Freedom Hosting sites compromised, founder arrested
twitlonger.com
twitlonger.com
So here's what I can grok from it:
* "Freedom Hosting" founder has been arrested; presumably, many people were using "Freedom Hosting" to host onion sites (is this where "half of all Tor sites compromised" comes from?). No charges listed, article slightly hints at child pornography charges.
* Someone, presumably the FBI, has set up an exploit to be distributed through Freedom Hosting sites that will phone home and reveal your non-Tor IP address (solution: seven proxies). "Freedom Hosting" founder was probably coerced into allowing distribution of this exploit.
* Author claims that said exploit only affects Firefox >= 17 on Windows.
* There's a link to a paper about possible problems with hidden services, which is apparently not relevant to any of this other than the fact that there was just a shakedown on a big onion site provider.
I'm flagging this article because it is utterly incoherent and the headline is sensationalist. There is no evidence of a fundamental flaw in Tor being related to any of the events mentioned. Hopefully someone will write a comprehensible piece soon and put it out there.
https://blog.torproject.org/blog/hidden-services-current-eve...
A better title may be like: "major .onion hosting service infiltrated by feds, all sites converted to honeypots; founder arrested". This does not imply any fundamental flaws in Tor itself or the technology in use, it does not falsely attribute a specific portion of .onion sites as infected, it does not communicate uncertainty into which sites are damaged (only sites hosted by Freedom Hosting were affected afawk), and it correctly reflects the events.
I suppose it's possible that the founder had a change of heart two days prior to his arrest and started collecting everyone's IP and sending it to the FBI based on nothing but a sense of personal moral obligation, but it doesn't seem too likely, and it's irrelevant either way because again, the proposed title is an accurate description of the posted article, even if the posted article is an inaccurate depiction of Real Life(tm).
Personally, I didn't read it that way at all. My first assumption was a hack, because it's more likely that a website was hacked than that the Tor protocol was so severely compromised.
> or else how could "half" of all sites be infected?
To me it sounded like a possible major law enforcement operation against 'rogue' sites. If someone was able to compromise Tor so completely, the idea that they would turn around and just hack half of the hidden sites doesn't make sense. Such an exploit would be worth major cash on the exploit market (mostly due to governments bidding against each other to get it).
If the headline had read "half of all web sites compromised" I would never have it thought it was because of some underlying fault with HTTP.
I'd suggest that you're the one being overly pedantic. "Protocol" doesn't necessarily have to refer to something explicitly labeled as a "protocol".
https://blog.mozilla.org/security/2013/08/04/investigating-s...
The fix was included in a Tor Browser Bundle update on June 26, 2013:
https://blog.torproject.org/blog/new-tor-browser-bundles-and...
tormail.org amongst them it seems. It's used at times by users of one famous online store of particular substances.
Just info. It's their problem if db leaked and they didn't use encryption of course.
Is it possible to route TOR traffic over TOR?
Among all internet users, Firefox 17 is probably rare, but among Tor users? My bet is that it owns a significantly higher chunk of the market.
[1] Tor Browser Bundle: https://www.torproject.org/projects/torbrowser.html.en
Furthermore, Tor Browser Bundle disallows JavaScript by default, and one should be cautious while allowing execution of arbitrary client-side code whilst intent on keeping their direct IP address secret. You have to take at least a couple of steps to be affected by this bug.
EDIT: The author has updated the OP and now claims that he believes Firefox 17 is the only affected version. His language is ambiguous such that it is unclear whether the exploit only affects Windows or if the code distributed by FH is simply not attempting to exploit any non-Windows environments (perhaps they were trying to get specific players).
EDIT: So it seems that NoScript is installed as part of the package, but that scripts are enabled globally by default. I just experienced this with a fresh install. Here's the answer confirming it: https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna... .
Personally I think that's a horrible compromise, and it's obviously something that's changed since last time I used it. This should be undone ASAP. Some education is required to use Tor properly even without considering things like JavaScript, so teaching someone to enable JS only when prudent should be fine to include as part of that educational package. It seems like there is some nefarious force at work here trying to trick people who really shouldn't be using Tor into using Tor. I know, for instance, that I had to stop several of my friends from using Tor after they heard about it from the news or whatever after the PRISM leaks. Do NOT use Tor if you don't fully understand the implications, like that all data you send through it is going to be decrypted to plaintext at a random exit node that could be run by literally anyone with a modern computer and internet connection.
Fortunately, NoScript continues to warn pretty blatantly with a big red exclamation point that scripts should not be allowed globally, and an educated Tor user will automatically forbid all scripts despite the awful default, so this is probably only a problem for people who are just dinking around anyway.
I am guessing that the payload that article mentions s/he does not have included a Windows (or Windows Firefox)-specific exploit which bypassed the tor tunnel so that they could then match the cookie in and out of Tor to identify the traffic origin. Otherwise, just having the cookie through Tor would be pretty worthless.
Other people that could be dinged by this would be anybody usuing that specific version of Firefox, without Torbutton. Torbutton wipes cookies when you switch between Tor and not-Tor, but Torbutton as a separate tool has been discontinued and TBB promoted, because to be safe you really need to have a separate browser profile.
On Linux (not targeted by this exploit, but maybe someday) you could avoid this using an Apparmor/SeLinux profile that prevented TBB Firefox from even making a network connection that's not to the Tor tunnel, or possibly even prevent Firefox from knowing it's own IP. Dunno if something like this is even possible on Windows. For traveling, I currently have been experimenting with a VM with TBB and an apparmor profile, and an iptables rule to prevent ANY outside traffic, except Tor. It works but it's a pain in the ass and nobody could be expected to install all that shit. That's what they made TAILS (A bootable disc image with only Tor, saves nothing to your machine, contains no known exploitable extraneous apps) for, people could check that out. Even running TAILS in a VM would have prevented this, though they recommend for maximum security you burn it and boot it.
No sympathy for child pornographers, but obv. this could be used against anybody seeking anonymity.
I don't currently use Tor, but I've thought about it and this is how I would do it. This can be done on windows using a virtual machine that disallows internet connections. Have the VM only able to network with the host OS, which is running the Tor app. That way the VM doesn't have an internet IP to leak, and if firefox itself is compromised there isn't anything on the VM that could give you away.
It does a check for NT-based platforms, the TBB will always identify itself as Windows/NT, even on Linux.
>Tor Browser Bundle disallows JavaScript by default
It has JS globally enabled by default.
For all these reasons, TBB exists, and is the safest way (short of a live environment) to ensure you have a sanitized environment. At the very least, you should use a separate browser profile before you switch to an activity that mandates the usage of Tor, unless you're using it only for very rudimentary circumventions.
However, the Commission (the executive branch, and especially the Trade Commisioner, Karel De Gucht) has been pushing hard for ACTA, going as far as lying, several times, to the Parliament. When the Parliament rejected ACTA, De Gucht said he would look for other means to bypass the decision.
The target demographics for prepaid is mostly kids and teens, poor people, and people concerned about their privacy, split between sensitized geeks, unfaithful lovers and criminals.
For the first two demographics cheap monthly plans are now emerging (in France, Free offers two hours of talk and infinite SMS for 2€ per month and unlimited talk, SMS and 3GB of data for 20€ per month).
It sucks for the last three.
On a slightly related topic, in demonstrations, people caught without a cell phone during an ID check often end up arrested for "administrative reasons".
So the likely reason for this is so that they can get an accounting of who was there, right? Where are you referring to?
It is definitely taken as suspicious.
Source: an alter-globalist activist acquaintance who demonstrates (peacefully) every other day.
Neither do most UK dwellers.
Except when it suits them, off course.
Basically, I think most civilized people have been operating on the premise that democratic western states are behaving in a vaguely civilized way towards people in other such states. But it's clear that America at least is behaving like the purest sociopath, where "friends" just means "easier to manipulate". They are breaking the unspoken international social contract, and it is going to have worse repercussions than they yet understand.
The American government, you mean.
I don't understand the "viable alternative" arguement. You are saying "I won't vote for who I really want to vote, because they'll never win, because everyone else won't vote for them" <--- Is that what you mean? That seems self defeating.
...
With preferential voting (or similar), you actually have the realistic probability of more than one party being in power. Here in Australia, the current government is formed from one major party, one minor party, and a couple of independents. It's not just 'mathematically possible', but a plausible outcome. That can't really happen with FPTP voting. Well, it can happen, but it's an oddity - see the current situation in the UK with the lib dems.
"I won't vote for who I really want to vote, because they'll never win, because everyone else won't vote for them"
The problem here is that by voting for someone whom you slightly prefer, you split the vote in a FPTP system, making them both lose out to the third person you didn't want in. If 60% of the population want a left-wing candidate, and they're split evenly-ish, they'll still lose out to the single right-wing candidate who only has 40%. It sounds self-defeating on paper, but in real terms it's more like self-preservation.
The other problem with systems that settle to two-party systems is that swing voters hold a disproportionate amount of power... which is ironic, given that the swing voters are usually not as politically interested as bloc supporters.
>>> that swing voters hold a disproportionate amount of power
How is it a bad thing? You say people that actually look at the issues at hand and not just mindlessly pull the lever for "our guy" whoever he is hold "disproportionate amount of power". I say they should hold 100% of the power - or 100% of the voters should be like this. The fact that they aren't is exactly the problem!
>>> given that the swing voters are usually not as politically interested as bloc supporters.
"Politically interested" can mean different thing. If bloc voters' only interest is getting "their guy" in power, and keep him there whatever happens, I don't have any sympathy for such kind of political interest. And if you want to see how well it works for those bloc voters, see how well it worked for voters in Detroit or Chicago, who are constantly voting in crooks and mob men.
No, America has strong American roots. Democracies and Republics both corrupt themselves over time.
America is unlike any other nation on earth, it's a hybrid, a democratic republic.
Considering that the United States is in a state of enduring war, and considering that all of the effort to monitor the internet comes from a desire to strengthen national security (which is a vital concern), it makes sense for the United States to behave this way.
After all, what is war other than purely sociopathic behavior? The monitoring of the internet is just an extension of these behaviors which manifest themselves during wartime.
If you'll let it off the leash entirely in "wartime", well, then the leash was never there.
The use of nuclear bombs signaled the end of world war two. Maybe the Obama administration is hopeful that surveillance of all communication is the final step towards a resolution of this war. That's not legitimate in my eyes, but oh well (i certainly don't know the solution). On top of everything else that has happened, zero expectation of privacy seems to be the equivalent of the nuclear option at this point.
but yes.
https://blog.torproject.org/blog/hidden-services-current-eve...
Once you manage to get arbitrary code running in the context of the browser, you can do anything the browser can, including (presumably) making raw non-TOR connections to anywhere, identifying the TOR user and correlating that with what they were doing over TOR.
Among other things like installing arbitrary malware kits that completely compromise the machine.
One partial solution would be to run the Tor client on a physically separate machine which acts as a transparent proxy for your browsing/internet box, and blocks any direct contact with the public internet via iptables trickery. I dunno what the processing overhead of running tor client is, but in theory you might be able to do so on a router running openWRT or similar.
personally i think a separate machine booted using the tails bootdisk and no write access to anything is probably the safest.
"In this paper we expose flaws both in the design and implementation of Tor’s hidden services that allow an attacker to measure the popularity of arbitrary hidden services, take down hidden services and deanonymize hidden services Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization"
Think of the children! Yes .. a good front to make it so that they can just bust anything using SWAT forces.
Is pedophilia such a big problem? Really ? I would like to see one study about pedophilia and the problems it creates, instead of what the problems that NSA and FBI are facing when people start encrypting their traffic and we actually have some freedom of speech in some areas.
By shutting down child pornography rings, police are preventing further abuse. How else would you propose they go about it?
Maybe, maybe not. Probably in some or even many cases, but certainly not all.
But, it also provides an unquestionable excuse to not care about "accidental" overreach or collateral damage. Someone's hosting something they don't like on a shared server? Guess what happens when they "discover" kiddie porn hosted by someone else on that same server?
Paedos will be paedos no matter whether privacy exists or does not exist, and it is not an issue related to privacy and freedom, do not link it as such; freedom ceases to be freedom when it violates another individual's freedom(=abuse or product of abuse) so the abuser has to be stopped from further violating it. As the previous poster said, you could argue around consent and/or having an inclination, but as to the actual abuse taking place there can be no question about it.
In a truly anonymous internet that respects privacy, it would be up to individuals to find, isolate and condemn these people, much like Anonymous did in 2011.
Abuse of freedom and privacy can only lead to and justify not having any freedom and privacy, it fuels the whole pro Big Brother argument; if there was a way to demonstrate that Internet self regulation/regulation by the people works, then this would be a major blow to all kinds of 'higher authority' monitoring and fear mongering.
I encourage everyone to chill out, leave your emotions at the door, and give the topic a thorough and dispassionate treatment.
"I'm fucking tired of X" is an unreasonable way to conduct ourselves. It's a sure way not to change anyone's opinion.
The argument I've heard is that a frictionless child pornography market effects an increased financial incentive to traffic children.
Previous discussion of malicious Javascript: https://news.ycombinator.com/item?id=6154246
"in some way", "probably", "presumably" = I have no idea what's going on.
That being said, there is always a point that this could be used for something else entirely, though. Compromising Tor mail is a lot less of a targeted attack.
http://pastebin.mozilla.org/2777139
edit: Maybe is a good idea to submit this link (or another related) to discuss about it in a new HN thread.
People should stop using web/browsers for everything.
I guess hardware catching up with resource requirements took away one of the biggest reasons against it. And most people really embraced the web as more than a document platform. I think part of me still misses the old way of thinking about it.
> Why is NoScript configured to allow JavaScript by default in the Tor Browser Bundle? Isn't that unsafe?
> We configure NoScript to allow JavaScript by default in the Tor Browser Bundle because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if a website they want to use requires JavaScript, ...
https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
It'd be crazy to download a full local client for something as shady as SilkRoad or many other hidden services. The browser is the safest place for that kind of thing.
It's my understanding that one can host a .onion "hidden" site without having to go through any such provider as Freedom Hosting, so I don't see how my privacy is being affected by this situation.
As of now there is some guy stating that some hoster has been pwnd and uploaded some JS that expoloited something that might be FF17 that might have been shipped with the tor browser bundle.
Why exactly does he thing FBI/NSA is involved? If he has the exploit code why didn't he upload it?
Lots of conclusions based on assumptions. As of now I'd think it's more likely someone just pwnd the largest TOR hidden host provider, uploaded a sploit that will affect most of the users (tor browser bundle) and called it a day.
Sure there MIGHT be some GOV/whatever involvment. But wouldn't it be time to wait with such accusations until we got some actual proof? Not even uploading the alleged exploit doesn't really help his position.
I would think that since about 60% of TOR projects funding comes from the .gov[0], that they have an incencitive to keep it online. I could imagine they have some nodes for which they wouldn't want to reveal the physical location. I don't know warhead controllers or something. Of course that only works if the're are enough nodes involved so you can hide yourself. That's why I think this might not have been a .gov action.
[0] https://www.torproject.org/about/findoc/2012-TorProject-Annu...
Where is there ever a "degree" of visibility as to whether something is a government honeypot?
State can and will use computer exploits in military and law enforcement. Like with PRISM, its no longer just the tinfoil - Its confirmed. The businesses model for a few companies are to hoard zero-day exploits, and sell it on the market. The military, police, "business intelligence" a.k.a industry spying, and criminals are their customers. In contrast to disease research, software virus research are not regulated or illegal, so both good and bad is the result. It is good when independent research find vulnerabilities in software we use, and less so when its hoarded and sold to be used against us.
>3. Bitcoin and all crypto currenecies set to absolutely CRASH as a result since the feds can not completely control this currency as they please.
Some of Endgame's products used by the likes of the NSA: "There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayman botnet-analytics package gets you access to a database of Internet addresses, organization names, and worm types for hundreds of millions of infected computers, and costs $1.5 million."
Exploiting an unknowable amount of users of a service as to hunt them. Using illegally harvested data from botnets, while others get hunted and prosecuted for coding them.
This tiered society where the legally immune can profit off acts that get others jailed. The market manipulation that comes with bribing companies for data access, the government giving less regulatory oversight to companies it has secret 'deals' with.
For the sake of society, economy, basic morality. It must end.
Not that I disagree with this sentiment, but how is this different from the fact the government is "legally immune" from using/possessing weapons and firearms that the average person can't possess or use?
I.e. billions of emails created daily originating from millions of email accounts created daily that contain random words including the ones the NSA is looking for.
I mean, they went on the path of the least resistance with this whole PRISM thing. Kind of blatantly stupid approach of "just listen to everything". That can possibly be derailed by simple creating tons and tons of "everything" daily to feed their stupid programs.