4 ms·
The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malwar
by mirimir 7y ago
The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malware.
This is just the outcome from busting one site, PlayPen:
At least 350 U.S.-based individuals arrested
25 producers of child pornography prosecuted
51 hands-on abusers prosecuted
55 American children successfully identified or rescued
548 international arrests, with 296 sexually abused children identified or rescued
https://www.fbi.gov/news/stories/playpen-creator-sentenced-to-30-years https://www.fbi.gov/news/stories/playpen-creator-sentenced-t...
- belorn 7y agoWhile that linked article does not directly talk about relay early, this article does: https://blog.torproject.org/did-fbi-pay-university-attack-tor-users https://blog.torproject.org/did-fbi-pay-university-attack-to... The article says that they likely did not have a warrant and simply just went and hired the researcher directly. But fair enough, the claim that hundreds did get tracked down and arrested, due to a bug found by a security researcher after getting hired by the FBI, is true. People selling zero days vulnerabilities is a major problem to security. Sadly it is something which new threat models need to take into consideration. The Tor Project did change how the Tor browser bundle updates, and I suspect this event did also caused some ripples in the project in how much they can trust researchers.