11 ms·

I wonder if this is going to be confirmation that a large fraction of Tor nodes are in fact run by the FBI.

Buffout 4y ago
So what if they were? Only exit node see the message (encrypted or not). And it doesn't know where it originated. I speculate this is most likely case of a ISIS server run by FBI.
- gizmo686 4y ago
  If you control both exit and entrance nodes, you can corralate connections with a timing analysis.
  - Buffout 4y ago
    I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.
    - electroly 4y ago
      I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.
      - deleted 4y ago
        [deleted]
      - Buffout 4y ago
        No, this is not the timing attack I was thinking of. Your version of timing attack comes from inside tor network and that is solved by Entry Guards. And besides you can also be Tor relay and a client. This attacks are just bugs that are fixed. The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also controls server or exit node.
        electroly 4y ago
        Possibly you replied to the wrong post; I don't know anything about timing attacks. My post was about whether the entry node knows that it's the entry node.
    - zrwalt 4y ago
      It is a volume+timing attack. From 2014: https://www.bbc.com/news/technology-28573625 https://www.bbc.com/news/technology-28573625 "The Tor Project suggests the perpetrator compromised the network via a "traffic confirmation attack". This involves the attacker controlling both the first part of the circuit of nodes involved - known as the "entry relay" - as well as the exit relay. By matching the volumes and timings of the data sent at one end of the circuit to those received at the other end, it becomes possible to reveal the Tor user's identity because the computer used as an entry relay will have logged their internet protocol (IP) address."
      - Buffout 4y ago
        See my reply above, this are just bugs that are fixable. "Timing attack" that will not be fixed is when police has warrant for your ISP, and police has ISP logs and destination server logs. (so it can compare the two)
Scoundreller 4y ago
> The FBI also found what specific pages Al-Azhari visited, including a section on donating Bitcoin; another focused on military operations conducted by ISIS fighters in Iraq, Syria, and Nigeria; and another page that provided links to material from ISIS’s media arm Based on what little I know of SSL, this suggests the server was compromised too? Or does tor do a bad job of certificate pinning? Edit: Or the clients are/were compromised. Or the suspect’s computer was compromised. Or they can somehow decrypt traffic between client and server.
- donkeyd 4y ago
  Unless I'm missing some info, I don't see anything that points at them finding all this info through Tor or the server. They identified the user AND 'also found what specific pages Al-Azhari visited'. That could've happened from his PC after they arrested him. Language like this is always ambiguous in order to give out as little information as possible while still providing some.
  - Scoundreller 4y ago
    > That could've happened from his PC after they arrested him. Tor client wouldn’t save any of that.
    - deleted 4y ago
      [deleted]
    - thefreeman 4y ago
      he may not have been using the tor browser
- michaelt 4y ago
  > Based on what little I know of SSL, this suggests the server was compromised too? Not necessarily. If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency.
fIREpOK 4y ago
> [...] it’s certainly possible that the NSA did the surveillance and passed the information to the FBI. We already know that the FBI passes information to local law enforcement agencies and tell them to do parallel construction when the information was obtained illegally, so why not the NSA too? It's probably easy to deanonymize Tor traffic when you see everyone's Internet traffic (they don't even need to setup exit nodes).
cheapliquor 4y ago
Spider-Man meme of FBI and Tor user they identified pointing at each other
kmeisthax 4y ago
I would not be surprised given that Tor was specifically created to anonymize the traffic of US spies. It was released to the public to give plausible deniability to the spies. A new protocol that ONLY spies used would be obvious to track down, no matter how much encryption it had. But if everyone is using it for different purposes then you have to actually have to break the encryption to know if someone's using Tor to check in with the CIA or if they're just so paranoid that they insist on surfing Wikipedia with it.
- paulluuk 4y ago
  After reading Edward Snowden's autobiography (Permanent Record, great read), I feel like Tor, end-to-end encryption and similar solutions/products are basically a dagger through the heart of intelligence services. As such, I find it hard to believe that they knowingly gave the public such tools. And if they did, it sure as hell backfired on them.
  - h4n1 4y ago
    If they run enough nodes to deanonymize users, it's a dagger through the heart of other intelligence services, but an absolute blessing for the NSA
    - sweetbitter 4y ago
      For very obvious reasons you don't need to run any nodes, craft any malware, or scrutinize a target's layer 3+ OPSEC, in order to break Tor. You simply go to tier 1 ISPs and buy up IP datagram headers going to/from entry nodes and you win. The only solution is a constant rate of fake traffic to the guard node.
    - frankfrankfrank 4y ago
      Hmmm almost like whoever has a head start and unlimited finances and resources due to being the reserve currency could have done exactly that.
  - CyanBird 4y ago
curiousllama 4y ago
My favorite theory is that the US, China, NK, Russia, Israel, et al. are all running a large number of malicious servers, all of which adds up to a secure Tor network, since they'll never cooperate
- from 4y ago
  I wish! But there most be some return on investment or they wouldn't be doing it. Tor is so much faster than it used to be so I think it is likely there is well resourced person who is up to something on Tor .
  - curiousllama 4y ago
    If nation-states stop running servers, then the last one standing gets control of the network. The ROI is defensive (denying your adversary a resource), rather than offensive (dominating that resource yourself).
frankfrankfrank 4y ago
Depending on your definition of “FBI” that is and long has been true. Laws are for the slaves, not the masters.
VLM 4y ago
To catch every random person visiting a site you do need to control most of the Tor nodes which is probably affordable for the three letter agencies. To catch one specific guy doing one action one time that he might do hundreds of times without getting caught but he only needs to get caught once to get punished, if you only need to succeed 0.1% of the time you only need to own 0.1% of the nodes, as a simplification. There's also the incredibly valuable chilling effect that he's being found guilty in public opinion of having read the wrong website once. If millions of people read the "wrong" website a dozen times a day for decades, you only need one bust in a couple billion accesses to generate massive propaganda that reading uncensored badthink is and should be punishable.
rtkwe 4y ago
I'm not sure, it's been known for a while that javascript can be used to deanonymize Tor users and unfortunately most websites need JS to even begin to function so there's an incentive to leave it on. If criminals were more tech savvy maybe needing JS would become a red flag for any criminal sites, but you'd still need the discipline to not visit any other sites.

So what if they were? Only exit node see the message (encrypted or not). And it doesn't know where it originated. I speculate this is most likely case of a ISIS server run by FBI.

gizmo686 4y ago
If you control both exit and entrance nodes, you can corralate connections with a timing analysis.
- Buffout 4y ago
  I don't think that is how timing analisis works. User can say to "entrance node" that it is also a node and that is how it can deny that it is originator. "Entrance node" doesn't know its position in a chain. Only Exit node knows its position.
  - electroly 4y ago
    I don't think that's totally true. At least, it's maybe superficially true but not in a real world sense. The entry node can see your IP by virtue of the incoming TCP connection and it's not hard to figure out if an IP is a Tor relay or not. The list of known relays is a list that you can just go and get. If it's not a relay, then it's a client, and you're the entry node.
    - deleted 4y ago
      [deleted]
    - Buffout 4y ago
      No, this is not the timing attack I was thinking of. Your version of timing attack comes from inside tor network and that is solved by Entry Guards. And besides you can also be Tor relay and a client. This attacks are just bugs that are fixed. The real timing attack that is not fixed and will not be (it is not in threat model), is when your ISP works with police (that has warrant) and gives them data. And police also controls server or exit node.
      - electroly 4y ago
        Possibly you replied to the wrong post; I don't know anything about timing attacks. My post was about whether the entry node knows that it's the entry node.
  - zrwalt 4y ago
    It is a volume+timing attack. From 2014: https://www.bbc.com/news/technology-28573625 https://www.bbc.com/news/technology-28573625 "The Tor Project suggests the perpetrator compromised the network via a "traffic confirmation attack". This involves the attacker controlling both the first part of the circuit of nodes involved - known as the "entry relay" - as well as the exit relay. By matching the volumes and timings of the data sent at one end of the circuit to those received at the other end, it becomes possible to reveal the Tor user's identity because the computer used as an entry relay will have logged their internet protocol (IP) address."
    - Buffout 4y ago
      See my reply above, this are just bugs that are fixable. "Timing attack" that will not be fixed is when police has warrant for your ISP, and police has ISP logs and destination server logs. (so it can compare the two)

Scoundreller 4y ago

> The FBI also found what specific pages Al-Azhari visited, including a section on donating Bitcoin; another focused on military operations conducted by ISIS fighters in Iraq, Syria, and Nigeria; and another page that provided links to material from ISIS’s media arm Based on what little I know of SSL, this suggests the server was compromised too? Or does tor do a bad job of certificate pinning? Edit: Or the clients are/were compromised. Or the suspect’s computer was compromised. Or they can somehow decrypt traffic between client and server.

donkeyd 4y ago
Unless I'm missing some info, I don't see anything that points at them finding all this info through Tor or the server. They identified the user AND 'also found what specific pages Al-Azhari visited'. That could've happened from his PC after they arrested him. Language like this is always ambiguous in order to give out as little information as possible while still providing some.
- Scoundreller 4y ago
  > That could've happened from his PC after they arrested him. Tor client wouldn’t save any of that.
  - deleted 4y ago
    [deleted]
  - thefreeman 4y ago
    he may not have been using the tor browser
michaelt 4y ago
> Based on what little I know of SSL, this suggests the server was compromised too? Not necessarily. If a passive snooper knows I used Tor Browser to make an SSL request to en.wikipedia.org and received 987,654 bytes then immediately made a SSL request to upload.wikimedia.org and received 1,234,567 bytes that might be enough information to work out I visited https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency.

fIREpOK 4y ago

> [...] it’s certainly possible that the NSA did the surveillance and passed the information to the FBI. We already know that the FBI passes information to local law enforcement agencies and tell them to do parallel construction when the information was obtained illegally, so why not the NSA too? It's probably easy to deanonymize Tor traffic when you see everyone's Internet traffic (they don't even need to setup exit nodes).

cheapliquor 4y ago

Spider-Man meme of FBI and Tor user they identified pointing at each other

kmeisthax 4y ago

I would not be surprised given that Tor was specifically created to anonymize the traffic of US spies. It was released to the public to give plausible deniability to the spies. A new protocol that ONLY spies used would be obvious to track down, no matter how much encryption it had. But if everyone is using it for different purposes then you have to actually have to break the encryption to know if someone's using Tor to check in with the CIA or if they're just so paranoid that they insist on surfing Wikipedia with it.

paulluuk 4y ago
After reading Edward Snowden's autobiography (Permanent Record, great read), I feel like Tor, end-to-end encryption and similar solutions/products are basically a dagger through the heart of intelligence services. As such, I find it hard to believe that they knowingly gave the public such tools. And if they did, it sure as hell backfired on them.
- h4n1 4y ago
  If they run enough nodes to deanonymize users, it's a dagger through the heart of other intelligence services, but an absolute blessing for the NSA
  - sweetbitter 4y ago
    For very obvious reasons you don't need to run any nodes, craft any malware, or scrutinize a target's layer 3+ OPSEC, in order to break Tor. You simply go to tier 1 ISPs and buy up IP datagram headers going to/from entry nodes and you win. The only solution is a constant rate of fake traffic to the guard node.
  - frankfrankfrank 4y ago
    Hmmm almost like whoever has a head start and unlimited finances and resources due to being the reserve currency could have done exactly that.
- CyanBird 4y ago

curiousllama 4y ago

My favorite theory is that the US, China, NK, Russia, Israel, et al. are all running a large number of malicious servers, all of which adds up to a secure Tor network, since they'll never cooperate

from 4y ago
I wish! But there most be some return on investment or they wouldn't be doing it. Tor is so much faster than it used to be so I think it is likely there is well resourced person who is up to something on Tor .
- curiousllama 4y ago
  If nation-states stop running servers, then the last one standing gets control of the network. The ROI is defensive (denying your adversary a resource), rather than offensive (dominating that resource yourself).

frankfrankfrank 4y ago

Depending on your definition of “FBI” that is and long has been true. Laws are for the slaves, not the masters.

VLM 4y ago

To catch every random person visiting a site you do need to control most of the Tor nodes which is probably affordable for the three letter agencies. To catch one specific guy doing one action one time that he might do hundreds of times without getting caught but he only needs to get caught once to get punished, if you only need to succeed 0.1% of the time you only need to own 0.1% of the nodes, as a simplification. There's also the incredibly valuable chilling effect that he's being found guilty in public opinion of having read the wrong website once. If millions of people read the "wrong" website a dozen times a day for decades, you only need one bust in a couple billion accesses to generate massive propaganda that reading uncensored badthink is and should be punishable.

rtkwe 4y ago

I'm not sure, it's been known for a while that javascript can be used to deanonymize Tor users and unfortunately most websites need JS to even begin to function so there's an incentive to leave it on. If criminals were more tech savvy maybe needing JS would become a red flag for any criminal sites, but you'd still need the discipline to not visit any other sites.