'Tor Stinks' presentation – read the full document

That Schneier article [1] is very technical and reveals quite a lot of interesting information. It was immediately flagged off HN front page by the flagging brigade [2]. It's highly recommended reading, though.

[1]http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa...

[2]https://news.ycombinator.com/item?id=6495771

That Schneier article is a must read with lots of technical details.

Anyone know how to start identifying the FoxAcid servers and calling them out?

PDFs of the leaked documents:

https://s3.amazonaws.com/s3.documentcloud.org/documents/8014...

http://s3.documentcloud.org/documents/801434/doc2.pdf

http://s3.documentcloud.org/documents/801435/doc3.pdf

A lot of these articles use abstruse acronyms. Is there perhaps a place where they're all compiled with their explanations?

For instance, what is (U)? Or (S), (SI), and (REL)?

It's a powerpoint, doubtless put together by a middle-manager who thought some clipart would spice things up. Internal presentations at pretty much every company I've worked for have been just as tacky.

and a beard... like terrorists can be stereotyped like that. This is more than just propaganda, this is the mentality of the type of people who put these presentations together. That fact that whoever wrote this presentation has profiled people like this. I would wager that 99% of online "terrorists" are sitting around in jeans and t-shirts, on safe soil, have probably never handled a gun, let alone an AK-47 (or whatever that is on his back), probably don't have a beard. The ones financing them probably spend their life wearing a suit and tie and are either driving a top of the line vehicle or are driven everywhere in a top of the line vehicle.

If you look at the world around us and review the history of terrorism, most of it's been funded behind the scenes by one of the major superpowers, and you can't overlook the fact that a large portion of this has been by backed by the US. It's funny how when the US wants a government toppled, the terrorists are "friendly" and funded and armed by the US government, but when they're counter to US interests, they're suddenly part of the axis of evil and must be destroyed...

Perhaps if they stopped funding this ignorant behaviour and stopped supplying munitions to these terrorist interests, the problem would eventually go away... spend more on education and tolerance towards all points of view, enlightenment, the world would become a more peaceful place.

When will "democratic" governments eventually realize that money and greed is not the best approach to the furthering the human experience on this planet.

Sorry, didn't mean to get off on a rant there, but that one picture triggered a bit of annoyance.

"Terrorist" -- as everyone knew it would become -- is now shorthand for anyone undesirable or anyone targeted for any reason.

> I don't know about you guys, but all my Tor activities are performed in my Halloween costume!

I don't always hack, but when I do, I wear a balaclava

http://www.buzzfeed.com/copyranter/all-computer-hackers-wear...

Oh, come on, they're humans too, and thus subject to deliberately unfunny jokes in (technical or not) slide presentations like the rest of us.

From a quick look this one seems more plausible than the absurd PRISM presentation.

If they built a Star Trek bridge replica to sell the idea of the NSA to the congress, they can do this too

http://americablog.com/2013/09/nsa-outrage-star-trek-bridge....

Yeah where is the value for my tax dollars? I want top shelf Powerpoint presentations.

This presentation seems very odd.

Page 4: Dumb Users (EPICFAIL)

Especially... I can't imagine this is clip art. Someone must have sat down and drawn that to order.

That must be a really wierd job, doing tacky but still sophisticated illustrations for top secret internal presentations.

I thought it was more of a Zorro mask. It's very suspicious that the entire presentation seems to undermine the supposed severity of the issue with very silly names and pictures...

Tor Stinks, ONIONBREATH, EPICFAIL

Can we pleeeeease make this the new default icon for the OnionBrowser Bundle?

(edited to remove broken image link)

Amazing.

Even better, on page 9: "Analytics: Dumb Users (EPICFAIL)"

It's all part of the theatre and propaganda. Make the weak minded believe that everyone's the boogeyman. At least people on the internet can think critically and say "Er, this doesn't sound right"

Although, in effect I think you are right about GCHQ, that whole CCTV thing is pretty much a myth founded in a deeply flawed study focussed on a street in Central London. 90% of CCTV is privately owned, and if you step out of the metropolis CCTV is no more abundant than anywhere else. I suggest you stop using that argument with regard to the UK as it undermines your absolutely valid post.

They are doing this all the time. They are buying exploits and keep them locked up, they actively backdoor software and hardware.

Basic statistics tells us it is pure insanity to compromise our security for the noise that is "international terror".

Police have to use the same roads. The presentation leads me to believe that they do not want to scare people away from Tor, so they can track at least some users, but probably/obviously have their own network/servers for anonymous connection that will not be impacted.

Otherwise yes, it seems stupid to make Tor unusable as a whole.

I'm pretty sure Tor does smart peer profiling/selection to optimize for throughput. Lots of people run Tor relays on their silly little home DSLs and Tor still works.

At the end they debate whether killing Tor would be bad, since if they could exploit it they'd have all the "bad guys" in one place.

But then the last slide has this:

> Critical mass of targets use Tor. Scaring them away from Tor might be counterproductive.

If anything this just encourages me to keep my non-exit relay up as much as possible.

This could be countered by setting up a lot of fast nodes. Stealthier malicious nodes that selectively drop or tar-pit traffic though would be harder to fight...

I wonder, if you flag too much, do you get a 'querulant' flag yourself that makes the site ignore your flags? :-D

I would totaly implement something like that if I were PG. Seems to fit the mindset of HN, as it also uses hellbans.

It already says they want people to keep using Tor. Read the last slide:

> Critical mass of targets use Tor. Scaring them away from Tor might be counterproductive.

In other words, they'd rather only have to break one anonymization service instead of five.

If I had a few million dollars to run compromized Tor nodes, and the ability to subpoena (and gag order) any Tor node operator in USA, UK and a couple of other major countries to give me their keys, I would be able to easily de-anonymize a large portion of the network.

This is probably part of the Snowden files, so it was unlikely to be an intentional leak.

"To trick targets into visiting a FoxAcid server, the NSA relies on its secret partnerships with US telecoms companies. As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target's browser to visit a Foxacid server.

In the academic literature, these are called "man-on-the-middle" attacks, and have been known to the commercial and academic security communities. More specifically, they are examples of "man-on-the-side" attacks."

Read more here: www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity

This is enabled by a very obvious flaw in the CA infrastructure that SSL/TLS is based upon. All it takes is someone with leverage over the top level certificate authority and the DNS servers you use and there's nothing you can do to detect that's what's going on. That's a huge and very obvious flaw in the system that anyone questioning what they can trust on the internet should have spotted a mile away.

Pretty sure it is. If you need serious anonymity, like if your life depends on it, get a botnet and use the trojaned PCs as proxies. Use public WiFi, and use cheap laptops that you replace regularly and/or VMs, and don't forget to fake your MAC address. Create multiple fake personas to confuse attackers. Have stuff you write rephrased by someone else, so they can't do a corpus analysis on your writings. Do as much offline as possible. If you have to transfer information, avoid the internet. Use dedicated lines, dialup, dead drops, etc. etc.

I'm so glad I have nothing to hide.

I think your original conclusion, 2007 is correct.

What exactly does sourced vs dated even mean?

The document states "still investigating" for multiple issues. It doesn't take the NSA 6 years to investigate these things.

The questions are very basic, such as, browser/JS exploits, leftover cookies, and owning the majority of nodes. That is hardly top secret, all of these were things that were public concerns long ago.

The other alternative is they just don't care. They can still slurp down a good portion of the incoming and outgoing email traffic. If one of wikileak's origin stories are to be believed most Tor users have no idea how Tor works or what they are actually doing, including government operators (with the appropriate code name EPICFAIL on page 9.)

Going completely off topic, I had an idea earlier. Bitcoin right now is using something around 16,000 petaflops of processing. This shows that when proper incentives exist massive computational and network resources can be utilized in a distributed manner.

What if a protocol existed which forced user participation or required them to exchange a store of value to use it? For example, if a user acted as a node (relay not exit) they mined a currency (probably inflationary.) If a user did not act as a node, they had to pay a currency which would then be distributed to exit node operators. The currency could be bought and sold through exchanges rather than to a central commercial entity.

The end goal, besides having a lot more network bandwidth, would be to have so many relay and exit nodes running it would be economically impossible for a single entity to compromise a significant number of them.

Of course, easier said than done.

Many government agencies do this - check out the names for DEA stings, or even FDA operations.

TOR - The Onion Router.

Would be a hell of a co-incidence if it wasn't a reference.

I think Tor recommends surfing from a dedicated virtual machine, IIRC, which is probably the safest way to surf, though something like Flash or Java can still probably report the actual host IP.

The document is dated 20070108, seems they'd be a lot further on with Tor now. Also they mention using AWS to set up Tor nodes.

Was interested in the user profiling to establish from raw network traffic which users are likely using Tor - so for example from this message.

Not sure what QFP is though?

if you follow ioerror and ggreenwald on twitter you probably have some idea of what forced this particular cache of articles.