Launching Anonymous Attacks Using the Tor Network

An anonymous reader writes "Nitesh Dhanjani over at O'Reilly Network describes how malicious users can launch attacks over the Internet anonymously using the Tor network. Looks like the flip side of the Tor project is that it allows anyone to launch network scans and exploits anonymously. Great, just what we need now."

Comments

Now, that's a discovery!

[Gadzinka]

I was operating mixmaster server some time ago. After couple of months of operation I've had couple of court orders[1] to reveal identity of people for which I was the last hop in mixmaster network. I decided to check outgoing mail for which I was last hop[2]. Around 90% of that mail was spam, scam, child pornography, harassment and simillar illegal and/or unethical stuff.

That was the end of mixmaster@hell.pl.

Oh, I believe, that there are some people in dictatorships, or some whistleblowers and other people, that really need anonymity on the net. But the reality is that whenever you make such a service available to population at large, it's the scum of the earth that dominates it.

Robert

[1] at least next best thing in my country, because here orders for search etc are issued by prosecution; don't ask me, why it is, it's stupid when the party to a conflict sings search warrants for the other party;

[2] you can't view mails that are just passing through your system in mixmaster network, they are encrypted; onl the mails that leave mixmaster network through your system are cleartext (if they aren't internally encrypted, of course);

Re:Astroturf

[Anonymous Coward]

Or read the last story about Tor on slashdot. The comments were filled with stories from people like myself that had to turn off thier nodes due to the nonstop abuse going through the network.

Not inevitable -- more defence instead of law?

[Morgaine]

There's no way around it....you simply have to take the good with the bad.

Not really, there are some VERY good things that could come from this, if the world actually moved in the direction of anonymity (sadly I don't think it will) ...

"This will make it incredibly difficult for you to track down the source of the attacks."

If you can't track them down, then there is no point complaining about attacks against you and bringing the law into it, so you would have to employ self-protection instead. Think of it as your $30 cable router's firewall on steroids, plus a bit more intelligence at ISPs. :-) In general, real defence is far more effective than looking to political solutions in a global space, where the law is largely powerless.

And as a side benefit, defence doesn't add to the already mountainous volume of law, nor lines the pockets of lawyers, not drains your wallet of legal expenses. But of course, you pay for your technological defenses instead.