7 ms·

FBI Exploits Tor Browser Bundle to Target Child Pornographers

77 points by dpeck 12y ago

fiatmoney 12y ago
"all computers that access the website" seems the polar opposite of "particularly describing the place to be searched, and the persons or things to be seized".
- rudimentary 12y ago
  Except, these agencies are quick to retroactively redefine terms. Maybe data isn't "seized" until you classify it as evidence. And if all else fails, "think of the children" usually works.
  - higherpurpose 12y ago
    That argument should never hold in a Court. I'm still hoping one of these surveillance cases goes to the Supreme Court.
    - fnordfnordfnord 12y ago
      The trick is to shop around for the most loathsome defendants you can find until you get a precedent established, then you can expand the technique's use more broadly.
- trhway 12y ago
  applying the same principle of "2nd amendment was written when AK-47 didn't exist", the 4th was written when Internet (with its immense capabilities for child pornographers in particular) didn't exist. You did let that happen to 2nd, now it happens to the 4th and the 1st will come next (Twitter isn't just like AK-47, it is more like small WMD)... Slippery slope isn't just an argument, it is a physical law of Nature (known as 2nd law in other branches of sciences).
- tedunangst 12y ago
  Is there no precedent for a warrant like "this whorehouse, address blah blah, and all the whores found therein"?
  - dublinben 12y ago
    It would be more like "this motel, known to be frequented by prostitutes, and every guest, regardless of their purpose for being there."
    - tedunangst 12y ago
      Would it? Did the FBI plant the malware on general purpose sites that happened to have some child porn, or on specific sites dedicated to child porn?
      - AlyssaRowan 12y ago
        Everything hosted by FreedomHosting, including Tormail, which was most probably the true purpose of their op (it had been used by Snowden and others, but all the mail was GnuPG encrypted).
        tedunangst 12y ago
        The initial Operation Torpedo seemed rather strictly targeted ("Pedoboard"), and those are the cases working their way through court. The Freedom Hosting malware came later, and it's not clear whether there even was a warrant or not, since it all appears to be still secret. To argue whether the warrant was sufficiently particular is impossible to say. I can concede that was too large a scope, but that defense can't really be made until there's a defendant. Was it even the same malware in both operations?
        AlyssaRowan 12y ago
        Same C&Cs. :)
- anigbrowl 12y ago
  It's different where you have prima facie evidence of guilt. Think of it as the digital equivalent to (perfectly legal) dye packs: http://en.wikipedia.org/wiki/Dye_pack http://en.wikipedia.org/wiki/Dye_pack
jedanbik 12y ago
FBI exploits vulnerabilities in old versions of TorBrowser. Solution: only run latest version of TorBrowser. Did I parse the article correctly?
- comex 12y ago
  FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future. This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.
  - jordigh 12y ago
    Unambiguously? This seems like a strong statement. What makes you say that?
    - aaron42net 12y ago
      Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets. Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.
    - Niten 12y ago
      comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense. Mozilla acknowledges as much with the mission statement of their Electrolysis project: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.
  - wtallis 12y ago
peterkelly 12y ago
So let me get this straight: Breaking into other's computer systems to gain unauthorised access is only illegal/unethical for the little people - is that right?
- sliverstorm 12y ago
  So let me get this straight: enforcement should be bound by exactly the same rules as citizens - am I correct?
  - coldtea 12y ago
    Yes, you are correct, and yes it should.
    - Loughla 12y ago
      So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? That is unbelievable naive, whatever your view on the current state of law-enforcement is. There are times when law-enforcement needs slightly more space to work than regular citizens; search warrants, for instance. The questions arise when we discuss where the line is for how much more space they need and when they need it. 99% of the time, I agree with you; law enforcement should have to operate under the same rules as everyone else. But, for that one percent, asking politely if any crimes are being committed on the premises is just not enough.
      - anon4 12y ago
        You're right but you don't want the executive branch to grant itself powers. You want the judiciary branch to give the executive branch an exceptional above-law right to do things in a specific situation that you don't want done to just any random person.
      - peterkelly 12y ago
        So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.
gabriel34 12y ago
Regardless of the legality issue, a privacy bundle subject to these vulnerabilities is not really a privacy bundle. TOR should stand on its own. If its security is dependent on legal framework than it's insecure. In my opinion, nothing can ever be considered completely safe. All you can do is make sure the attacker's effort is bigger than the value of what you are protecting is in his view.
GrinningFool 12y ago
What's with editorialized title? The targets are those who downloaded the porn, those who hosted the porn, but - as far as the article discussed - not the pornographers producing the content [1] [1]Pornographer - one who produces pornography -- http://www.merriam-webster.com/dictionary/pornographer http://www.merriam-webster.com/dictionary/pornographer
- _archon_ 12y ago
  Interesting... I would tend to think that the highest priority target is the one creating such material and harming minors in the process.
AlyssaRowan 12y ago
That's not all exactly true. Let me name it: the name of that exploit is EGOTISTICALGIRAFFE. Sound familiar? They actually infected everything on that service provider, including Tormail. That was deliberate and part of an NSA op. They didn't hack the server, the hosting provider gave them root. Data seized is being secretly used in various Tormail operations (not covered by warrant), and in "parallel construction" in several drug-bust cases and one related to another leaker. I'm not saying this is a cover, but it is awfully convenient.
EliRivers 12y ago
But hidden services are also a mainstay of the nefarious activities carried out on the so-called Dark Net: the home of drug markets, child porn, murder for hire, and a site that does nothing but stream pirated My Little Pony episodes. My God. Those pony-pirating monsters.

77 points by dpeck 12y ago

"all computers that access the website" seems the polar opposite of "particularly describing the place to be searched, and the persons or things to be seized".

rudimentary 12y ago
Except, these agencies are quick to retroactively redefine terms. Maybe data isn't "seized" until you classify it as evidence. And if all else fails, "think of the children" usually works.
- higherpurpose 12y ago
  That argument should never hold in a Court. I'm still hoping one of these surveillance cases goes to the Supreme Court.
  - fnordfnordfnord 12y ago
    The trick is to shop around for the most loathsome defendants you can find until you get a precedent established, then you can expand the technique's use more broadly.
trhway 12y ago
applying the same principle of "2nd amendment was written when AK-47 didn't exist", the 4th was written when Internet (with its immense capabilities for child pornographers in particular) didn't exist. You did let that happen to 2nd, now it happens to the 4th and the 1st will come next (Twitter isn't just like AK-47, it is more like small WMD)... Slippery slope isn't just an argument, it is a physical law of Nature (known as 2nd law in other branches of sciences).
tedunangst 12y ago
Is there no precedent for a warrant like "this whorehouse, address blah blah, and all the whores found therein"?
- dublinben 12y ago
  It would be more like "this motel, known to be frequented by prostitutes, and every guest, regardless of their purpose for being there."
  - tedunangst 12y ago
    Would it? Did the FBI plant the malware on general purpose sites that happened to have some child porn, or on specific sites dedicated to child porn?
    - AlyssaRowan 12y ago
      Everything hosted by FreedomHosting, including Tormail, which was most probably the true purpose of their op (it had been used by Snowden and others, but all the mail was GnuPG encrypted).
      - tedunangst 12y ago
        The initial Operation Torpedo seemed rather strictly targeted ("Pedoboard"), and those are the cases working their way through court. The Freedom Hosting malware came later, and it's not clear whether there even was a warrant or not, since it all appears to be still secret. To argue whether the warrant was sufficiently particular is impossible to say. I can concede that was too large a scope, but that defense can't really be made until there's a defendant. Was it even the same malware in both operations?
        AlyssaRowan 12y ago
        Same C&Cs. :)
anigbrowl 12y ago
It's different where you have prima facie evidence of guilt. Think of it as the digital equivalent to (perfectly legal) dye packs: http://en.wikipedia.org/wiki/Dye_pack http://en.wikipedia.org/wiki/Dye_pack

jedanbik 12y ago

FBI exploits vulnerabilities in old versions of TorBrowser. Solution: only run latest version of TorBrowser. Did I parse the article correctly?

comex 12y ago
FBI has, in one case where the exploit was spotted and made public (and they probably knew it would be, since it was deployed so widely), exploited an out-of-date version of TorBrowser. No guarantee that they don't use zero-days elsewhere or won't in the future. This is why I think TorBrowser should switch to Chromium. Whatever you have to say about Google, Chromium is unambiguously more secure than Firefox.
- jordigh 12y ago
  Unambiguously? This seems like a strong statement. What makes you say that?
  - aaron42net 12y ago
    Until Firefox tightens their sandbox, I believe any exploit can still use system calls to directly create TCP sockets. Chrome forces sandboxed processes to use its network stack; if that's been configured to use Tor, it shouldn't end up revealing your IP and therefore identity.
  - Niten 12y ago
    comex's statement is correct. Chrome/Chromium was designed from the ground up for fine-grained sandboxing of renderers and extensions; Firefox's single-process design currently prevents it from implementing any similar layered defense. Mozilla acknowledges as much with the mission statement of their Electrolysis project: https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis Hopefully Firefox's situation will improve in the near future—at the very least, we'll all benefit if Chrome has a viable competitor. But in the meantime Firefox absolutely is behind Chrome in the security department.
- wtallis 12y ago

peterkelly 12y ago

So let me get this straight: Breaking into other's computer systems to gain unauthorised access is only illegal/unethical for the little people - is that right?

sliverstorm 12y ago
So let me get this straight: enforcement should be bound by exactly the same rules as citizens - am I correct?
- coldtea 12y ago
  Yes, you are correct, and yes it should.
  - Loughla 12y ago
    So to commit any crime at all, I just need to be sure to close my doors and not allow law-enforcement in when they ask to enter. Correct? That is unbelievable naive, whatever your view on the current state of law-enforcement is. There are times when law-enforcement needs slightly more space to work than regular citizens; search warrants, for instance. The questions arise when we discuss where the line is for how much more space they need and when they need it. 99% of the time, I agree with you; law enforcement should have to operate under the same rules as everyone else. But, for that one percent, asking politely if any crimes are being committed on the premises is just not enough.
    - anon4 12y ago
      You're right but you don't want the executive branch to grant itself powers. You want the judiciary branch to give the executive branch an exceptional above-law right to do things in a specific situation that you don't want done to just any random person.
    - peterkelly 12y ago
      So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.

gabriel34 12y ago

Regardless of the legality issue, a privacy bundle subject to these vulnerabilities is not really a privacy bundle. TOR should stand on its own. If its security is dependent on legal framework than it's insecure. In my opinion, nothing can ever be considered completely safe. All you can do is make sure the attacker's effort is bigger than the value of what you are protecting is in his view.

GrinningFool 12y ago

What's with editorialized title? The targets are those who downloaded the porn, those who hosted the porn, but - as far as the article discussed - not the pornographers producing the content [1] [1]Pornographer - one who produces pornography -- http://www.merriam-webster.com/dictionary/pornographer http://www.merriam-webster.com/dictionary/pornographer

_archon_ 12y ago
Interesting... I would tend to think that the highest priority target is the one creating such material and harming minors in the process.

AlyssaRowan 12y ago

That's not all exactly true. Let me name it: the name of that exploit is EGOTISTICALGIRAFFE. Sound familiar? They actually infected everything on that service provider, including Tormail. That was deliberate and part of an NSA op. They didn't hack the server, the hosting provider gave them root. Data seized is being secretly used in various Tormail operations (not covered by warrant), and in "parallel construction" in several drug-bust cases and one related to another leaker. I'm not saying this is a cover, but it is awfully convenient.

EliRivers 12y ago

But hidden services are also a mainstay of the nefarious activities carried out on the so-called Dark Net: the home of drug markets, child porn, murder for hire, and a site that does nothing but stream pirated My Little Pony episodes. My God. Those pony-pirating monsters.