4 ms·

If this is the only manner that the FBI --or any law enforcement for that matter-- has for identifying TOR users, then wouldn't the best operational security ju

If this is the only manner that the FBI --or any law enforcement for that matter-- has for identifying TOR users, then wouldn't the best operational security just be to firewall yourself off completely except for Tor connections? Better yet, you could monitor what applications are trying to broadcast out even if they are designed or intended not to leak. Isn't this what the TAILS live-CD does? For this case, even if your software was out of date and vulnerable to the initial attack on the browser, the attempt to broadcast out would hit a firewall and fail (and ideally be logged and alerted).

revelation 13y ago
I think you will want to use a router that automatically tunnels everything leaving the local network through TOR. And then put in a permanent "everything read-only mode" by burning a fuse or something... Can't trust the local machine to tunnel things correctly.
a1a 13y ago
..or just adhere to common sense and disable javascript.
- hack_edu 13y ago
  ... at the packet level.
marshray 13y ago
The attacker could just as easily made the connection out via Tor, but it might not have been as considered quite as strong for their evidence gathering process. Another example, it sounds like one might have dodged this particular attack by using a browser other than the Firefox bundled in the TBB. But whether or not using a non-TBB browser gives you a net increase in security probably depends a lot on the user.
jlgaddis 13y ago
An easy way to prevent this sort of thing is to use two machines. Run Tor and privoxy on one of those machines and allow it to build its circuits and such. The second machine should be configured to use the privoxy instance as an HTTP proxy and should not have a default gateway configured. (Also, on the first machine, you could use iptables to only permit outgoing traffic from the uid that Tor is running as and to drop everything else, just as an extra precaution.)

revelation 13y ago

I think you will want to use a router that automatically tunnels everything leaving the local network through TOR. And then put in a permanent "everything read-only mode" by burning a fuse or something... Can't trust the local machine to tunnel things correctly.

a1a 13y ago

..or just adhere to common sense and disable javascript.

hack_edu 13y ago
... at the packet level.

marshray 13y ago

The attacker could just as easily made the connection out via Tor, but it might not have been as considered quite as strong for their evidence gathering process. Another example, it sounds like one might have dodged this particular attack by using a browser other than the Firefox bundled in the TBB. But whether or not using a non-TBB browser gives you a net increase in security probably depends a lot on the user.

jlgaddis 13y ago

An easy way to prevent this sort of thing is to use two machines. Run Tor and privoxy on one of those machines and allow it to build its circuits and such. The second machine should be configured to use the privoxy instance as an HTTP proxy and should not have a default gateway configured. (Also, on the first machine, you could use iptables to only permit outgoing traffic from the uid that Tor is running as and to drop everything else, just as an extra precaution.)