The FBI Is Classifying Its Tor Browser Exploit | Hacker News Reader

The FBI Is Classifying Its Tor Browser Exploit

motherboard.vice.com

128 pointsashitlerferad64 comments

If the exploit is classified, how can it be verified that the exploit actually extracted the evidence claimed? That is, how can the FBI prove that it did not obtain the evidence by other, illegal means (as they have instructed other agencies to do)? Provenance of evidence is everything in criminal cases.

"I just know he's guilty, your honor. I just know it in my heart of hurts. Just trust me on this, OK? Just, like, trust me. I mean I am here busting my balls working 14 hour days keeping our people safe, your honor, and I just really need a win right now. So can you just, like, find him guilty? Like, I've never asked you for any personal favors. And I totally have the evidence, but who needs that. I mean I just not it, just by looking into his eyes. Look at him, doesn't he just look guilty to you, your honor?"

The obvious solution is to have a court that can handle classified material.

The defendant has a legal right to be present, and to see all the evidence presented against them, even if they're neither allowed to receive "classified" information nor bound to not disclose it. So no, classified evidence is not evidence.

If you can't make a case against someone without classified information, decide which you care more about: the classification of the information, or the conviction.

That would work out very badly. Consider this cold war example:

Somebody high-up in the CIA is secretly working for the USSR. They are passing everything to the USSR. Over in the USSR there is a similar situation, with somebody passing KGB things to the CIA. The guy secretly working for us is able to reveal the person secretly working for the USSR.

Now we grab the person. If we reveal the evidence to him and everybody in unclassified court proceedings, it will get back to the USSR. Our agent in Moscow will be caught. Even if we black out his name, he will be caught. It's a scary enough risk just acting on the info he supplied.

Your way of doing things gives us 3 terrible choices:

a. Evacuate our super-valuable guy from Moscow. b. Get our guy in Moscow killed. c. Let the spy go unpunished, thus encouraging others.

Can the defendant insist on a jury trial if some of the evidence is classified? What happens then?

There really shouldn't be any trouble finding people with security clearances to be on the jury. If anything, this is a far superior "jury of peers". It's people who do the same sort of work.

> It's people who do the same sort of work.

Exactly the problem. "People with security clearances" seems like a set of people more likely on average to favor the government point of view, to the point that a defense attorney that allowed twelve people with security clearances to form a jury has utterly failed at voir dire.

In general, yes, they might favor the government point of view. In this case however, they'd be asked to judge one of their own. ("that could be me") That balances things off pretty well.

For sure, it's a more caring and accurate group of people than the usual collection of students, old ladies, and unemployed people.

It'd work fine.

That's the first time I've ever heard of a bunch of FBI spooks being described as "caring and accurate".

There would be lawyers with security clearances, and the defendant would usually have to rely on his lawyer.

It's not perfect, but it balances the conflicting needs better than any alternative I've ever seen.

Note that this isn't 1-sided in favor of the government. Consider what happens today. People working at Area 51 tried to sue over being exposed to toxins, but were stopped by the state secrets privilege. That privilege would die if we had classified courts.

As far as American criminal justice is concerned "due process" actually means "plausible fantasy".

It needs to be plausible?

Damn you and your impossible standards, you commie terrorist!!

The FBI has two different, and sometimes opposed, missions. The primary mission is security - it's supposed to stop terrorists from terrorizing, spies from spying, saboteurs from... well, whatever.

After-the-fact law enforcement is secondary. It may be this is a tool they intend to use to attack spy and terrorist networks where breaking up the network is more important than getting prosecutions.

> The primary mission is security ... After-the-fact law enforcement is secondary.

I'm not sure that's true. Where do you get that?

https://www.fbi.gov/about-us/quick-facts

The FBI dropped law enforcement from their mission statement several years ago, and now considers their mission to be intelligence work only.

> The FBI dropped law enforcement from their mission statement several years ago, and now considers their mission to be intelligence work only.

That's an interesting claim, but utterly untrue: "The mission of the FBI is to protect and defend the United States against terrorist and foreign intelligence threats, to uphold and enforce the criminal laws of the United States, and to provide leadership and criminal justice services to federal, state, municipal, and international agencies and partners; and to perform these responsibilities in a manner that is responsive to the needs of the public and is faithful to the Constitution of the United States."

https://www.justice.gov/jmd/organization-mission-and-functio...

You can say pretty much the same thing about all electronic evidence. Ultimately it comes down to people involved in the chain of custody for the evidence signing affidavits, whether the evidence is an exploit or a simple log file.

There's a huge difference between the chain of custody and the methods used to extract information.

If I'm allowed to use a classified system to extract information (say from an encrypted drive) I could really just be creating that information instead. The defendant can't or won't decrypt the drive so they can't dispute the claim.

I guess I don't understand how this isn't trivially true of the simplest log file introduced into evidence.

Log files are cleartext. We can both see what it says on day 1 and that won't change.

But if there's a classified evidence-gathering program it can be upgraded to "find" whatever they want at any date.

Except the chain of custody involved easily MITM-able unencrypted data:

http://motherboard.vice.com/read/fbi-our-malware-sends-unenc...

Again not sure how arguments like that don't apply to most collected electronic evidence. Defendants can raise that argument in court; evidence is routinely disputed.

Closed binary demonstrates they can pull data.

It doesn't verify the data is accurate and correct at the time of collection.

Without that evidence is literally worthless.

How is this concern different for any form of evidence? At some point you're trusting that a person collected evidence in the way they claim to have collected it. To help me understand, could you make an analogy for a drug bust? Theoretically an officer could plant drugs on you. And that does happen from time to time, but we don't just ignore all evidence because that might have happened.

The difference between a lie and "that's classified" is that you can disprove a lie.

You can disprove the claims made from classified sources. "A classified source said you bought 50 kilos of cocaine. We searched your house and found 50 kilos of cocaine." You're still going to jail. If no cocaine turns up, then you should be in the clear.

The claim you're going to want to challenge there isn't the existence of the cocaine, it's the existence of probable cause to search your house for it.

Yes, the exclusionary rule means the bad guys win when the good guys can't prove they followed the rules. That's how the exclusionary rule gets the good guys to follow the rules.

> To help me understand, could you make an analogy for a drug bust?

You can verify that:

1) Drugs were present at the location at the time of the arrest.

2) They are in fact drugs.

3) That a chain of custody exists.

4) The people involved in the arrest and the person arrested.

With "classified, closed source software" you can verify:

1) The people involved in the arrest and the person arrested.

You cannot verify:

1) If the software works as explained/intended.

2) You cannot verify the person was present at the time of the crime.

3) You cannot verify the chain of custody because you have no idea. ( http://legal-dictionary.thefreedictionary.com/chain+of+custo... )

How would you verify that drugs weren't present at the time of arrest? Generally the arresting officers' word is going to be taken as fact unless you can prove otherwise. So you'd basically have to have your own video recording of the event showing the officer planting the drugs. This is the functional equivalent to "If the software works as explained." If drugs are found at your house, but not on you, you're still going to jail. So there goes #2. Why would you not be able to verify chain of custody for digital evidence?

The difference is the attack surface. They only get one chance to plant drugs. They have unlimited attempts to fake finding data on your encrypted drive image.

"Your Honor, the new version of the program found kiddyporn that we missed before."

And even if you decrypted the drive you wouldn't be able to prove you didn't have the data steganographically hidden, so there's no possible way you could refute the claim.

You could easily setup and experiment to verify this.

Because the FBI wouldn't lie about stuff like this. And parallel reconstruction does not exist. I meant honestly, if there were any real hard rules, other than do whatever you can get away with, much if not all criminal case evidence would be highly suspect, demanding at the least a retrial.

https://en.wikipedia.org/wiki/Poe%27s_law

but it's not everything in situations outside the rule-of-law. Just because something isn't legally provable doesn't make it false. I suppose the existence of the exploit could be a very VERY elaborate set of smoke and mirrors, but I doubt it. DC shoots from the hip just like everyone else.

"never attribute to malice that which can be attributed to incompetence." -Some Smart Guy IDK...Google it.

The FBI and other government institutions often ask for the help of the tech industry, and act like they want to build bridges but actions like this show a double standard.

They are like your annoying needy friend. Always asking you for stuff but never bothering to return the favor.

> show a double standard

No they don't. Assistance that industry would provide would also be classified and honestly a penalty would probably be levied if the found issues were ever fixed.

So they found it on their own, results classified so they can't be fixed.

Needed help finding it, threaten penalties if the issue is ever fixed.

They're not trying to build bridges, they're trying to gain control of another source of information.

Why is Tor Browser still using FF instead of Chrome or something?

A sandbox is necessary, and I'm 100% sure there are a ton of 0-days in all browsers.

https://www.torproject.org/docs/faq#TBBOtherBrowser

>Our efforts to work with the Chrome team to add missing APIs were unsuccessful, unfortunately. Currently, it is impossible to use other browsers and get the same level of protections as when using the Tor Browser.

https://blog.torproject.org/blog/google-chrome-incognito-mod...

Chrome is not even open source. They can't use it.

If you're referring to Chromium, well, what makes you think it's more secure than Firefox?

Also, don't you think that the developers of the Tor browser are pretty security-aware? That they might make very well informed decisions?

Chromium is a magnitude more secure than Firefox. If you find a 0day in the Firefox renderer, bam, code execution with full user permissions. A 0day in Chromium renderer code is pretty much worthless.

Firefox has zero additional layers of security. Chromium has a battle-tested sandbox which kills 99% of all exploits in the absence of an additional kernel exploit.

Also note how none of the recent Flash 0days was exploitable on Chrome.

"developers of the Tor browser" probably not, lots of incompetent people in infosec. Tor itself has decent devs, but even they have seen leadership troubles recently, pressure from feds etc. Check the mailing-list.

Reminder, this isn't a vulnerability in Tor, but an IP leak in Firefox, or at least the way it's configured in TBB.

Maybe a sandbox is irrelevant to an IP leak though, idk.

chromium still has a sandbox

And mystery binary blobs have made an appearance[0]

[0] https://www.reddit.com/r/linux/comments/3a0rz0/chromium_unco...

Distros can choose to disable that feature. Also note that the blob runs _inside_ the sandbox.

I for one would never trust a Google tor client.

Or more importantly, why isn't there a browser written in a language impervious to low level buffer overruns, ROP, and pointer problems?

Certainly there are other higher level data exposure problems that could manifest, but I'm so utterly sick of C-level security exploits that I'm ready to throw everything out with the bathwater.

That's one of the hopes of Servo: https://github.com/servo/servo

Yes, zero day exploits are present in all software, that is a known fact (Chrome is not an exception)... in fact, 0-days is just what is publicized... there is the exploits that are kept private which might one day become "0-day".

I'm not sure why anyone uses a big-name browser on tor anymore. It's trivial to lock something like wget or lynx/links into using the tor connection and getting the same kind of results.

So write a bot that browses bad sites on tor and see what infections it picks up, then examine what vulnerabilities they exploit.

Contrary to my usual opinion about the US Federal Government's "cyber-tactics," this actually seems like a good thing.

I'd rather that fewer people understand how to break tor, as opposed to more. There's a middle ground which may be better, but on the open-source/classified spectrum I'm a little right-leaning on this one. Thoughts?

It should be patched. Am I wrong?

The entire reasoning behind using tor is for anonymity, and we don't know what this exploit is exactly or how serious it is.

I remember reading an doctoral paper from MIT about it, and the general principal involved a combination of large swaths of man-in-the-middle tor nodes, combined with algorithms resembling physics formulas which use statistical mechanics to model fluid dynamics.

If that's the case the exploit is intrinsically linked to the way tor works, and there may be no patching possible.

I'ma need someone to fact-check me because I'm semi-busy right now and I don't have the article on-hand.

This is described as a Tor Browser exploit -- a vulnerability in the browser that people normally use with Tor -- rather than a vulnerability in the design of Tor or a way of performing traffic correlations. This vulnerability can probably be fixed permanently for all users with a tiny software patch.

The article indicated the vulnerability was in the Tor Browser, not Tor itself. A vulnerability in the Tor Browser can be patched, and it's likely present in Firefox as well.

I'd very much like to read that paper, wow.

> I'd rather that fewer people understand how to break tor, as opposed to more.

Then you should be opposed to this! If the fbi shares the exploit, tor will patch it. As is, this vulnerability in tor puts its users at risk, both from the fbi and from anyone else who has found the exploit.

If the FBI let people know what vulnerability is, the vulnerability could be fixed, which would result in fewer people understanding how to break tor.

The FBI doesn't want the vulnerability to be fixed though, which is why they classified it.

Yea as a sibling indicated, the obvious better middle ground is the exploit just not existing any more.

If the exploit were in the protocol itself then that might not have been viable, but the facts of the case suggest it's an implementation level exploit, in which case the FBI choosing to hoard it actually does increase the chance of more people (even outside of the American intel community) gaining access to the exploit.

This was an exploit in Firefox, which may or may not have anything to do with Tor, but probably doesn't.

Releasing it would almost certainly lead to it being fixed very soon.

> I'd rather that fewer people understand how to break tor, as opposed to more.

That is ridiculous. The more people who try to break Tor, succeed and tell the Tor Project how they did it, the safer Tor (and Firefox) become. The Tor Project relies on the security research community to find attacks on Tor so that they can be fixed. Same goes for all software in general.

Reply on news.ycombinator.com