6 ms·

The talk about de-anonymizing Tor at the BlackHat conference has been removed

203 points by lanbird 12y ago

packetlss 12y ago
A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment. Source: http://www.reuters.com/article/2014/07/21/cybercrime-conference-talk-idUSL2N0PW14320140721 http://www.reuters.com/article/2014/07/21/cybercrime-confere...
- lanbird 12y ago
  Thank you for the information packetlss! http://www.qatar.cmu.edu/iliano/svc/meetings/PX/2004-09-21/syverson.pdf http://www.qatar.cmu.edu/iliano/svc/meetings/PX/2004-09-21/s... http://www.cmu.edu/silicon-valley/research/tech-showcase/pdfs/stegotorus.pdf http://www.cmu.edu/silicon-valley/research/tech-showcase/pdf...
  - 616c 12y ago
    Interesting, they did a talk at Education City in Qatar and I had no idea about it? Very disappointed, and surprised they had talks with these kinds of experts on this talk (censorship avoidance is not looked kindly upon there).
- x1798DE 12y ago
  I have to imagine that this is for some sort of internal bureaucratic reason. I don't see who is in a position to even want to stop this talk - almost certainly not the Tor project itself. The mundane (and thus most likely) answer is that the CMU lawyers wanted to pull it either because they want to sort out some sort of intellectual property first, or they're worried about some sort of liability.
  - andor 12y ago
    I don't see who is in a position to even want to stop this talk A government agency that wants to stay a step ahead of the competition or of its targets?
    - toyg 12y ago
      Or a University who doesn't want to get sued / get bad publicity for screwing with a tool used by government agencies...
      - MacsHeadroom 12y ago
        Legality aside, I'm surprised this wasn't pulled on ethical grounds. Does Black Hat not require "researchers" to follow responsible/coordinated disclosure? What about the political dissidents who use Tor? They could be at risk of certain death if caught by the authoritarian regimes they live under. Without coordinated disclosure, the "researchers" might as well have been signing death warrants.
        tptacek 12y ago
        Black Hat is a venue for presenting research. They don't influence the procedures used by researchers at all. And the Black Hat review board is not stuffed full of people who buy into "responsible disclosure". In fact: I'm not aware of a vulnerability research conference that does get nosy about this stuff. I even reviewed for Usenix WOOT one year, and we didn't vet research for "coordinated disclosure". Not even Usenix works the way you want BH to.
        dllthomas 12y ago
        "at risk of certain death" That's an odd construction...
    - x1798DE 12y ago
      It's possible, but I think that's the paranoid / Hollywood spy version of this. Not saying that this sort of thing doesn't happen - the spy agencies take themselves very seriously but aren't big on effective policies anyway, but unless there's a specific operation that is relying on this specific exploit, and someone in the government got advance details of the nature of the exploit, it doesn't seem to have a particularly high prior probability. Anyone with a significant budget can probably pay for any number of zero days so they don't have a single weak point like "if anyone fixes this bug in the software our operation / malware will stop working". Generally when you see some outside force trying to suppress security research and the presentation thereof, it comes from the companies who will actually have to fix the problems and deal with support calls (or companies who feel that security through obscurity is sufficient and are hoping to somehow suppress the information from ever getting out). In this case, that would be maybe the Tor Project, but they generally are very receptive to this kind of thing.
bitexploder 12y ago
Wild conjecture. Most of the guys on CERT have a security clearance. This talk may have been viewed as crossing streams that he could not cross. He likely had to get the talk approved by whoever manages his clearance to ensure his talk is not leaking secret information. Someone further up the chain may have caught wind and pulled it.
pekk 12y ago
Speakers drop out all the time. Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues.
- at-fates-hands 12y ago
  >>> Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues. To some degree, isn't this what the Black Hat conference is all about?
  - jackweirdy 12y ago
    Seems to me the public ousting of projects only happens when they refuse to implement a fix, or deny that something's an issue.
  - deleted 12y ago
    [deleted]
  - MacsHeadroom 12y ago
    No, to some degree BH is about compromising X in public after X has been repeatedly contacted with the necessary details AND given ample time to address the issues. What these "researchers" were doing was just reckless. When it comes to Tor, lives are on the line. This kind of irresponsible disclosure is abhorrent, at best.
    - tptacek 12y ago
      I don't know what BH you've been attending for the last 10 years, but it's not the one I've been going to.
  - eat 12y ago
    Not at all... Black Hat is one of the more commercial, "industry" security conferences out there.
  - peterwwillis 12y ago
yalue 12y ago
I doubt this removal is anything sinister. Attacks on Tor have been a relatively common theme at many large security conferences. For example, there was a presentation at IEEES&P 2013 on de-anonymizing Tor hidden services (http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf). The Tor people are typically pretty open to this stuff. It was most likely removed due to something mundane, like the presenters having issues getting through their organization's bureaucracy.
dpeck 12y ago
Mid summer tends to be pullout season for Blackhat and Defcon speakers. A handful happen every year, thats why they have alternates. Sometimes the speakers screwed up and didn't get their material together and they weren't important enough to ignore that. Other times they're threatened by their employer or some external forces. Subway hacking, Padgets RFID (and GSM a few years later IIRC), etc. Theres quite a history of great presentations that have never happened for one reason or another.
orbifold 12y ago
At this point it is not really a good idea to use Tor anyways, given that you are then automatically targeted by the NSA and at the same time potentially provide cover for covert operations of several countries. What is really needed is political action to limit the capabilities of security agencies to indiscriminantly monitor web traffic.
- cortesoft 12y ago
  I disagree. The only way to prevent security agencies from indiscriminately monitor web traffic is to make it technically impossible. No political action is going to stop all such entities in the world from monitoring web traffic, let alone prevent non-government entities from doing so. I am not saying Tor is the answer, but whatever the answer is, it will have to be technical.
  - orbifold 12y ago
    Well Tor is obviously not the answer, it introduces too much latency and at the moment very few nodes mostly located in the US bear the majority of all traffic. No technical solution will prevent governments from monitoring all important network hubs. It seems impossible to prevent them to gather at least metainformation there. If enough routers in an onion routing scheme are compromised the same is true. If there would be laws that guaranteed the physical integrity of data centers, it would definitely be much easier to devise safe routing protocols.
    - cortesoft 12y ago
      Yes, Tor is not the answer. I can think of a hypothetical technical solution to the problem, however. If everyone used an onion-routing protocol where everyone also acts as an exit node, you could create a situation where even meta-information would be unobtainable.
      - orbifold 12y ago
        As it stands Tor is deliberately routing the majority of the traffic through a minority of the available exit nodes, they explain that they do that for performance reasons. Given that they are financed almost exclusively by the US government and some of the developers have very friendly relations with law enforcement to this day, it is at least plausible that there are other reasons at work. In some of the leaked NSA memos they even state that while they have not been able to fully compromise the tor network so far, at least the majority of their targets are using it. All of this is a clear indication to me, that TOR should be abandoned sooner rather than later.
dan_bk 12y ago
https://news.ycombinator.com/item?id=7998527 https://news.ycombinator.com/item?id=7998527
wfn 12y ago
Roger's response here is probably relevant: https://lists.torproject.org/pipermail/tor-talk/2014-July/033954.html https://lists.torproject.org/pipermail/tor-talk/2014-July/03... Hi folks, Journalists are asking us about the Black Hat talk on attacking Tor that got cancelled. We're still working with CERT to do a coordinated disclosure of the details (hopefully this week), but I figured I should share a few details with you earlier than that. 1) We did not ask Black Hat or CERT to cancel the talk. We did (and still do) have questions for the presenter and for CERT about some aspects of the research, but we had no idea the talk would be pulled before the announcement was made. 2) In response to our questions, we were informally shown some materials. We never received slides or any description of what would be presented in the talk itself beyond what was available on the Black Hat Webpage. 3) We encourage research on the Tor network along with responsible disclosure of all new and interesting attacks. Researchers who have told us about bugs in the past have found us pretty helpful in fixing issues, and generally positive to work with. (imho 2) and 3) is a polite way of saying that this particular talk did not feature much in terms of responsible disclosure. But these are not related to 1).)
- lawnchair_larry 12y ago
  Coordinated disclosure is the proper term.
ripb 12y ago
A lot of "I don't like your post so I'm downvoting it", Reddit-esque behaviour in this thread.

203 points by lanbird 12y ago

A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment. Source: http://www.reuters.com/article/2014/07/21/cybercrime-conference-talk-idUSL2N0PW14320140721 http://www.reuters.com/article/2014/07/21/cybercrime-confere...

lanbird 12y ago
Thank you for the information packetlss! http://www.qatar.cmu.edu/iliano/svc/meetings/PX/2004-09-21/syverson.pdf http://www.qatar.cmu.edu/iliano/svc/meetings/PX/2004-09-21/s... http://www.cmu.edu/silicon-valley/research/tech-showcase/pdfs/stegotorus.pdf http://www.cmu.edu/silicon-valley/research/tech-showcase/pdf...
- 616c 12y ago
  Interesting, they did a talk at Education City in Qatar and I had no idea about it? Very disappointed, and surprised they had talks with these kinds of experts on this talk (censorship avoidance is not looked kindly upon there).
x1798DE 12y ago
I have to imagine that this is for some sort of internal bureaucratic reason. I don't see who is in a position to even want to stop this talk - almost certainly not the Tor project itself. The mundane (and thus most likely) answer is that the CMU lawyers wanted to pull it either because they want to sort out some sort of intellectual property first, or they're worried about some sort of liability.
- andor 12y ago
  I don't see who is in a position to even want to stop this talk A government agency that wants to stay a step ahead of the competition or of its targets?
  - toyg 12y ago
    Or a University who doesn't want to get sued / get bad publicity for screwing with a tool used by government agencies...
    - MacsHeadroom 12y ago
      Legality aside, I'm surprised this wasn't pulled on ethical grounds. Does Black Hat not require "researchers" to follow responsible/coordinated disclosure? What about the political dissidents who use Tor? They could be at risk of certain death if caught by the authoritarian regimes they live under. Without coordinated disclosure, the "researchers" might as well have been signing death warrants.
      - tptacek 12y ago
        Black Hat is a venue for presenting research. They don't influence the procedures used by researchers at all. And the Black Hat review board is not stuffed full of people who buy into "responsible disclosure". In fact: I'm not aware of a vulnerability research conference that does get nosy about this stuff. I even reviewed for Usenix WOOT one year, and we didn't vet research for "coordinated disclosure". Not even Usenix works the way you want BH to.
      - dllthomas 12y ago
        "at risk of certain death" That's an odd construction...
  - x1798DE 12y ago
    It's possible, but I think that's the paranoid / Hollywood spy version of this. Not saying that this sort of thing doesn't happen - the spy agencies take themselves very seriously but aren't big on effective policies anyway, but unless there's a specific operation that is relying on this specific exploit, and someone in the government got advance details of the nature of the exploit, it doesn't seem to have a particularly high prior probability. Anyone with a significant budget can probably pay for any number of zero days so they don't have a single weak point like "if anyone fixes this bug in the software our operation / malware will stop working". Generally when you see some outside force trying to suppress security research and the presentation thereof, it comes from the companies who will actually have to fix the problems and deal with support calls (or companies who feel that security through obscurity is sufficient and are hoping to somehow suppress the information from ever getting out). In this case, that would be maybe the Tor Project, but they generally are very receptive to this kind of thing.

bitexploder 12y ago

Wild conjecture. Most of the guys on CERT have a security clearance. This talk may have been viewed as crossing streams that he could not cross. He likely had to get the talk approved by whoever manages his clearance to ensure his talk is not leaking secret information. Someone further up the chain may have caught wind and pulled it.

pekk 12y ago

Speakers drop out all the time. Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues.

at-fates-hands 12y ago
>>> Or maybe someone didn't want to compromise Tor in public until the Tor project had a chance to address the issues. To some degree, isn't this what the Black Hat conference is all about?
- jackweirdy 12y ago
  Seems to me the public ousting of projects only happens when they refuse to implement a fix, or deny that something's an issue.
- deleted 12y ago
  [deleted]
- MacsHeadroom 12y ago
  No, to some degree BH is about compromising X in public after X has been repeatedly contacted with the necessary details AND given ample time to address the issues. What these "researchers" were doing was just reckless. When it comes to Tor, lives are on the line. This kind of irresponsible disclosure is abhorrent, at best.
  - tptacek 12y ago
    I don't know what BH you've been attending for the last 10 years, but it's not the one I've been going to.
- eat 12y ago
  Not at all... Black Hat is one of the more commercial, "industry" security conferences out there.
- peterwwillis 12y ago

yalue 12y ago

I doubt this removal is anything sinister. Attacks on Tor have been a relatively common theme at many large security conferences. For example, there was a presentation at IEEES&P 2013 on de-anonymizing Tor hidden services (http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf). The Tor people are typically pretty open to this stuff. It was most likely removed due to something mundane, like the presenters having issues getting through their organization's bureaucracy.

dpeck 12y ago

Mid summer tends to be pullout season for Blackhat and Defcon speakers. A handful happen every year, thats why they have alternates. Sometimes the speakers screwed up and didn't get their material together and they weren't important enough to ignore that. Other times they're threatened by their employer or some external forces. Subway hacking, Padgets RFID (and GSM a few years later IIRC), etc. Theres quite a history of great presentations that have never happened for one reason or another.

orbifold 12y ago

At this point it is not really a good idea to use Tor anyways, given that you are then automatically targeted by the NSA and at the same time potentially provide cover for covert operations of several countries. What is really needed is political action to limit the capabilities of security agencies to indiscriminantly monitor web traffic.

cortesoft 12y ago
I disagree. The only way to prevent security agencies from indiscriminately monitor web traffic is to make it technically impossible. No political action is going to stop all such entities in the world from monitoring web traffic, let alone prevent non-government entities from doing so. I am not saying Tor is the answer, but whatever the answer is, it will have to be technical.
- orbifold 12y ago
  Well Tor is obviously not the answer, it introduces too much latency and at the moment very few nodes mostly located in the US bear the majority of all traffic. No technical solution will prevent governments from monitoring all important network hubs. It seems impossible to prevent them to gather at least metainformation there. If enough routers in an onion routing scheme are compromised the same is true. If there would be laws that guaranteed the physical integrity of data centers, it would definitely be much easier to devise safe routing protocols.
  - cortesoft 12y ago
    Yes, Tor is not the answer. I can think of a hypothetical technical solution to the problem, however. If everyone used an onion-routing protocol where everyone also acts as an exit node, you could create a situation where even meta-information would be unobtainable.
    - orbifold 12y ago
      As it stands Tor is deliberately routing the majority of the traffic through a minority of the available exit nodes, they explain that they do that for performance reasons. Given that they are financed almost exclusively by the US government and some of the developers have very friendly relations with law enforcement to this day, it is at least plausible that there are other reasons at work. In some of the leaked NSA memos they even state that while they have not been able to fully compromise the tor network so far, at least the majority of their targets are using it. All of this is a clear indication to me, that TOR should be abandoned sooner rather than later.

dan_bk 12y ago

https://news.ycombinator.com/item?id=7998527 https://news.ycombinator.com/item?id=7998527

wfn 12y ago

Roger's response here is probably relevant: https://lists.torproject.org/pipermail/tor-talk/2014-July/033954.html https://lists.torproject.org/pipermail/tor-talk/2014-July/03... Hi folks, Journalists are asking us about the Black Hat talk on attacking Tor that got cancelled. We're still working with CERT to do a coordinated disclosure of the details (hopefully this week), but I figured I should share a few details with you earlier than that. 1) We did not ask Black Hat or CERT to cancel the talk. We did (and still do) have questions for the presenter and for CERT about some aspects of the research, but we had no idea the talk would be pulled before the announcement was made. 2) In response to our questions, we were informally shown some materials. We never received slides or any description of what would be presented in the talk itself beyond what was available on the Black Hat Webpage. 3) We encourage research on the Tor network along with responsible disclosure of all new and interesting attacks. Researchers who have told us about bugs in the past have found us pretty helpful in fixing issues, and generally positive to work with. (imho 2) and 3) is a polite way of saying that this particular talk did not feature much in terms of responsible disclosure. But these are not related to 1).)

lawnchair_larry 12y ago
Coordinated disclosure is the proper term.

ripb 12y ago

A lot of "I don't like your post so I'm downvoting it", Reddit-esque behaviour in this thread.