deaddrop 7y ago
  >Why on earth would they need separate infrastructure and the rest of us do not? I imagine they wanted to build their own version of SIPRNet. [0] - https://en.wikipedia.org/wiki/SIPRNet https://en.wikipedia.org/wiki/SIPRNet
dmix 7y ago
Probably a way to avoid the massive leak of the names of intel officers when that US gov employment database got leaked. The note about operating outside of the standard state IT network is the obvious indicator. Part of their job is counter intelligence not just offensive.
- jwieczorek 7y ago
  Counter intelligence is FSB's pretty much the only job. If they do intelligence, it's in CIS (Commonwealth of Independent States) countries such as Belarus or Kazakhstan. It's SVR and GRU that are Russia's intelligence agencies.
  - dmix 7y ago
    Right, same with deanonyming Tor. That’s only useful for catching people/software trying to hide themselves which is more counter intelligence than purely offensive.

bin0 7y ago

As much as I hate to say this, we all knew it was happening, right? I'm still ninety percent sure they had to scramble to justify a non-tor-breaking reason they got Ulbricht. I don't know why people are still encouraging others to use it alone. You should also be using some kind of encryption of the content itself. Their goal is to figure out who you are and what you're saying; deny them either piece, and they're foiled (three-letters, that is).

TazeTSchnitzel 7y ago
Ulbricht was grossly incompetent, they didn't need a special attack on Tor to unmask someone who asks questions about connecting to Tor from a public StackOverflow account in their real name.
- bin0 7y ago
  He really did that? Jeez, you're right. Still, such attacks have doubtless been used before. Even if they haven't broken the core protocol, I'd assume they've got a few zero-days sitting around.
  - TazeTSchnitzel 7y ago
    We do know that the US government used a Flash applet to deanonymise a lot of Tor Browser users. It was revealed in some lawsuit I think.
  - somethingnot 7y ago
    He did a lot of stupid stuff. Like logging into SilkRoad from a public library. FBI agents were at the next table.
    - dontbenebby 7y ago
      He logged in in public a lot. They were able to correlate him opening laptop/joining wifi with their suspect account signing into Silk Road.
  - 7y ago

Santosh83 7y ago

Nobody with an ounce of intelligence can believe for one moment that the most powerful intelligence agencies in the most powerful country of the world will stand idly by and watch a protocol/network be completely opaque for them. Whether there is evidence or not (in such cases there may never be enough evidence), it is safe to assume that many if not most Tor exit nodes are govt run (various govts), and one or more of the top intelligence agencies of the world can break Tor by more than one method. The only form of safe communication is one that relies on old fashioned and proven methods, utilising code and algo that has been scrutinised by researchers from many nations. People really wanting to be anonymous will do well to be wary of heavily 'promoted' solutions.

onetimemanytime 7y ago
How do various embassies contact the mothership? I heard that a lot of them use TOR, and for smaller countries it makes sense. Big countries I suppose have their brew (which is not necessarily safer.)
- Santosh83 7y ago
  I'd be surprised if the big countries used plain Tor for their vital communication. They would be having their own secret networks or tunnel through Tor. Small countries have probably simply given up hiding their intelligence from the big ones at this point and are simply interested in ensuring their immediate rivals are kept out, which Tor can probably do.
  - Paul-ish 7y ago
    A custom protocol can potentially be fingerprinted. I wouldn't be surprised if they used something less sophisticated. Like (encrypted) direct messages on twitter/reddit/facebook. This way the traffic blends with the rest.
    - nameismypw 7y ago
      There's a companion project to Tor called obs4proxy which is designed to hide the protocol's implementation.

dontbenebby 7y ago

It sounds like the attack is not unusual or unknown - they're spinning up malicious nodes then trying to drive traffic to those nodes via DDOS. This is a common technique and unfortunately it's my understanding that aside from increasing the number of good nodes there's not much that can done about it. (Though monitoring for malicious behavior is much better nowadays, so bad nodes will quickly get kicked off the network)

dmix 7y ago
It said the attacks were detected by a Swedish University.

jammygit 7y ago

What is the risk of hosting an exit node? I have heard that you can be liable for facilitating illegal actions if yours gets used for it

somebodythere 7y ago
Hosting an exit node is not illegal (in the United States), and generally you cannot be held liable if the network was used for illegal actions as a consequence of being an exit node and not committed by you (this is not legal advice); however, you have to be able to prove that and it does not necessarily mean you are protected from being investigated, having your door kicked in, and/or your equipment seized.
- lucb1e 7y ago
  > being investigated, having your door kicked in, and/or your equipment seized. True and good to be aware of (upvoted), but I think it is fair to note that this is a very small number of cases. It's not small odds like "win the lottery" odds, but it's also not likely that it'll happen to you. Definitely something to be aware of and plan for (e.g. don't also use that server for important stuff, say, your email and website).
rocky1138 7y ago
It's best left to universities and other large organizations.
stordoff 7y ago
As I understand it, part of the risk is proving that you didn't perform the illegal act, and that an investigation itself can be damaging (loss of equipment/public reporting that you are being investigated for being involved in illegal behaviour). If you maintain a strict separation between your traffic/equipment and the exit node, this may be less of a risk, but is subject to the laws of your jurisdiction. > In the USA, there have been no equipment seizures due to Tor exits, but there have been phone calls and visits. In other countries, people have had all their home computing equipment seized for running an exit from their home internet connection. https://blog.torproject.org/tips-running-exit-node https://blog.torproject.org/tips-running-exit-node > Jan Bultmann and David Robinson, a married couple from Seattle and well-known privacy activists in that city, were awakened early one morning last month by police with a search warrant for their home. The detectives from the Seattle Police Department demanded passwords to access the couple's computers, saying they were investigating child abuse imagery [...] The couple consented to the search and gave their passwords to police, who found no child abuse imagery, didn't seize any equipment, and made no arrests. https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-tor-exit-node-raided-by-cops-investigating-child-abuse/ https://nakedsecurity.sophos.com/2016/04/07/couple-hosting-t... > The operator of a Tor [exit node] used by someone to download a pornographic image of a minor has been given a three-month suspended prison sentence by an Austrian court for abetting access to pornographic images of minors [but chats show that he was aware of this use and did not disapprove, so this is not necessarily a general ruling] https://www.pcworld.com/article/2452320/tor-exit-node-operator-convicted-of-abetting-spread-of-child-porn.html https://www.pcworld.com/article/2452320/tor-exit-node-operat...

burtonator 7y ago

I wish there was some sort of secure protocol to allow tor clients to create their own exit nodes using cloud services. I just don't see how it would really be possible reliably.

ineedasername 7y ago

hacked into SyTech's Active Directory Sure, why not? Active Directory doesn't really scream top-secret security to me. Maybe someone with more knowledge can chime in here: Is AD really considered best of breed for what it offers, esp. in terms of security? Or am I not giving it enough credit?

thatfunkymunki 7y ago
Is there any better solution for large scale AAA than Kerberos/AD? I think it does the job pretty decently for the large problem that it encompasses.
- ineedasername 7y ago
  Maybe I'm just judging too much from personal experience working under a system that may be poorly implemented.
  - 420codebro 7y ago
    You are partially not wrong. I think the real issue is that MSFT AD is so bloody point-and-click-and-go easy to stand up that a lot of orgs didn't ever put any proper thought or design into it. Just "go" now and figure it out later (when we get owned).

class4behavior 7y ago

a) All that article states is that Russian intelligence runs their own servers to scan through the traffic. That isn't a huge threat; only when a party attempts to run a big majority of the entire network, it becomes an issue. b) There are merely around 7000 servers active. With more funding or contributors, the danger of any single party taking over would quickly diminish. Here's one way you could help: https://www.torservers.net/about.html https://www.torservers.net/about.html

INTPenis 7y ago

Yeah I mean if you have the budget of an intelligence agency, even a russian one, you could automatically deploy hundreds, thousands, of tor exit nodes all the time. Intelligence agencies could run a substantial part of the tor network with ease. That's why I'd like to see some sort of identification for tor exit node operators. Like keybase or github accounts that can verify who they are and that they have a "normal" presence on the internet.

xtat 7y ago

A reminder: Please run as many tor nodes as you can. They don't have to be exit nodes. This is a mostly free way to give back that has a big impact on privacy and free access and helps to prevent state actor attacks.