Tor Users Urged To Update After Security Breach

An anonymous reader writes "If you use Tor, you're cautioned to update now due to a security breach. In a message on the Tor mailing list dated Jan 20, 2010, Tor developer Roger Dingledine outlines the issue and why you should upgrade to Tor 0.2.1.22 or 0.2.2.7-alpha now: 'In early January we discovered that two of the seven directory authorities were compromised (moria1 and gabelmoo), along with metrics.torproject.org, a new server we'd recently set up to serve metrics data and graphs. The three servers have since been reinstalled with service migrated to other servers.' Tor users should visit the download page and update ASAP."

Comments

From: Anonymous Coward

[Anonymous Coward]

Anyone else find it so funny that a news story about anonymity is suggested to slashdot by anonymous coward?

I think it's the best form of joke... one with an epic amount of unexpected expectedness.

Takes all types...

[adbge]

Anyone else find it so funny that a news story about anonymity is suggested to slashdot by anonymous coward?

I think it's the best form of joke... one with an epic amount of unexpected expectedness.

If you think that's funny, just think...

Every Anonymous Coward posting about this article will be an Anonymous Coward posting about an Anonymous Coward's anonymity story. A story by an Anonymous Coward for Anonymous Cowards about Anonymous Cowards. Anonymous anonymous anonymous.

Tor weaknesses

[girlintraining]

The problem with Tor is that there's no way to detect compromises -- every node on the network could be compromised and you'd never know. Authors of botnets have greater anonymity than we do -- ironically because it's run by a central authority. An illegal and immoral one, yes, but one that comes with a measure of anonymity. Few botnet authors are actually caught even with the most primitive security methods. They don't even use encryption and they often can't be found...

Re:Tor weaknesses

[v1]

They don't even use encryption and

Oh but they do, and that's the key to the problem. Everyone and their dog knows where the C&C servers are, and can monitor the commands sent out. Problem is, the commands are cryptographically signed, usually with a hideously large key (last one I saw was 2048 BYTES) so you can't subvert their network. Improperly signed commands are merely ignored.

The bot herders get their anonymity from any of a hundred ways to anonymously sign into the IRC C&C channel. I'd speculate that most of them use TOR to do so.

Re:Tor weaknesses

[snowgirl]

The problem with Tor is that there's no way to detect compromises -- every node on the network could be compromised and you'd never know. Authors of botnets have greater anonymity than we do -- ironically because it's run by a central authority. An illegal and immoral one, yes, but one that comes with a measure of anonymity. Few botnet authors are actually caught even with the most primitive security methods. They don't even use encryption and they often can't be found...

There's a lot to be said for hiding in a crowd though. While it is true that every node in the network could be compromised, and we'd never know, collecting all that data together to target you individually becomes more and more difficult the more people use the network... and we're not talking about big-O of n, we're talking at least big-O n squared or so.

As with all forms of security, there's nothing you can do to guarantee security, you simply raise the burden of breaching that security until the opportunity to breach you is not worth the cost to breach you.

Re:Tor weaknesses

[X0563511]

The fun begins when they start noting illegal commands and retaliating. Fun.

Further Details From Roger On or-talk mailing list

[Anonymous Coward]

Roger's entries to date on the subject (excluding first page linked within /. summary):

(this is for those who are too lazy to page through mailing list threads, this post is
missing other individuals replies as well as future replies from Roger and others)

http://archives.seul.org/or/talk/Jan-2010/msg00165.html

Here are some more technical details about the potential impacts, for
those who want to know more about Tor's innards:

----- #1: Directory authority keys

Owning two out of seven directory authorities isn't enough to make a new
networkstatus consensus (you need four for that), but it means you've
only got two more to go. We've generated new v3 long-term identity keys
for these two authorities.

The old v3 long-term identity keys probably aren't compromised, since
they weren't stored on the affected machines, but they signed v3 signing
keys that are valid until 2010-04-12 in the case of moria1 and until
2010-05-04 in the case of gabelmoo. That's still a pretty big window,
so it's best to upgrade clients away from trusting those keys.

You should upgrade to 0.2.1.22 or 0.2.2.7-alpha, which uses the new v3
long-term identity keys (with a new set of signing keys).

----- #2: Relay identity keys

We already have a way to cleanly migrate to a new v3 long-term identity
key, because we needed one for the Debian weak RNG bug:
http://archives.seul.org/or/announce/May-2008/msg00000.html

But we don't have a way to cleanly migrate relay identity keys. An
attacker who knows moria1's relay identity key can craft a new descriptor
for it with a new onion key (or even a new IP address), and then
man-in-the-middle traffic coming to the relay. They wouldn't be able to
spoof directory statements, or break the encryption for further relays
in the path, but it still removes one layer of the defense-in-depth.

Normally there's nothing special about the relay identity key (if you
lose yours, just generate another one), but relay identity keys for
directory authorities are hard-coded in the Tor bundle so the client
can detect man-in-the-middle attacks on bootstrapping.

So we abandoned the old relay identity keys too. That means abandoning
the old IP:port the authorities were listening on, or older clients will
produce warn messages whenever they connect to the new authority. Older
Tor clients can now take longer to bootstrap if they try the abandoned
addresses first. (You should upgrade.)

----- #3: Infrastructure services

Moria also hosted our git repository and svn repository. I took the
services offline as soon as we learned of the breach -- in theory a clever
attacker could give out altered files to people who check out the source,
or even tailor his answers based on who's doing the git update. We're
in pretty good shape for git though: the git tree is a set of hashes
all the way back to the root, so when you update your git tree, it will
automatically notice any tampering.

As explained in the last mail, it appears the attackers didn't realize
what they broke into. We had already been slowly migrating Tor services
off of moria (it runs too many services for too many different projects),
so we took this opportunity to speed up that plan. A friendly anonymous
sponsor has provided a pile of new servers, and git and svn are now up
in their new locations. The only remaining Tor infrastructure services on
moria are the directory authority, the mailing lists, and a DNS secondary.

----- #4: Bridge descriptors

The metrics server had an archive of bridge descriptors from 2009.
We used the descriptors to create summary graphs of bridge count and
bridge usage by country, like the ones you can see at
http://metrics.torproject.

Wait a minute...

[__aaclcg7560]

How do you update a Tor SF paparback book?

US Intelligence almost certainly monitors TOR

[presidenteloco]

I mean. That's where I'd go fishing for people trying to communicate secrets,
if I was them.

Now I don't want to spread paranoia, but
did you know that the patent on Onion Routing was filed by the US Department of the Navy?
Look it up.

Remember kiddies. Always use your own encryption layer.

Re:US Intelligence almost certainly monitors TOR

[wiredlogic]

They probably do more than just monitor. They almost certainly run their own exit nodes so they can log everything flowing through what they pwn.

Re:US Intelligence almost certainly monitors TOR

[BitZtream]

Yes, the government created it, this is well known. They created it so they could securely communicate by bouncing signals off of unsecured ships, like your random cruise ship or an allied warship.

They were involved with its creation, of course the watch it. So do lots of other people.

As a general rule, people hiding their activities DO HAVE SOMETHING TO HIDE. The minority use something like this for legitimate uses. However, our founding fathers had the opinion that until we know you're hiding something bad, you can hide it so no one can come after your for something you do in private that doesn't bother anyone else. This helps to prevent people from having a bad opinion of you, prejudice and hate.

It doesn't however change the fact that it will be used, primarily by people using it to hide illegal activities. It would be retarded if they DIDN'T watch it and as a tax payer I'd be pissed if they didn't.

Reality says that most people have no need to use this sort of protection and that its of very little use to the majority of the people on the planet, even those doing minor illegal activities.

I've talked about plenty of things over the phone, email and hell, even posted on bulletin boards (the real ones, cork board and paper with pushpins) at grocery stores about illegal activities. None of it was anything major of course, minor little crap, all of which were misdemeanors. There are 2 reasons why nothing ever came of it.

A. It was minor crap, no one actually cares about what I did unless I was stupid enough to do it in front of an ON DUTY cop.

B. Hiding in plain site and blending in with the crowd makes you a lot less obviously a target than the person hiding things, regardless of what you are hiding.

So yes, when you make it obvious you're trying to hide something people are going to pay attention to try and figure out what you're hiding, thats being a good detective and what I expect from people who's job is to detect stuff.

Re:US Intelligence almost certainly monitors TOR

[Mr.Bananas]

Have a read at this piece of work: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565 While hiding in plain sight has its value, not being able to hide anything can have plenty of harm to an innocent person, especially if they have no control of how their data is used or interpreted.

Re:Sooo......

[Anonymous Coward]

I spent a bit over a year working with the FBI gathering information on a pedophile ring who was using one of our servers (to coordinate picture trading going on in Asian image board sites). Neither agents' opinions, the content gathered, nor the actual research I've seen, agree with your unsupported assertion that "they are one and the same". Though, two troll paratrooper points for accusing those who disagree with you of naivete. Good show, golf claps all around.

I also don't know to what extent the "pedo" content in actual prepubescent kids, versus underage pubescent ("jailbait"). No, I don't really want to know either. Anyway, ephibophilia is illegal, but arguably medically normal, and ephibophiles and pedophiles make up separate populations.

Re:Sooo......

[xous]

Hi,

How did you collect your statistics when Tor is decentralized? Sure you could analyze the outbound traffic on a exit node but I doubt that this would be enough of a sampling to extrapolate a meaningful conclusion. Since you offer no supporting evidence your claim is irrelevant to the discussion.

I also do not think that the number of child molesters could be large enough to represent a "vast majority" because I doubt the original content producers would distribute a such a high risk material for free. It is much more likely that pedophiles are distributing the material to other pedophiles. I think that it is important to note the difference because while I find either appalling I'd rather have them fapping to "old child pornography" instead of creating a demand for new material and reducing the profit margins of the people that are actually doing these horrible things to children. The lesser of of two evils is still evil but we don't live in a idealistic world.

Unfortunately freedom has it's costs.

Re:Sooo......

[trytoguess]

In short, people attracted to children will rape them? A bit like saying all men will rape women no? But that's not a perfect analogy, you can have sex with a man or woman without too much difficulty, whereas a pedophile can only masturbate. How about, would all slovenly, unattractive, misanthropes, who've zero chance of getting sex resort to rape? I rather doubt it, and even though pedophilia disturbs me, I don't think the sexual drive of that group is somehow stronger than your average male or female.

Re:Sooo......

[Runaway1956]

I don't know where to find good citations - but you can research easily enough.

Download not just TOR, but I2P, freenet, anonnet - search for more if you like. You WILL BE exposed to child porn. No questions asked, you'll be exposed.

It's safe to say that 2/3 to 3/4 of all the sites out there are trash that you don't even want to see. But - there are also some interesting things that are NOT pornography.

You can go explore, or not. It's slow, it's aggravating because all the CP gets in the way, there's not a whole LOT OF good stuff to find, but, go explore all the same. Make sure you read the documentation - you don't want to broadcast your IP across the dark web, with all your personal details. You think the regular internet is bad? LMAO

Re:Further Details From Roger

[inviolet]

As explained in the last mail, it appears the attackers didn't realize what they broke into. We had already been slowly migrating Tor services off of moria (it runs too many services for too many different projects), so we took this opportunity to speed up that plan. A friendly anonymous sponsor has provided a pile of new servers, and git and svn are now up in their new locations.

Mmmm, yes, free.

And you will never, in a million years, detect the compromised hardware in those machines.

The only way for tor (or wikileaks or other dangerous-to-the-authorities service) to buy hardware, is anonymously. If someone wants to donate servers, have them sell the servers and give you the cash.

Re:Snail Mail

[MrNaz]

Dear John & Cynthia.
Thank you for all your support this year, and I wish you all the best for the next.
Yours truly,
John and Sarah.

P.S., Attack at dawn.

Re:Sooo......

[clang_jangle]

But until it's as simple as hitting a button in Firefox to use Tor, of course it's only going to be the enthusiasts and scumbag fringes that'll put the time into researching and securing their privacy online.

Duh!

Re:first

[JWSmythe]

    Technically, it can't be. But since most of the exit points are pretty well known, it's not all that hard. If more people made themselves exit points, rather than just taking advantage of the network, that problem would go away.

    I've tried Slashdot. It's been a matter of switching exit points until you find one that isn't forbidden. Google is really on top of it though. I suspect they may have a tie-in with the network map, so they know the exit points as they come and go.

Re:Sooo......

[trytoguess]

People with sexual urges will eventually create an opportunity act on them, and readily available pornographic content simply encourages them by giving them validation and a sense of moral acceptance.

Hmm... then how about homosexuality? It's not hard to find stories of people who denied attraction to the same sex their whole life in order to avoid being socially stigmatized.

As for the effects of pornography, does masturbating calm your sexual urges, or does it inflame them?

Re:Sooo......

[trytoguess]

This is somewhat tangential, but there is illustrated porn where just about any deviance can be catered to without harming a minor. Actually molesting a child is wrong of course.

Re:Sooo......

[larry bagina]

tor also lets you run an (anonymous) file server.

Re:Further Details From Roger

[VortexCortex]

Wait... Anyone can be a TOR node and it's still secure.

TOR data is very encrypted.

It doesn't matter if the hardware or software is compromised, it's still secure because a TOR node is just one node in a chain of encrypted nodes. You encrypt your data 5 times if you're sending it through 5 nodes.

Each node takes off one layer of encryption and forwards the still encrypted data to the next node. If any intermediate nodes (2 3 4 in our 5 node example) are compromised (in software or hardware), they can not see the message in plain text, or determine the originating IP or destination IP of the traffic.

If the first node is compromised it can see your source IP, but not the destination IP or any part of the message (it's still encrypted.)

If the exit node is compromised it can see the destination IP, and clear text message, but not the source IP.

These multiple layers of encryption mean that if any one node is compromised the system is still very secure.

Taking off a layer of encryption at each router is like peeling an onion... hence, "The Onion Router".

(this is an oversimplified explanaion -- if you're talking compromised code repositories, viruses and trojans are usually not delivered as source code, the tampering would be evident.)

Re:first

[JWSmythe]

    Ideally, everyone that runs a client is an exit node too. But, much like an open AP on your network, when the police come knocking at your door, just saying "But, I was just connected to Tor" isn't going to be much of a defense. It may work in court, but you may be waiting a long time for that day to come.

Re:Tor is going to get people killed.

[Anonymous Coward]

I wish the holier than thous behind the Tor movement would stop with their outrageous and indefensible claims about the protections Tor allegedly provides.

I tried to have this discussion with, among others, people who've made "names for themselves" traveling from conference to conference blustering about how Tor is making the Internet safe for unpopular opinions in places where an unpopular opinion can get you disappeared right quick (hello China)... shouted down every time because it's not a POPULAR point of view.

I see that I'm not the only one in this discussion with concerns. Thank god things are changing.

Whoever these people you have met traveling from conference to conference are not the authors of tor:

# tor --help
Jan 21 22:48:35.191 [notice] Tor v0.2.1.22. This is experimental software. Do not rely on it for strong anonymity. (Running on Linux x86_64)
Copyright (c) 2001-2004, Roger Dingledine
Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson
Copyright (c) 2007-2009, The Tor Project, Inc.

tor -f [args]
See man page for options, or https://www.torproject.org/ for documentation.

Re:Further Details From Roger

[wall0159]

"A friendly anonymous sponsor has provided a pile of new servers, and git and svn are now up
in their new locations"

I read this to mean that tor are hosting git and svn on the new, anonymously-donated servers. I expect that if they were hardware-compromised, that could be used, in turn, to compromise the source-repositories. Please correct me if I'm wrong tho...

Having said all that - I'd also expect a project like tor to be pretty careful with security! Also, it's quite possible that although the servers were anonymously-donated, they may still have been sourced by the tor project - it's hard to imagine a guy in a trench-coat and dark glasses knocking on their door, handing them a server before fading into the shadows, and them welcoming it with open arms!

What was the cause of the breach?

[master_p]

The links are not very informative about what allowed the breach to happen. Was a security model vulnerability? man-in-the-middle attack? buffer overflow?

Re:Sooo......

[Opportunist]

The price of freedom isn't vigilance in this time and age, it's having to deal with unpopular content.

Is tor used by people who want to circumvent laws for whatever reason? Yes. Duh. Basically that's what it was created for. We deem it positive that tor allows dissidents to avoid their laws concerning the freedom of speech, but we don't deem it positive that it also allows the circumvention of our laws. That's very human, but also quite a bit of a double standard.

I hope /. is a bit above the killer arguments of "think of the children" (honestly, if you think of the children all the time, you're prolly a pedo yourself) and we're able to look at it from a bit of a detached position. Because that's what we have to deal with here. Basically swapping child porn in the US is, at least from a purely content point of view, not different from swapping anti-government ideas in China: Both is illegal, and both requires additional security to be done without prosecution. The question is now whether we're willing to accept the existance of the former to enable the latter. You will only get them together. Is the freedom of the Chinese people (and, given the recent development in the west, probably ours soon, too) worth it, knowing that this will also allow communication of pedophiles, terrorists, spies and maybe even worse? Or should we toss both? That's basically the options we have.

And before someone replies with "but tor doesn't allow chinese to discuss freely, isn't secure, etc": This isn't just about tor. That question affects all tools that allow free speech. The question is, is free speech worth dealing with the effects of free speech that you do not want to exist?

Re:first

[NotBornYesterday]

I concluded that most of the traffic on TOR was child pornography and shared music/films.

Please explain how you arrived at this conclusion. Did you actually survey TOR traffic to see what it contained, or are you simply assuming that the only reason most people want anonymity is CP & file sharing? I was under the the impression that TOR encrypted its traffic, except for what entered/exited at the exit nodes.