Slashdot Mirror
Tor Used To Collect Embassy Email Passwords
Several readers wrote in to inform us that Swedish security researcher Dan Egerstad has revealed how he collected 100 passwords from embassies and governments worldwide, without hacking into anything: he sniffed Tor exit routers. Both Ars and heise have writeups on Egerstad's blog post, but neither adds much to the original. It's not news that unencrypted traffic exits the Tor network unencrypted, but Egerstad correctly perceived, and called attention to, the lack of appreciation for this fact in organizations worldwide.
Why are embassy officials using Tor? Trying to hide something?
...of a guy in a class I took who had packet sniffed our network, then reported my university e-mail password to me. Why? Because the university refused to enable SSL-secured POP3. A quick email reveals that, in fact, they were never planning to, and that I am just SOL.
Palm trees and 8
Of course something originally designed by the US Naval Research Laboratory and then spun off to an "independent pro-privacy group" such as the EFF would have loopholes, insecurities, and unwieldly aspects of it.
One thing that doesn't make sense to me: why does Tor operate MOSTLY over primary networks with non-tor functions? Doesn't it make sense that people who rely on Tor-offered anonymity would only operate the network bound to a specific NIC, a specific router and a specific network connection, separate from their main non-anonymous one? If anonymity is that important, why even bother trying to maintain an anonymous network connection concurrent with your non-anonymous one, with both utilizing the same single-point of exit/entry?
Doesn't make sense.
Well, the embassies should have used this new technology called "encryption". I heard that in the future, even browsers will support it...
eknagy
Tor uses the concept of 'onion routing' to obscure the source and destination of content passed through it. What this means is that, like an onion, content is wrapped in multiple layers of destinations and buried in the ground (or routed) until, after a delay, shoots come up (the headers are interpreted and the onion is passed to another destination) and ultimately the onion is ready to be dug out of the ground (the content reaches its destination).
Unfortunately, it's possible to tell it's still an onion by the time it reaches your house. And that's what this article is referring to. If you wrapped an apple in an onion (used secure public key encryption) then you have an additional layer of security. That's a whole nother layer of complication, however.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
if you voluntary place the said man in the middle?
Of course Embassy officials have something to hide. In fact this raises a superb example of one of the legitimate, and useful, needs for Tor. There are a lot of people, mostly in law enforcement, who'd like to see all anonymity, and especially Tor, shut down. And I'm not just referring to Communist China.
And let us not forget that Onion routing was first officially developed, and published, by the U.S. Navy back in the 90's.
Now if only Slashdot would allow me to post via lynx through Tor. "Anonymous" my butt.
I'd hate to be around when you bake a pie.
I doubt the users from these governments were using TOR to check their mail. More likely that hackers had already compromised the accounts and were using them to check the email accounts anonymously.
-AC
I thought it was common knowledge that most exit routes were owned by the very people, people think they need to keep secrets from.
... but then again I grew up in Canada, not Bosnia or whatever :-)
Personally, I'm more afraid of some script kiddie stealing my ID than the man listening to my thoughts
Someday, I'll have a real sig.
Unless he built his own Tor node, joined the network, then captured his proxied traffic - which is something ANY Tor admin could do, in which case its STILL not particulary insightful, cool, or 31337.
That's exactly what he did. The entire point of him doing so was (he claims) to demonstrate that people using TOR are not protected from anyone reading traffic that comes out the exit nodes if they don't bother to encrypt the traffic they send into TOR.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Someone who sits between sender and recepient who exchange unencrypted data can sniff it? Impossible! Stunning news!
/. should implement irony tags.
Which reminds me,
Seriously, people. OF COURSE that works! Man in the middle, anyone? Where's the big deal? I'm kinda glad someone finally points it out and that it affects some high profile target like an embassy so some people (read: politicians and other, similar entities) will actually realize that this is possible and being done, but the answers here scare me almost more.
I mean, here, we're supposedly a hint more educated than Joe Schmoe Average Browser, right? News for Nerds is hardly Weekly World News, I'd say. And still, we got people posting tinfoil crap like "Developed by $three_letter_agency" or "of course it has to have holes, it's from the EFF". WTF? Folks? Get a grip. From the exit node to the server it's as unencrypted as it would be from you to the server if you didn't use TOR. That's neither a flaw, nor an implementation error, nor some CIA/NSA/WTF conspiracy. It's simply the way the net works, if you don't use some kind of SSL encryption between the communication partners!
Sometimes I really wonder...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"Try this site for the issue"
Can you please explain what this has to be (a faked root authority) with my question? Remember: I *already* have the site's public key; I don't need to be confident in *any* other third party.
Even in the case from you article, remember that if your "MiM attack" strategy includes owning my box or the server, that's not a MiM attack anymore.
"It does help a little to sign your own certs and inspect them ALL the time on every use."
Wouldn't you find a little suspicious that while visiting a site which public key is already known by your client app it asks you to accept a new one?
The attack presented in the article only works because your app doesn't know the public certificate from the server upfront (and I explicitly said that not being the case) and because you were fooled to accept services from an ill-behaving individual/company. If you think such foolery (or bad luck) is just a "new technologies" hazard, ask yourself about it next time you *physically* allow some unknown guy into your home "just" bacause he happens to wear your cable-tv company uniform.