4 ms·

Has there been any known case where a person using Tor has been tracked down and put into curt, without human mistake that lead to his de-anonymization?

4gotunameagain 7y ago
I would imagine that if anyone had this capability, they would go into great extents to hide it's existence.
mirimir 7y ago
Yes. See https://news.ycombinator.com/item?id=22215126 https://news.ycombinator.com/item?id=22215126 Not one person. Hundreds, maybe thousands. Because of a exploited vulnerability, and failure to pay attention to an upsurge in suspicious relays. Unless you consider that the mistake was using Tor directly, rather than through a VPN service.
- belorn 7y ago
  https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack https://blog.torproject.org/tor-security-advisory-relay-earl... A bit more detail would be welcome about those "Hundreds, maybe thousands" of persons. Clearly the security researcher did find a vulnerability in the protocol and confirmed it by unmasking users, but I don't see the support for people getting "tracked down and put into [court]". More important, what purpose is there to reference a 5 year old patched security vulnearbility? The same year as the above vulnerability was found in Tor, HTTPS was also broken with Heartbleed. The only fool-proof security is security in so many layers that it become statistically unlikely to cause a negative impact.
  - mirimir 7y ago
    The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malware. This is just the outcome from busting one site, PlayPen: At least 350 U.S.-based individuals arrested 25 producers of child pornography prosecuted 51 hands-on abusers prosecuted 55 American children successfully identified or rescued 548 international arrests, with 296 sexually abused children identified or rescued https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years https://www.fbi.gov/news/stories/playpen-creator-sentenced-t...
    - belorn 7y ago
      While that linked article does not directly talk about relay early, this article does: https://blog.torproject.org/did-fbi-pay-university-attack-tor-users https://blog.torproject.org/did-fbi-pay-university-attack-to... The article says that they likely did not have a warrant and simply just went and hired the researcher directly. But fair enough, the claim that hundreds did get tracked down and arrested, due to a bug found by a security researcher after getting hired by the FBI, is true. People selling zero days vulnerabilities is a major problem to security. Sadly it is something which new threat models need to take into consideration. The Tor Project did change how the Tor browser bundle updates, and I suspect this event did also caused some ripples in the project in how much they can trust researchers.
  - Astarte 7y ago
    It depends on who runs these attacks. Some law enforcement agency could use those attacks to put you in jail. Mapping out Tor users can be interesting to other entities, too ... As you can see from the original article these attacks happen. They are also run against more interesting websites or individuals. Obviously, the attackers won't write a publication for their vulnerabilities ;) Related: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548?source=---------5------------------ https://medium.com/@nusenu/the-growing-problem-of-malicious-... Once in while, Tor node operators will complain about DDOS on the tor mailing lists or similar sites. In most of the cases this is just an attempt to figure out guard nodes or real IP addresses of an individual or server.
  - mirimir 7y ago
    Oops, I neglected to address this point: > More important, what purpose is there to reference a 5 year old patched security vulnearbility? Sure, it's old, and everyone screws up sometimes. A few things bother me about it. One is that we know that the Tor Project did notice the malicious relays that CMU people were hosting. From what I've read, they weren't subtle about it. So basically Tor Project staff said that they screwed up, and apologized. But somehow that just doesn't feel plausible. There's also some email obtained through FoIA which could be read as evidence that "Tor developers are closely working with the US government".[0] Sure, maybe that's just paranoia and conspiracy theory. And I do appreciate the delicacy of supporting strong anonymity for Tor without defending child pornographers. 0) https://restoreprivacy.com/tor/ https://restoreprivacy.com/tor/
jlgaddis 7y ago
(I don't have a link handy and I'm going from memory here so I apologize if I've screwed anything up...) There was a Harvard student a few years ago who got busted for e-mailing a bomb threat (during finals, maybe?) or something like that. The school reviewed their (Netflow?) logs, found the users on their network who were using Tor at the time and so he quickly became a suspect (and confessed when questioned, IIRC). If he hadn't been on the school's network, it would have obviously been much more difficult, if not impossible, to find him so I suppose this one could be classified as an opsec fail.

4gotunameagain 7y ago

I would imagine that if anyone had this capability, they would go into great extents to hide it's existence.

mirimir 7y ago

Yes. See https://news.ycombinator.com/item?id=22215126 https://news.ycombinator.com/item?id=22215126 Not one person. Hundreds, maybe thousands. Because of a exploited vulnerability, and failure to pay attention to an upsurge in suspicious relays. Unless you consider that the mistake was using Tor directly, rather than through a VPN service.

belorn 7y ago
https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack https://blog.torproject.org/tor-security-advisory-relay-earl... A bit more detail would be welcome about those "Hundreds, maybe thousands" of persons. Clearly the security researcher did find a vulnerability in the protocol and confirmed it by unmasking users, but I don't see the support for people getting "tracked down and put into [court]". More important, what purpose is there to reference a 5 year old patched security vulnearbility? The same year as the above vulnerability was found in Tor, HTTPS was also broken with Heartbleed. The only fool-proof security is security in so many layers that it become statistically unlikely to cause a negative impact.
- mirimir 7y ago
  The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malware. This is just the outcome from busting one site, PlayPen: At least 350 U.S.-based individuals arrested 25 producers of child pornography prosecuted 51 hands-on abusers prosecuted 55 American children successfully identified or rescued 548 international arrests, with 296 sexually abused children identified or rescued https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years https://www.fbi.gov/news/stories/playpen-creator-sentenced-t...
  - belorn 7y ago
    While that linked article does not directly talk about relay early, this article does: https://blog.torproject.org/did-fbi-pay-university-attack-tor-users https://blog.torproject.org/did-fbi-pay-university-attack-to... The article says that they likely did not have a warrant and simply just went and hired the researcher directly. But fair enough, the claim that hundreds did get tracked down and arrested, due to a bug found by a security researcher after getting hired by the FBI, is true. People selling zero days vulnerabilities is a major problem to security. Sadly it is something which new threat models need to take into consideration. The Tor Project did change how the Tor browser bundle updates, and I suspect this event did also caused some ripples in the project in how much they can trust researchers.
- Astarte 7y ago
  It depends on who runs these attacks. Some law enforcement agency could use those attacks to put you in jail. Mapping out Tor users can be interesting to other entities, too ... As you can see from the original article these attacks happen. They are also run against more interesting websites or individuals. Obviously, the attackers won't write a publication for their vulnerabilities ;) Related: https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548?source=---------5------------------ https://medium.com/@nusenu/the-growing-problem-of-malicious-... Once in while, Tor node operators will complain about DDOS on the tor mailing lists or similar sites. In most of the cases this is just an attempt to figure out guard nodes or real IP addresses of an individual or server.
- mirimir 7y ago
  Oops, I neglected to address this point: > More important, what purpose is there to reference a 5 year old patched security vulnearbility? Sure, it's old, and everyone screws up sometimes. A few things bother me about it. One is that we know that the Tor Project did notice the malicious relays that CMU people were hosting. From what I've read, they weren't subtle about it. So basically Tor Project staff said that they screwed up, and apologized. But somehow that just doesn't feel plausible. There's also some email obtained through FoIA which could be read as evidence that "Tor developers are closely working with the US government".[0] Sure, maybe that's just paranoia and conspiracy theory. And I do appreciate the delicacy of supporting strong anonymity for Tor without defending child pornographers. 0) https://restoreprivacy.com/tor/ https://restoreprivacy.com/tor/

jlgaddis 7y ago

(I don't have a link handy and I'm going from memory here so I apologize if I've screwed anything up...) There was a Harvard student a few years ago who got busted for e-mailing a bomb threat (during finals, maybe?) or something like that. The school reviewed their (Netflow?) logs, found the users on their network who were using Tor at the time and so he quickly became a suspect (and confessed when questioned, IIRC). If he hadn't been on the school's network, it would have obviously been much more difficult, if not impossible, to find him so I suppose this one could be classified as an opsec fail.