Slashdot Mirror
Wikileaks Was Launched With Intercepts From Tor
The New Yorker is featuring a long and detailed profile of Julian Assange, founder of Wikileaks. From this Wired's Threat Level pulls out one salient detail: that Wikileaks' initial scoop came from documents intercepted from Tor exit routers. The eavesdropping was pulled off by a Wikileaks activist — neither the New Yorker nor Wired knows who or even in what country he or she resides. "The siphoned documents, supposedly stolen by Chinese hackers or spies who were using the Tor network to transmit the data, were the basis for Wikileaks founder Julian Assange's assertion in 2006 that his organization had already 'received over one million documents from 13 countries' before his site was launched ..."
Update: 06/02 06:31 GMT by T : In reaction to the Wired story, and the New Yorker story on which it drew, Andrew Lewman of the Tor Project points to this explanation / reminder of what Tor's software actually does and does not do. Relevant to the claims reported above, it reads in part "We hear from the Wikileaks folks that the premise behind these news articles is actually false -- they didn't bootstrap Wikileaks by monitoring the Tor network. But that's not the point. The point is that users who want to be safe need to be encrypting their traffic, whether they're using Tor or not." This flat denial of the assertion that Wikileaks was bootstrapped with documents sniffed from the Tor network is repeated unambiguously in correspondence from Wikileaks volunteers.
The summary is written as if Tor is suppose to be secure from eavesdropping. It isn't. It's supposed to offer anonymity. There's nothing to indicate that the _source_ of the documents was compromised.
"National Security is the chief cause of national insecurity." - Celine's First Law
Transparency is what the information age is for. It will be interesting to see how political bodies adjust... on one hand, the leaks are damaging, and truly innocuous or routine things can be spun and blown way out of proportion by opposition groups. On the other hand, they now have to behave to higher ethical standards (or at least the appearance of high ethical standards) because virtually anything could become public knowledge.
Heh, there have been rumors this has been a bonanza for the intelligence community. If wikileaks is doing it you can bet every three letter agency in the world has been doing it too.
An Education is the Font of All Liberty
those chinese hackers are good for something.. I'm thinking if we ever catch one though.. we'll sentence them to work in that Foxconn plant making iPhones ...
Personally reading the linked articles made me really, really uncomfortable. Obviously wiki-leaks as a site has its own particular biases and political goals, everyone does, but the way in which they went about gathering this payload fills me with a really agonising ambivalence.
It really strikes to the heart of my feelings about wikileaks itself. Democracies require informed populations and accountability – they’re premised on the fundamental idea that the voting public makes choices based on more than partisan, or self, interest. For the most part, when considered on a population-wide basis, this tends to happen. For every insane extremist there is a balance on the opposite side of the political spectrum leaving those who cluster around the middle to chart a more reasonable course. That being said, moderation is not always the best of all options (only killing half of all people with foreign accents is hardly the ideal resolution to the war on terror) but it’s the best one we have. Wiki gives us a level of information we previously lacked.
However, the fact that they were born out of some ethically questionable actions worries me. It makes me question the source of their information, its reliability, and its purpose to a far greater extent than previously. I am forced to wonder what their goal actually is, and worry that I’ve been naive in believing that they’re interested in mature and reasoned public discourse. Perhaps that’s an over-reaction. Does the idea of Fruit-from-a-poison-tree apply here?
If you want to see how even Wikileaks volunteers don't know how funds are used in their organization read the following link at Cryptome
http://cryptome.org/0001/wikileaks-funds.htm
Cryptome has also published a lot of Wikileaks founder's personal emails in which, like many of us at different points in time in our lives, he speaks of how broke he is. After founding Wikileaks, he told an Australian newspaper Sydney Morning Herald that he did not use a single cent from Wikileaks for funding his personal expenses, but he has substantial private investments. Where did the money come from?
Cryptome has all the inside information about Wikileaks.
I am a supporter of the site thought. Not of the shady founder. Wikileaks good.
Would this be a fundamental flaw of the TOR network? If you don't know who's controlling the exit nodes, then you will never know if the information you send is truly secure.
Tor offers anonymity, not security. Encryption and signing is for security. The two can be combined.
No, this is a fundamental flaw with unencrypted communication, which is exactly what you're doing when you use Tor to access things outside of the Tor network without additional encryption. Either stay inside the network or ensure whatever you're running over it has its own encryption, simple as that. As always, the biggest threat to security is incompetence.
http://www.wired.com/threatlevel/2007/11/swedish-researc/ :)
As people might recall log-in and password information for 1,000 e-mail accounts belonging to foreign embassies where seen in plain text too.
Tor was always one huge honey pot built on the US telco network with all exit nodes collectable to the NSA.
Others are just building their own small data collection services on top.
Another man in the middle data retention story
Domestic spying is now "Benign Information Gathering"
Anybody involved with TOR knows that EXIT nodes are a big potential risk, and not only have there been rumors of official government sponsored (and therefore tapped) exit nodes, but even /. had a story about it a long ass time ago. Recently the TOR guys have been trying to curtail this via a few different methods, but it is nothing new. Regardless, exit node sniffing is a novel way to get information, (for example, allow only .gov or .edu traffic)
"It's ok, I'm completely secure as long as my iron is off"
The DMV has been given extraordinary powers since all these MADD sponsored mandatory DUI sentencing guidelines have begun to be expanded. My friend was arrested for suspicion of DUI in Oregon 2 years ago and was never charged but he still can't get it off his record.
An Education is the Font of All Liberty
Sounds like an excellent way to spread disinformation.....even better than say.....the New York Times.
You know, even as recently as the salad days of my youth, I could have labeled you a troll for writing that about the NYT.
Now, alas, all I can do is nod my head sadly in agreement.
Crumb's Corollary: Never bring a knife to a bun fight.
...for getting around the Great Firewall to d/l porn and access facebook, not for doing anything that needs to be secure.
"I don't care about the Constitution!" --Bill O'Reilly, November 17, 2009
The attempts by large groups to dominate the weak occurred long before capitalism, and will continue should capitalism ever cease to exist. It is simply one model of domination. There are many more in existence.
More precisely, it is not the nodes themselves that are the risk, but the (unencrypted) communication coming from the exit nodes.
While we're at it, your browser SSL encryption is only as secure as the least secure of the certificate authorities that your browser trusts. Any time your browser shows a secure and validated SSL connection it's because someone in your authorities list said it was okay. Just one authority. That's all it takes.
Go look at the list of CAs your browser trusts.
I just checked mine and I see 86 certificates belonging to maybe 30 different organizations. If any single one of those 30 organizations has a compromised certificate, my browser could show a bogus SSL connection as valid. So, I connect to Bank Of America, and the connection appears like a good SSL connection, but that's only because the fake cert in this attack was authorized by some rogue operator at "TÜBTAK UEKAE Kök Sertifika Hizmet Salaycs - Sürüm 3" or whichever of the 30 companies. That's a pretty long chain to deal with for a weakest-link-screws-you scenario.
Maybe some folks here didn't realize that this is how the model works. That's part of the problem.
So I might suggest understanding the difference between an anonymized connection and an encrypted one. Folks should understand how Tor works before using it. Already we have a problem with people using SSL without understanding it.
Anyway, I installed Tor and Torbutton recently and kept running across notices of how Tor works and that I should be aware of how it works to receive the benefits of it.
Here's another way you can protect yourself against bogus SSL certs, by the way: Perspectives. See the demo. There's a Firefox extension.
Perspectives shows you an SSL cert's history. That is, how long that cert has been in use by the host you're SSL connecting to (as seen by a number of other hosts on the net). If the cert changed on you today, that's suspicious. If it changed today and you are the only person seeing that new cert, you might consider not using that connection for sensitive communication.
Probably because my answer was just a different way of saying "so what? just because you read it elsewhere yesterday doesn't make it any less interesting for those who DIDN'T read it elsewhere. Considering the news in question, one day, or even one week, late doesn't make a difference"
I just put it in less words the first time around
"DRM is like the Ford Pinto: it's a smooth ride, right up the point at which it explodes and ruins your day."-C.Doctorow