WIRED: Feds Are Suspects in New Malware That Attacks Tor Anonymity

[kpete]

Feds Are Suspects in New Malware That Attacks Tor Anonymity

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

,,,,,,,,,,,,,,,,,,



The inevitable conclusion is that the malware is designed specifically to attack the Tor browser. The strongest clue that the culprit is the FBI, beyond the circumstantial timing of Marques’ arrest, is that the malware does nothing but identify the target.


The payload for the Tor Browser Bundle malware is hidden in a variable called “magneto”.


the rest:
http://www.wired.com/threatlevel/2013/08/freedom-hosting/

[darkangel218]

1. Duh....

[leveymg]

2. Can someone please tell us about the Tor anonymity network? Thnx

[kpete]

3. So what is TOR? According to their website:

Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis.

In addition to providing anonymous access to internet services, the network also allows for anonymous or hidden web site hosting as well. These hidden websites (which are accessible only through TOR), allow not only the users to be anonymous but the servers as well:

A Hidden service is a server – often delivering web pages – that is reachable only through the Tor network. While most people know that the Tor network with its thousands of volunteer-run nodes provides anonymity for users who don´t want to be tracked and identified on the internet, the lesser-known hidden service feature of Tor provides anonymity also for the server operator.

According to TOR, this allows the service to:

protect dissidents, activists, and protect the anonymity of users trying to find help for suicide prevention, domestic violence, and abuse-recovery. Whistleblowers and journalists use hidden services to exchange information in a secure and anonymous way and publish critical information in a way that is not easily traced back to them. The New Yorker's Strongbox is one public example.


MORE:
https://www.torproject.org/index.html.en
http://www.dailykos.com/story/2013/08/05/1229037/-Before-you-TOR

[randome]

6. Don't forget child pornographers.

A man in Ireland believed to be behind Freedom Hosting, the biggest service provider for sites on the encrypted Tor network, is awaiting extradition on child pornography charges, reports The Independent. Denied bail until there is a ruling on the extradition request, Eric Eoin Marques has been described by an FBI special agent as "the largest facilitator of child porn on the planet," and faces up to 30 years in prison if tried in the US.

http://www.theverge.com/2013/8/5/4589392/child-porn-bust-rocks-tor-network-freedom-hosting-compromised
[hr][font color="blue"][center]Stop looking for heroes. BE one.[/center][/font][hr]

[KeepItReal]

4. Tor is free software designed to let you surf the web anonymously

It is for PC, Mac, and Andriod devices (maybe even rooted iPhones) and other platforms.

From the Wiki:
Tor (originally short for The Onion Router) is free software for enabling online anonymity.

Tor directs Internet traffic through a free, worldwide volunteer network consisting of more than three thousand relays[6] to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis.

Using Tor makes it more difficult to trace Internet activity, including "visits to Web sites, online posts, instant messages and other communication forms", back to the user and is intended to protect users' personal privacy, freedom, and ability to conduct confidential business by keeping their internet activities from being monitored.

http://en.wikipedia.org/wiki/Tor_(anonymity_network)

[TroglodyteScholar]

5. This is a big fucking deal

TOR has been enjoying a higher profile recently as one of the only effective ways to protect your privacy when using the internet...and now there's an attack, potentially initiated by some agency of the US govt, that nullifies its effect without the user's knowledge?

Hooh.

On edit: I just read the whole article, and it was updated to add that the IP receiving the information (identifying info about the TOR user) is registered to SAIC, a major defense contractor. Reports that the info is going straight to NSA are false.

[nadinbrzezinski]

7. Let me pretend to be surprised.