4 ms·

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an innovative tactic, you can find it on all sorts of sites. If you use the Tor Browser Bundle, it will route Flash through Tor so you're immune. However, during Operation Torpedo, the FBI deployed an "implant" on Freedom Hosting's servers which was an exploit for CVE-2013-1690, a vulnerability in Firefox. Wasn't a 0-day, but a lot of people using TBB had not patched yet. This was just some Javascript which executed a small bit of Windows shellcode, sending each victim's IP address, MAC address, and a serial number to an FBI-controlled server. The only way to be safe from this was with an updated Firefox version, and/or running NoScript.

vilhelm_s 12y ago
According to the article, Operation Torpedo happened one year earlier than the Freedom Hosting hack. I don't think we have seen the results of the latter yet.
- noirbot2 12y ago
  The Freedom Hosting event was over 1.5 years ago. I'm starting to wonder if there was some procedural / legal issue with that operation. I don't know what would delay the investigation this long otherwise.
  - bbrian 12y ago
    The extradition case in Ireland hasn't concluded yet, but looks like it's being heard tomorrow. http://www.breakingnews.ie/ireland/extradition-case-against-alleged-largest-facilitator-of-child-porn-in-the-world-adjourned-653963.html http://www.breakingnews.ie/ireland/extradition-case-against-...
smtddr 12y ago
>>It will only catch people who have configured their proxy very poorly. To add to this, in Firefox if you use this: http://i.imgur.com/ajT98xC.png http://i.imgur.com/ajT98xC.png , Flash does not obey it. I kinda think Mozilla should put some kind of warning-text on this dialog window to warn uses that it doesn't apply to flash, silverlight or any plugins. This surprised me at first but it makes sense if you think about it. You really have to do a system-wide VPN type thing. Something like this: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle will actually tunnel everything on your PC.
- alex_duf 12y ago
  Careful, sshuttle doesn't route UDP, and by default does not route DNS requests either. For Firefox, I don't think they should bother anyway, the world is killing flash, if you want to be anonymous on the internet use noscript and don't install flash in the first place.
  - smtddr 12y ago
    Oh wow! Thanks for this heads up!
- wazoox 12y ago
  Wait a minute, how does flash reach the web if your access is only through a proxy, then?
  - smtddr 12y ago
    https://forums.adobe.com/message/4262734 https://forums.adobe.com/message/4262734 Hmmmmmm..... So from what I gather here, if the ActionScript is using the regular getURL[1] that call is passed to the browser and will be proxied. But if flash tries to open up a raw socket[2] on its own, it won't know about the proxy and will just fail(or reveal your true IP) 1. http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?content=00000564.html http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?cont... 2. http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/Socket.html http://help.adobe.com/en_US/FlashPlatform/reference/actionsc...
ChuckMcM 12y ago
Interesting to me though is that that article seems to imply that if you are after an Onion server you only need one "idiot" using it in order to unmask it. By compromising that user, their compromised system will get you information about the server. Or did I mis-read what they were implying?
- digi_owl 12y ago
  You're misreading it. They already had a guy at the web hotel. The injected code unmasked the visitors, allowing the FBI to go out and arrest them along with taking down the site itself.
  - ChuckMcM 12y ago
    Thanks.
debacle 12y ago
Isn't it recommended that users turn off JavaScript when trying to anonymize?
- meowface 12y ago
  Yes.

vilhelm_s 12y ago

According to the article, Operation Torpedo happened one year earlier than the Freedom Hosting hack. I don't think we have seen the results of the latter yet.

noirbot2 12y ago
The Freedom Hosting event was over 1.5 years ago. I'm starting to wonder if there was some procedural / legal issue with that operation. I don't know what would delay the investigation this long otherwise.
- bbrian 12y ago
  The extradition case in Ireland hasn't concluded yet, but looks like it's being heard tomorrow. http://www.breakingnews.ie/ireland/extradition-case-against-alleged-largest-facilitator-of-child-porn-in-the-world-adjourned-653963.html http://www.breakingnews.ie/ireland/extradition-case-against-...

smtddr 12y ago

>>It will only catch people who have configured their proxy very poorly. To add to this, in Firefox if you use this: http://i.imgur.com/ajT98xC.png http://i.imgur.com/ajT98xC.png , Flash does not obey it. I kinda think Mozilla should put some kind of warning-text on this dialog window to warn uses that it doesn't apply to flash, silverlight or any plugins. This surprised me at first but it makes sense if you think about it. You really have to do a system-wide VPN type thing. Something like this: https://github.com/apenwarr/sshuttle https://github.com/apenwarr/sshuttle will actually tunnel everything on your PC.

alex_duf 12y ago
Careful, sshuttle doesn't route UDP, and by default does not route DNS requests either. For Firefox, I don't think they should bother anyway, the world is killing flash, if you want to be anonymous on the internet use noscript and don't install flash in the first place.
- smtddr 12y ago
  Oh wow! Thanks for this heads up!
wazoox 12y ago
Wait a minute, how does flash reach the web if your access is only through a proxy, then?
- smtddr 12y ago
  https://forums.adobe.com/message/4262734 https://forums.adobe.com/message/4262734 Hmmmmmm..... So from what I gather here, if the ActionScript is using the regular getURL[1] that call is passed to the browser and will be proxied. But if flash tries to open up a raw socket[2] on its own, it won't know about the proxy and will just fail(or reveal your true IP) 1. http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?content=00000564.html http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?cont... 2. http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/Socket.html http://help.adobe.com/en_US/FlashPlatform/reference/actionsc...

ChuckMcM 12y ago

Interesting to me though is that that article seems to imply that if you are after an Onion server you only need one "idiot" using it in order to unmask it. By compromising that user, their compromised system will get you information about the server. Or did I mis-read what they were implying?

digi_owl 12y ago
You're misreading it. They already had a guy at the web hotel. The injected code unmasked the visitors, allowing the FBI to go out and arrest them along with taking down the site itself.
- ChuckMcM 12y ago
  Thanks.

debacle 12y ago

Isn't it recommended that users turn off JavaScript when trying to anonymize?

meowface 12y ago
Yes.