4 ms·

I'm somewhat concerned with the blanko recommendation of TOR. As has become clear, TOR traffic is blatantly obvious. Yes, your data is secure, but the fact that

I'm somewhat concerned with the blanko recommendation of TOR. As has become clear, TOR traffic is blatantly obvious. Yes, your data is secure, but the fact that you are using TOR.. is not. And there should be no surprise feds employ the low-tech methods like just matching your activity on a chat to traffic on your line and the like. We really need something like automatically mutating protocols, not the TOR "I'm HTTPs that no one would ever use for HTTPs" stuff.

bhitov 13y ago
The limitations of TOR were made clear in the talk that the slides were meant to accompany.
marshray 13y ago
Tor is useful for hackers and law enforcement alike because it anonymizes the TCP client from the TCP server. Obviously this is useful for both hackers and law enforcement investigators alike. You're right in that that has its limits. It doesn't protect against traffic analysis by an adversary who is able to observe both the client's and the server's internet connection. But the talk was about "OPSEC for Hackers". If the hacker's adversary is already monitoring his internet connection for correlation to specific and ongoing attacks, he's pwned. This was filed in court in at least one of the Anonymous prosecutions. Basically the investigators said "We observed the suspect walk into his house, we observed his Mac connect to his wifi, we observed Tor traffic over his wifi, and we subsequently observed the suspect's hacker alias join the IRC channel."
nikcub 13y ago
Their method would have been a lot more difficult had they not caught Sabu and flipped him. Even with Sabu flipped, absent a confession they only have a lot of circumstantial evidence on Jeremy. Sabu was blatantly poor at covering up his identity. He was doxed by other hackers online long before the FBI found him (apparently it was one of the anti-anonymous 'patriot' hackers who passed on Sabu's real ID to the FBI). Without Sabu, they wouldn't know where to park the van, or which VPN providers and ISP's they need to subpoena. Sabu made two mistakes. First he pasted a link to a file in IRC that was hosted on prvt.org. Somebody looked up the historic whois records for that domain and found the name Hector Monsegur. His second mistake was that his Tor setup didn't "fail close", and when his local SOCKS server died his IRC client accidentally logged him in using his real IP address. The feds can't match Tor activity if they don't know where to park the van. They also relied on Jeremy having a weak Wifi setup where they could watch his network connections. All of these other leads, including the personal details to match against, relied on first flipping Sabu. The idea Tor setup is having an intermediary isolating proxy, and preferably one that is hosted offshore in another jurisdiction. For extra security, run a VPN connection over that, so it would look like: laptop => OpenVPN or SSH tunnel => offshore server => privoxy (header munging) => VPN connection => tor => tor exit node => VPN server => internet To prevent matching against a shared circuit, setup multiple tor circuits and random load balance across them, and do the same with the VPN. Tor is just like a lot of other things, it can be setup and used in such a way where it leaks a lot of data and information, but it can also be used as part of a chain that makes the job of unmasking the user a lot more difficult.

bhitov 13y ago

The limitations of TOR were made clear in the talk that the slides were meant to accompany.

marshray 13y ago

Tor is useful for hackers and law enforcement alike because it anonymizes the TCP client from the TCP server. Obviously this is useful for both hackers and law enforcement investigators alike. You're right in that that has its limits. It doesn't protect against traffic analysis by an adversary who is able to observe both the client's and the server's internet connection. But the talk was about "OPSEC for Hackers". If the hacker's adversary is already monitoring his internet connection for correlation to specific and ongoing attacks, he's pwned. This was filed in court in at least one of the Anonymous prosecutions. Basically the investigators said "We observed the suspect walk into his house, we observed his Mac connect to his wifi, we observed Tor traffic over his wifi, and we subsequently observed the suspect's hacker alias join the IRC channel."

nikcub 13y ago

Their method would have been a lot more difficult had they not caught Sabu and flipped him. Even with Sabu flipped, absent a confession they only have a lot of circumstantial evidence on Jeremy. Sabu was blatantly poor at covering up his identity. He was doxed by other hackers online long before the FBI found him (apparently it was one of the anti-anonymous 'patriot' hackers who passed on Sabu's real ID to the FBI). Without Sabu, they wouldn't know where to park the van, or which VPN providers and ISP's they need to subpoena. Sabu made two mistakes. First he pasted a link to a file in IRC that was hosted on prvt.org. Somebody looked up the historic whois records for that domain and found the name Hector Monsegur. His second mistake was that his Tor setup didn't "fail close", and when his local SOCKS server died his IRC client accidentally logged him in using his real IP address. The feds can't match Tor activity if they don't know where to park the van. They also relied on Jeremy having a weak Wifi setup where they could watch his network connections. All of these other leads, including the personal details to match against, relied on first flipping Sabu. The idea Tor setup is having an intermediary isolating proxy, and preferably one that is hosted offshore in another jurisdiction. For extra security, run a VPN connection over that, so it would look like: laptop => OpenVPN or SSH tunnel => offshore server => privoxy (header munging) => VPN connection => tor => tor exit node => VPN server => internet To prevent matching against a shared circuit, setup multiple tor circuits and random load balance across them, and do the same with the VPN. Tor is just like a lot of other things, it can be setup and used in such a way where it leaks a lot of data and information, but it can also be used as part of a chain that makes the job of unmasking the user a lot more difficult.