4 ms·

I wonder how exactly they tracked that he was using Tor at the time---does Harvard specifically log connections to the Tor network? Or do they log every outboun

I wonder how exactly they tracked that he was using Tor at the time---does Harvard specifically log connections to the Tor network? Or do they log every outbound TCP connection?

brajkovic 13y ago
My guess is they have logs of every outbound TCP connection—it's not like Tor is the only protocol that can be used for evil.
daughart 13y ago
The Harvard (non-guest) network is secure - you must connect to it using your Harvard web ID login information. Harvard can then uniquely identify all of your traffic. (http://www.fas-it.fas.harvard.edu/node/189 http://www.fas-it.fas.harvard.edu/node/189) I guess I should have written a paragraph's worth of inane blog spam to get my submission title used? I was trying to make this exact point in my original title. The title my submission was assigned is not the real title of the PDF either... seems very arbitrary.
jauer 13y ago
Many institutions & providers gather Netflow data (source, dest IP+Port, number of bits, flow duration) and store for a period of time to use in detecting DDoS, performance monitoring, and planning transit/peering. Correlating that with access to known tor nodes and you're done.
hrrsn 13y ago
By and large, if he tethered his cellphone and used Tor that way (or sit outside a coffee shop, etc), he wouldn't have been caught?
- pwnna 13y ago
  Tethered cellphone probably will be identified, though that would be slower as it needs to go through the ISP. Coffeeshop will make it even harder, but may still have issues like identifying the computer, etc. etc.
  - MichaelGG 13y ago
    Identifying from a cellphone connection would require the FBI to get a log of all Tor connections from all cellphone users in the area. And it still doesn't prove anything. Compared to just asking the campus for their records, it's a totally different league. It's not even clear if cell ISPs track every TCP connection.
    - htns 13y ago
      They would have only needed a log of all connections within a very short time window (a timing attack, which ofc is not tor specific, after all someone might chain a proxy and tor). If the terrorism card is on the table I wouldn't be surprised if they had done that first and only after that constructed a legal case. Remember that there was a good period of time during which they had the bomb threat but they didn't necessarily know it was fake.

I wonder how exactly they tracked that he was using Tor at the time---does Harvard specifically log connections to the Tor network? Or do they log every outbound TCP connection?

brajkovic 13y ago

My guess is they have logs of every outbound TCP connection—it's not like Tor is the only protocol that can be used for evil.

daughart 13y ago

The Harvard (non-guest) network is secure - you must connect to it using your Harvard web ID login information. Harvard can then uniquely identify all of your traffic. (http://www.fas-it.fas.harvard.edu/node/189 http://www.fas-it.fas.harvard.edu/node/189) I guess I should have written a paragraph's worth of inane blog spam to get my submission title used? I was trying to make this exact point in my original title. The title my submission was assigned is not the real title of the PDF either... seems very arbitrary.

jauer 13y ago

Many institutions & providers gather Netflow data (source, dest IP+Port, number of bits, flow duration) and store for a period of time to use in detecting DDoS, performance monitoring, and planning transit/peering. Correlating that with access to known tor nodes and you're done.

hrrsn 13y ago

By and large, if he tethered his cellphone and used Tor that way (or sit outside a coffee shop, etc), he wouldn't have been caught?

pwnna 13y ago
Tethered cellphone probably will be identified, though that would be slower as it needs to go through the ISP. Coffeeshop will make it even harder, but may still have issues like identifying the computer, etc. etc.
- MichaelGG 13y ago
  Identifying from a cellphone connection would require the FBI to get a log of all Tor connections from all cellphone users in the area. And it still doesn't prove anything. Compared to just asking the campus for their records, it's a totally different league. It's not even clear if cell ISPs track every TCP connection.
  - htns 13y ago
    They would have only needed a log of all connections within a very short time window (a timing attack, which ofc is not tor specific, after all someone might chain a proxy and tor). If the terrorism card is on the table I wouldn't be surprised if they had done that first and only after that constructed a legal case. Remember that there was a good period of time during which they had the bomb threat but they didn't necessarily know it was fake.