5 ms·
I think it's because he was the only one accessing TOR on a monitored network during the specific time.
by kmlymi 13y ago
I think it's because he was the only one accessing TOR on a monitored network during the specific time.
- srl 13y agoAlmost certainly. I'm at reasonably large (~15000 students on-campus), and a friend using TOR to do ... something ... got caught not because he was the only one using TOR at the time, but because he was the only one using TOR, ever -- it was just too obvious.
- talmand 13y agoHow did they know the something was done by someone using TOR on their network?
- srl 13y agoIt came from a TOR ip.
- rickyc091 13y agoThere's a list of IPs that TOR networks run on, so they could just cross reference that.
- dijit 13y agotor exit nodes are easy to identify, if they had the co-operation of site.com then they'd not see the location, but they'd see the exit node.
- talmand 13y agoI can understand they can the attack was done through Tor, what I don't understand is how they understood the attack originated on their own network through Tor.
- mseebach 13y agoReminds me of this XKCD: http://xkcd.com/1105/ http://xkcd.com/1105/
- epsylon 13y agoGood old Signal Intelligence.