11 ms·
“Warning: Do Not use my mirrors/services until I have reviewed the situation”
- mmastrac 12y agoInteresting to see this play out in realtime. This message just showed up in the thread[1]: Node fingerprints are as follows, please blacklist ASAP. Some servers are accessible via their KVM again but not networked. D78AB0013D95AFA60757333645BAA03A169DF722 6F545A39D4849C9FE5B08A6D68C8B3478E4B608B 5E87B10B430BA4D9ADF1E1F01E69D3A137FB63C9 0824CE7D452B892D12E081D36E7415F85EA9988F 35961469646A623F9EE03B7B45296527A624AAFD 1EA968C956FBC00617655A35DA872D319E87C597 E5A21C42B0FDB88E1A744D9A0388EFB2A7A598CF 5D1CB4B3025F4D2810CF12AB7A8DDDD6FC10F139 722B4DF4848EC8C15302C7CF75B52C65BAE3843A 93CD9231C260558D77331162A5DC5A4C692F5344 A3C3D2664F5E92171359F71931AA2C0C74E2E65C 575B40EF095A0F2B13C83F8485AFC56453817ABF 27780F5112DEB64EA65F987079999B9DC055F7C0 54AA16946DB0CF7A8FA45F3B48A7D686FD1A1CEF 1EB8BDA15D27B3F9D4A2EDDA58357EA656150075 17A522BC05A0D115FC939B0271B8626AAFB1DDFF 1324EC51FBFA5FD1A11B94563E8D2A7999CD8F57 [1] http://thread.gmane.org/gmane.network.tor.user/34619 http://thread.gmane.org/gmane.network.tor.user/34619
- mmastrac 12y agoFurther updates via @CthulhuSec on Twitter: Not much further info at this point. Trying to do secure log dumps but most systems seem unavailable again. Bracing for possible local raid Apologies no further info atm, I don't know what I am dealing with yet, ISP has made no comment Re: if warrant executed at servers Interesting that the servers were briefly up and running, but down again.
- alfiedotwtf 12y agoAs the Tor community knew of a possible compromise in advance, what what is the purpose of this? Sounds like fear mongering by the TLAs with the aim to discredit anonymity within the network rather than actual malice.
- chummm 12y agoAt this point we really don't know.
- nickporter 12y agoWhat's wrong with informing the public that his exit node might be compromised? I would want to know. Also, IMO it's unlikely that these events are unrelated. 1. Tor says they might get compromised. 2. Guy's exit node gets compromised.
- lazyjones 12y agoUm, it's useful for other Tor operators to know what to look for if they find their servers rebooting / going down for a while without good reason. Also, warning people not to use those mirror sites is a responsible reaction to possible compromise.
- alfiedotwtf 12y agoSorry, I think you misunderstood me... what I meant was - what is the purpose of the TLAs continuing with their raids if everyone knew it was about happen. That's what I meant by fear mongering.
- meowface 12y agoIt's possible that they suspect the servers are hosting other services/content and aren't just Tor exit nodes. Other than that, I agree, I don't see what the point of this would be. Especially when there was some early warning. It is possible that the warning from a few days ago is entirely unrelated to this incident, though.
- lazyjones 12y agoOK, they might simply seek control of those servers in preparation for some large-scale action. Or they are after some people who they know absolutely depend on Tor to operate. Just wild speculation though...
- drodgers 12y agoFor anyone who missed the warning a few days ago: https://blog.torproject.org/blog/possible-upcoming-attempts-disable-tor-network https://blog.torproject.org/blog/possible-upcoming-attempts-...
- MalcolmDiggs 12y agoOh wow, I definitely missed that. Thank you for posting.
- mmaunder 12y agoAnd the HN thread: https://news.ycombinator.com/item?id=8774833 https://news.ycombinator.com/item?id=8774833
- ChuckMcM 12y agoInteresting. It is entirely possible it is survivor bias on my part but I get the suspicion that a global sort of 'cyberwar' that has been rumbling along for years is heating up rapidly. I've seen a 10x increase in various scripted attacks being attempted (patch early and often folks!) and a number of APT level compromises of systems either staging malware or deploying it (see the latest bulletin on the Afghan government compromise). And of course the whole Free Syrian Army / ISIS / terrorist nom de jure attacks. I can't shake the analogy to pictures from WW II where shop keepers were huddled in the back while soldiers fought from the front of the store. I see innocent servers being 'occupied' by enemy malware so that it can launch attacks on other servers further into a protected network. Fortunately in this modern version of war you can "kick the soldiers out" of your server by bringing it down and re-imaging it. And they won't turn around and shoot you, but that is not all that comforting somehow.
- _RPM 12y agoDoes ISIS really have the resources to carry out criminal computer activities? From what I understand, they are a group with limited technological advantage, and there is no way they could carry out a major attack on the Internet.
- ossreality 12y agoWhat "resouces" do you need? A credit card and a curious 20 year old could inflict a massive amount of damage with little effort, given a vulnerability to exploit. I can spin up a thousand VMs in 4 cloud providers in seconds. By the way, I'm aware I was hellbanned. It was well over a year ago. My comments were on-topic and polite before I was banned. The funny thing is, the person I was banned for arguing with has burned through half a dozen accounts. I refuse to play ball with HN's shitty policy of hellbanning and so I post like an asshole. Hellbanning is exceedingly rude and everytime I want to comment I remember how much it pisses me off so I decide to let it affect my comments. (For context, my original HN account was nearly in the Top 10 [with an average of ~10] when it was banned for arguing with the same person ironically.) Awe, that's too bad. Jamesaguilar and I see eye-to-eye on most things and I respect their attention to bs sexism and racism on HN :)
- gnu8 12y agoHow did these criminals penetrate the ISP? Is there security footage? It should be no trouble to identify the perpetrators and have them arrested if their pictures are posted online.
- alfiedotwtf 12y agoThe criminals were probably carrying a warrant.
- Havoc 12y agoI laughed...and then I frowned.
- rtpg 12y agoIf there was a warrant, we should be able to get that information, and act on it, and figure out how to avoid it in the future. Which comes to an interesting situation: if this was acted upon by NSL, here there's proof something happened, so how does that get explained without breaking the gag order?
- olefoo 12y agoYour comment is indicative of the crisis of legitimacy that has infected our governments, and most of the institutions of stability in our global society. It seems like a small thing; but once the perception that the forces of law and order are themselves lawless exceeds a certain critical threshold things begin to change rapidly. Indeed the United States itself came to be in the wake of the erosion of the legitimacy of Englands colonial government. There won't be an announcement; but once that threshold is crossed events begin to move rapidly and forcefully and do not stop until a new arrangement of powers is found that society can scaffold itself upon. Who knows what will be the stable state of a world seeded with the idea of networks and knowledgable in their subversion and subornation.
- markbnj 12y agoI'd love to see some historical basis for this supposition that there is a natural counter balance to "lawless" power. First of all, your premise presupposes that there is some standard of "lawfulness" against which the existing power structure can be judged. If the powers that be are faithful to their own interests and rules then by definition they are lawful, since they create and administer the law. Your appeal to a higher morality (I assume, since I don't know what other standard there could be) makes a good muse for an artisan, but I see no evidence in the long, bloody history of our species that it acts as some sort of automatic restorer of natural order. Quite the contrary, in fact. It is the current state of affairs in some Western countries, in which the citizens have leave to consider whether their governments are lawful and ways to act if they are not, that is the exception.
- 0x0 12y agoWonder what shenanigans the USB device is up to. A bootable drive for flashing backdoored bios/hdd firmware or keylogging? Snapshotting the HDDs? 0day'ing the kernel USB stack?
- dsl 12y agoProbably just a USB stick with Second Look or a similar tool on it. Very first thing you do is dump the running memory on the system. Then you pull the drives, plug them into a write blocker, then image the drives. Modifying anything before you have a complete forensic dump is a big no-no because you need to preserve evidence.
- xorcist 12y agoCan you explain more? How do go about dumping memory?
- dsl 12y agoThis is a good intro to the subject http://www.forensicswiki.org/wiki/Memory_Imaging http://www.forensicswiki.org/wiki/Memory_Imaging Law enforcement also has additional undisclosed methods to avoid detection by systems.
- psykovsky 12y agoUndisclosed even to courts? How do courts know such forensic methods are done according to the law if they're undisclosed?
- adrianpike 12y agoThe specific tool they were mentioning is: https://secondlookforensics.com/ https://secondlookforensics.com/ Interestingly enough, look who makes it.
- grrowl 12y agoSpoiler/save-the-click: "© 2014 Raytheon Cyber Products. All rights reserved. Second Look® is a registered trademark of Raytheon." > The Raytheon Company is a major American defense contractor and industrial corporation with core manufacturing concentrations in weapons and military and commercial electronics.
- nullflow 12y agothe chassis of the servers was opened and an unknown USB device was plugged in only 30-60 seconds before the connection was broken. In which country did this happen? As an European I expected the US/EU governments would keep their hands of Tor because dissidents use it in countries where US/EU want regime change.
- tankenmate 12y agoNederlands $ whois 77.95.229.11
- SchizoDuckie 12y agoWTF?! Since when do we backdoor hardware in The Netherlands without informing the owner?
- Havoc 12y agoI'm sure even the Netherlands has some kind of mechanism in place to allow this if a sufficiently powerful court order is in place.
- tinco 12y agoFeel free to drop the 'even' in that sentence. Just say the magic words 'child pornography' and the judge will go and install that bug himself. Tor has a very bad reputation in The Netherlands, I think just saying it's a Tor node might be enough reason for a judge to sign off on an eaves-dropping warrant.
- EarthLaunch 12y agoIt's not less possible, you're just more ignorant of it than America is.
- anigbrowl 12y agoHold off on the conclusion-jumping = 'possibly consistent with X' is a long way from 'proof of X'.
- binaryanomaly 12y agoUpdate here: https://lists.torproject.org/pipermail/tor-talk/2014-December/036078.html https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... Seems mysterious but not confirmed to be LE raid.
- draugadrotten 12y agoUpdate on twitter: https://twitter.com/CthulhuSec https://twitter.com/CthulhuSec "People have taken my mere suspicions way too seriously. I haven't even mentioned a specific agency and the theories are already flowing." Update on tor-talk: https://lists.torproject.org/pipermail/tor-talk/2014-December/036078.html https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... In the first original email, he writes "At this moment in time I am under no gagging orders or influence from external parties/agencies. If no update is provided within 48 hours you may draw your own conclusions." Please may I call your attention that this canary paragraph is missing from the latest tor-talk update. Draw your own conclusions.
- dmix 12y agoWhich latest tor-talk update is missing the canary? The one you linked to says: > 7. Again, at this moment in time I am under no gagging orders or unreasonably withholding information under orders.
- draugadrotten 12y agoThe "under no influence" part is missing.
- grrowl 12y agoIF we take the strict differences of the phrasing, we could say he's reasonably withholding information by request. Incorporated with the timeframe, this could be anyone — but given his response and the extra 250+ twitter followers today, he's probably been reminded the cost of drawing conjecture in public.
- draugadrotten 12y agoI am thinking this guy is very exact and precise in his phrasing, especially with regards to a canary. He's a crypto-geek, anarchist and running an exit node and this crowd knows Alice is not Bob. He knows what he says will be scrutinized by thousands. Why wouldn't he be very careful in what he says? Based on his first canary vs the last, he could, as you say, "reasonably" be withholding information on request. Perhaps terrorists, kitty pr0n or the threat of jail is reason to him. Good resons, who knows. He could also be under the control of someone that asks him to add new, lie or modify information. Worse reasons, perhaps. Either way his first canary reminded us that whatever he says now needs to be treated as possible disinformation.
- Nanzikambe 12y agoOff Topic: But out of curiosity what does a Tor hidden service keep in memory? Would there be any information that would uniquely identify the services it's running? Given that they're often run in datacentres (either colocated or within a VM) - wouldn't a USB device capable of scraping RAM and dumping a list hosted .onions be quite practical for law enforcement purposes? They're obviously finite amount of datacenters in each country/jurisdiction that accept bitcoin or sell VPSs.
- flux_w42 12y agoA Dutch tech news site [1] published the news on their site and got in contact with the ISP Snel: The ISP told Tweakers that the account of Thomas White was blocked due to a security policy of the company. The customer let a deadline for verification accidentally expire and logged in through KVM. "Some KVM's generate a USB event when you use it to set up a connection to the server, this is what the customer just notified." - according to the ISP Snel. Meanwhile, the man's account is released. [1] https://tweakers.net/nieuws/100388/beheerder-verliest-controle-over-cluster-tor-exitnodes.html https://tweakers.net/nieuws/100388/beheerder-verliest-contro...
- spacefight 12y agoSo much about ISP <> customer confidentiality then!?
- psykovsky 12y agoEspecially when the media has better information than the customer.
- osivertsson 12y agoI don't really buy it. This doesn't explain why a chassis intrusion alarm was triggered, nor why a large chunk of logs are now missing.
- tripzilch 12y agoThe article also links to an update Thomas White has posted: https://lists.torproject.org/pipermail/tor-talk/2014-December/036078.html https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... Few quick points (that I found most interesting, click link to read everything): "The likelihood of this being the work of law enforcement seems to be lower than originally anticipated. This is good in many ways but asks more questions than it solves right now." "Support staff at the ISP have confirmed to me there has been unauthorised access to my account. This could be down to the fact I access the control panel often via Tor (yes, using TLS before anybody asks), however it does raise the prospect of a non-LE person(s) being behind this but does not explain why a chassis intrusion was detected for example or anything else to do with on-board sensors." "Again, at this moment in time I am under no gagging orders or unreasonably withholding information under orders."
- fluential 12y agoWhat do you think is the business / legal risk of running few tor relays (no exit) nodes as a commercial company (UK or US based)? One of my friends told me that he would be afraid of the potential of freezing company assets if someone start investigation and those nodes would be part of that case. Any thoughts? Comments?
- folta 12y agoLatest update posted in the mailing list: https://lists.torproject.org/pipermail/tor-talk/2014-December/036084.html https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... No canary in this update.
- folta 12y agoOne more update: https://lists.torproject.org/pipermail/tor-talk/2014-December/036089.html https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... Several nodes are going to go back online and are being requested to be un-blacklisted. "I have emailed some of the DirAuths to remove several nodes and IPs from the blacklist that we feel confident have not been breached or compromised in any way."