Half of Tor Sites Compromised, Including TORMail
First time accepted submitter elysiuan writes "The founder of Freedom Hosting has been arrested in Ireland and is awaiting extradition to USA. In a crackdown the FBI claims to be about hunting down pedophiles, half of the onion sites in the TOR network have been compromised, including the e-mail counterpart of TOR deep web, TORmail. The FBI has also embedded a 0-day Javascript attack against Firefox 17 on Freedom Hosting's server. It appears to install a tracking cookie and a payload that phones home to the FBI when the victim resumes non-TOR browsing. Interesting implications for The Silk Road and the value of Bitcoin stemming from this. The attack relies on two extremely unsafe practices when using TOR: Enabled Javascript, and using the same browser for TOR and non-TOR browsing. Any users accessing a Freedom Hosting hosted site since 8/2 with javascript enabled are potentially compromised."
Looks very much like the three letter agencies decided it's time now to start playing hardball.
Computer Intrusion is illegal, and the FBI knows that.
So is spying on someone without a warrant, and given that they can't know who they're spying on, I don't see how they could possibly have obtained a warrant for this action.
I hope the TOR user community sues them. Very roughly. And with extreme prejudice.
The US has gotten way too fucking big for it's britches.
I used to think maybe there was justification for the anti-terrorism attitude that the US has.
I've changed my mind.
My sympathies now lie with those who rise up against these goddamn born-again Nazis in their attempt at world domination.
You go, Al Queda!
I do not fail; I succeed at finding out what does not work.
"Any users accessing a Freedom Hosting hosted site since 8/2 with javascript enabled are potentially compromised."
That would include all the FBI computers used to deliver the poison, then?
Put your Tor client in a Secure Linux VM, so none of your hardware information can be exposed. Go to https://check.torproject.org/ to check if Tor is working, and make sure NoScript or something similar is enabled.
Should have invited the feds to defcon after all. Seems they got bored this weekend.
So the FBI, with no particular target in mind, are using the Tor network as a line of beaters in the bush scaring out any kind of animal and hopefully only shooting the ones they are trying to find. Meanwhile, every animal is scared out of it's normal activities until the beaters have passed.
Yeah, that's not intrusive at all. No privacy compromised for anyone. And all it takes is the FBI actually infecting the Tor network with their own malware. Thank heavens they're the good guys. Oh, wait, the good guys wouldn't intentionally infect computers and networks, would they?
The "I don't like the government monitoring me" part of me objects to this, but the "Find every pedo and kill them slowly" part of me is currently winning out, because lets face it for every legitimate user of TOR, there was about 200 pedo's.
What does 8/2 mean? August 2d or 8th of February?
Kind of ambiguous...
I wonder about the legality of FBI's action here. Ok, I guess they have some kind of search order/wiretap order for "investigating pedophiles" against one specific site, but what about collateral damage? I mean they shut down an email service used by normal people as well. They did track and spy on activities on normal law abiding citizens. Did they effectively break into a big number of law abiding citizen's machines against whom no search or writetap orders were issued?
Or can FBI hack anyone at will without any legal oversight? I don't remember getting the memo where such behaviour from a government agency is legal.
Well I guess we can stop pretending we live in a law-abiding democratic world. It's an oligarchy run by the banks, the rich, lobyists and professional politicans, and scew everyone else...
--Coder
So basically, if you're legally accessing a website while browsing with Tor, making use of legal services in a legal fashion... the FBI will install a wiretap on your computer, without a warrant, in order to monitor all your activities, on the off chance that you might be up to no good. This is rather like walking out into rush hour traffic, pointing at random cars, and saying "Search that car! We know terrorists use cars, so let's start searching them all."
Dear FBI,
Fuck you. That's a terrorist's mentality. You're worse than the lowly pieces of shit you hunt, because we expected you to uphold principles of integrity, honor, and those other words you got plastered on your slimy logo that used to mean something. You are, in fact, worse than a terrorist: You're a corrupt law enforcement organization with a bigger budget than any terrorist organization out there, and you are doing more harm to this country than catching a hundred Bin Ladens could accomplish.
-_- The internet is a global and international community and you need to show some restraint, otherwise you're going to create large amounts of resentment and anger throughout the world. No wait: You already have created this. You are endangering the infrastructure and the people you are oath-bound to protect with your actions. I don't give a flying fuck through a rolling doughnut what authority or law you think gives you the right to act in this fashion... you're a public menace. You're just giving everyone who doesn't like this country piles of ammunition and sympathy from the general public that can be used to attack MY country.
Knock it the fuck off. Now.
#fuckbeta #iamslashdot #dicemustdie
Exit nodes weren't involved in this since it's an attack against hidden services whose traffic by definition remains within the TOR network. It's not really an attack on TOR, it was an attack on the server software Freedom Hosting was running and clueless/idiot TOR users with javascript enabled and other unsafe TOR habits.
Totally agree with you on people thing that TOR is some anonymity panacea is shortsighted.
I'm starting to wish governments would just get it over with and declare a permanent state of emergency. A different arm band for each person's assessed threat level, embedded RFID with skin tattoo for redundancy and mandatory iris, DNA and fingerprint sampling for all citizens. Upgrade traffic cameras with RFID readers and facial recognition software, require RFID and cellular GPS transponders on all automobiles and motorcycles and perform mandatory searches of persons and vehicles for any traffic stop. Nationalizing all ISPs, search engines, telco providers and banks would also be a smart move. Frankly I'm disappointed the government is taking this long. Guess that's democracy for ya.
Buy your next Linux PC at eightvirtues.com
I hadn't heard this - something in the news?
Tor ships their own, modified version of Firefox. I guess that's why it's ancient. The exploit they used doesn't exist in Mozilla's version as that has been patched for it a while ago.
First of all, use Whonix to access Tor, never the same browser you use for any other purpose.
Second, use Firefox with a JonDoFox profile which is not included in Whonix Workstation by default.
Third, go to ip-check.info and run the test on your browser. Everything should be green or yellow at the worst. If you see anything in red, fix it before you go to any questionable site. Finally, make sure you don't have any DNS Leaks in your host OS by running this test also from your regular host browser. Don't use or trust DNS from your ISP.
If you want to be extra-cautious, run the Whonix Gateway after you establish a VPN connection. Choose an offshore provider that has multi-hop technology to avoid traffic analysis. I'm using iVPN who is located in Malta.
You think the Russians and the Chinese, or Pakistanis or Nigerians will play with kid gloves? We are establishing the boundaries for the coming century of conflicts, most of which will take place in the digital realm, paying little heed to national borders or treaties. A dirty war fought with dirty weapons. A game of cat and mouse, where winner takes all, and the loser forfeits their digital secrets wholesale. He who controls the information, controls the world. The US is best placed to take the lead, they cannot give up their technological and logistical edge. It's a battle to ensure the world is safe for democracy and capitalism - in other words, to make the world safe for America. It's a golden time to be a contractor.
We're half way there.
They want to protect the children as much as they chasing terrorist, capture some people that sell/use drugs or catch (not very big) tax evaders, They will use those "wars" to show some results, but their main target is still the US population, the only ones capable to take them out of power.
Yesterday I made a posting on CNN regarding the story about the heightened terrorist threat alert. While it covers a different subject, I could re-write it to fit this situation, but I think the slashdot crowd will get my drift, here is a direct copy\paste:
I do not know who to trust or what to think anymore. If this threat is real or not, I imagine we are intended to suppose that it was the US governments blanket surveillance of the world, including domestic spying that tipped them off. On the other hand, the timing is such (Snowden/Manning) that for all I know they made the whole thing up to better justify government wrongdoing in the eyes of the people. Or perhaps al Qaeda made the whole thing up just to see if they can manipulate the movements of our government by taking advantage of info gathering with a campaign of false intel. I don't know who to trust or what to think anymore, with the exception that I know I don't trust my own government. They have proven themselves manipulative liars.
Brought to you by Carl's Junior.
The Feds are shutting down the last bastions of free speech, have crippled the 2nd amendment by buying up all the ammo, have closed all our embassies in the Islamic parts of the world... it's just a question of time, in my mind, until we once again go to war for the petrodollar.
I don't see how this affects Bitcoin at all. It's not an exploit of Bitcoin. Bitcoin isn't dependent on any onion sites, "Freedom Hosting", or Tor. The Silk Road are not the only users of Bitcoin.
Firefox 17 is Mozilla's Extended Support Release. I believe the 17.0.x branch still gets minor updates. The articles are vague about the zeroday and whether they affect the latest of that line (17.0.7, which is in the Tor Browser Bundle).
It goes without saying that if the US government is so paranoid and afraid that it'll tap your god damn Facebook profile, then it is going to be hell bent on trying to get at Darknets, anonymising services and Tor.
Abuse of power comes as no surprise.
against our "stout" principles. I'm a libertarian leaning type of guy, that said... I abhor child abuse and especially child sexual abuse, it should be an automatic death sentence, so if they got even one fucking child rapist, I somehow find myself turning a blind eye to this obvious subversion of personal rights.
When people who claim to be privacy nuts are such godawfully fucktarded morons to fall for this, I guess we're pretty well doomed on that front.
Do you really believe that everyone using Tor are identical clones? Maybe the fraction of users they got with this method were not self-proclaimed privacy nuts? Maybe these are the same people who fall for Nigeria scams, or vote for "the lesser of two evils" instead of voting for someone who they really like to rule the nation?
c++;
EFF in the White house, ASAP please.
I understand there's a legitimate need to conduct surveillance when justified. But having people from the EFF and/or ACLU running, or at least supervising things will likely act as a filter to prevent further abuses and level the playing field.
Nothing is enough for whom enough is too little - Confucius
I wish I could believe, but given their record, far more likely they are putting up a strawman to outlaw TOR and similar services.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
and clueless/idiot TOR users with javascript enabled and other unsafe TOR habits.
Is what they're telling us, but if you combine the watch-every-packet-in-the-internet features of PRISM with a I-have-the-webservers-logs server attack, you'd think they'd just track all the traffic through all the hops with or without javascript and cookies. The server logs would tell you what the user requested, and the metadata they collect would link the packets through the internet to wherever they're going.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Sure, let them slowly take away everyone's free speech because of 0.1 percent of people looking at rotten.com type of material on the internet.
Crazy libertarian conspiracy talk, Not real.
http://www.snopes.com/politics/guns/ssabullets.asp
Well.. maybe. Or Maybe not. But Definitely not sort of.
Correct. It is more an excuse to clamp down on the general population than anything. You always need a scapegoat.
If the execuse is not pedophiles, it's terrorists, or drug cartels. All of you fucks who chose safety over freedom, enjoy the world you have made.
Who else is stuck using a derivative of Firefox 17 other than Debian users of Iceweasel?
It's the freaking FBI. That's not exactly a secret rogue agency. FBI director Mueller briefs Obama directly. Technically, Clapper is Mulleur's boss, and Obama is Clapper's boss. That's ONE GUY in the chain of command between Obama and the FBI.
I would use Tor only on a netbook with no HD, booting from an internal read-only USB stick off the webcam USB line (I would want no webcam anyway) into a preconfigured Linux (or *BSD just to maximize obscurity). The actual boot partition would be encrypted. A text-mode browser like lynx would deal with javascript and other nonsense thoroughly. I would use it only on public or otherwise free or available networks not connected in any way to me. I would make sure the WiFi card would use a fresh random MAC for every connection. External USB and Ethernet ports would be physically disconnected or glued shut and the case sealed. It would have a switch soldered in to disconnect battery power.
I'm too lazy for that though.
I think it is very hard to believe that TOR mistakenly released a single version of their TOR browser with javascript conveniently activated. I wouldn't be surprised there was a concerted operation with FBI to reduce child porn on the TOR network. Actually, they could be legally coerced into doing exactly that.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
And another thing..... Always remember to disconnect from the internet.
TOR networks will always be compromised by the DENIAL OF REALITY attacks on all its faithful users:
the truth is out there, we are NOT alone!
Stop believing in fairy tales - there is no privacy.
1.) have you also cut the microphone ? (voice identification) / yes freebsd has support for various sondcards
2.) is sendmail running ? (just install a fresh FreeBSD and portscan and be supprised) (exploitable point of intrusion, by zero day)
3.) Hardware unique identifiers, serialnumbers (pci(e) - take a deeper look at your windows control center) , mac addresses .. yes fresh fakeable, but ! the macadress contains vendor information! and needs a reboot most likely after every change
4.) USB-Stick -> serialnumber of sdcards & usb-sticks ?
5.) soldered in to disconnect (that's worse than the controlled selfkill of truecrypt, because your memory contains the data for at least 7 more minutes
(freeze ram forensics)
6.) no hdd bad, flash memory is harder to delete than hdd (and fakes sometimes a delete to speed up)
7.) public networks, triangulation(signal strength) + cctv and zoom in on your face ( have you also turned your phone off ? .. well all 99% others around you haven't bingo!)
We got lots of evidence (more than enough to show probable cause) showing Obama gave orders to large groups within Federal Government in Homeland Security and FBI to lead local/state police on the ground in sweeping out all the Occupy groups in late night raids when nobody would be watching on TV.
It was highly illegal for Obama to give orders to Federal Government personnel to lead local police against those protesters. It's was made legal later after Obama had gone after Occupy protesters.
If only half the systems are infected, then the remainder are just in DENIAL.
If you sail on the ship of fools it doesn't matter how safe and secure you feel - the ocean gets you wet, one way or another.
Actually, these secret courts started in 1978
http://www.ask.com/question/what-is-the-penalty-for-opening-someone-else-mail. 5 Years times, say a billion a day.
FISA allows the executive, under the direction of the president, to apply for a secret search warrant from a confidential court. That's the extent of the "secrecy" there is any evidence of in the judicial branch.
That court, like any other, can approve the warrant requested by the administration. I've seen no evidence, or even any claim other than yours, that the courts in any way direct the executive agencies. Do you have anything, anything at all, to support your novel and extravagant claims? If not, doesn't it make much more sense to focus our energies on the well known and currently very visible fact that the executive is trampling the Constitution?
Wow. That's a whole lot of stupid you've got there. Does that hurt at all?
Wasn't TOR set up and funded by the US gov? Did they change their mind or was it always just a honeypot?
Good thing I use a clean-state VM for darknet surfing...with JS disabled, along with most every other feature beyond regular HTML rendering.
"When information is power, privacy is freedom" - Jah-Wren Ryel
So what happened to assumed innocent and targeted court orders? Just because TOR can be used in bad ways doesn't mean you have to.
If they do this, why not just track every car and what is in it? Mount GPS and cameras in every car.
---- Booth was a patriot ----
I imagine that the major projects (Debian, Fedora) get adequate security review to trust that the binaries actually match the sources; and tat the sources are reviewed by many eyes. For a little known distro like Whonix -- why would you think you can trust that the binary doesn't have backdoors installed by the people who put it together. I find it quite possible that many intel agencies would benefit by putting together their own privacy-tools with backdoors. How can you be confident that this one isn't one. (Personally I'm guessing you're safest using either Debian or Fedora (NOT Ubuntu or RHEL) and configuring it yourself.)
There's a pretty good unwrapping of the payload here, and it's a pretty creative exploit of the javascript interpreter to execute shellcode. Just from a glance at the shellcode, I see a hand-crafted HTTP header so at minimum they're using the OS network stack directly to give the tor-level UUID a public IP coorelation. Beyond that, they could be doing anything since they're already through the sandbox.
1 - You need proof that you were infected
2 - You need proof THEY did it
3 - Do you really want to be on *that* list?
---- Booth was a patriot ----
0-day Javascript attack against Firefox 17? but Firefox 22 is the current version. who uses Tor sites with Javascript enabled anyways? just asking.
http://www.forbes.com/sites/ralphbenko/2013/03/11/1-6-billion-rounds-of-ammo-for-homeland-security-its-time-for-a-national-conversation/
"some of this purchase order is for hollow-point rounds, forbidden by international law for use in war" - too expensive for training and useless around the world.
What most sites do is pick any "purchase order" number and then quote it was ever just that total low amount.
If you add up the US gov contracts to buy over the months, you get ongoing larger numbers until new order details where less public on gov sites.
Domestic spying is now "Benign Information Gathering"
I'm pretty sure the FBI was moved under the Director of National Intelligence in 2004. Has it changed since then? In any event, the point stands - the FBI isn't a secret agency. They report to Obama through one intermediate person.
That sounds like the administration is doing whatever they want with zero interference from the FISA court. So, pretty much the opposite of what of the court controlling the agencies as GP claimed
OK, so why the hell doesn't someone take the five minutes to add some code to Tor that would strip out client-side scripting? It's not that hard; plenty of other secure networks do it (ex. Freenet) so why the hell doesn't Tor? I mean yeah, I get it, they give you ample warnings before you download, but is there any legitimate reason they don't do this or have they just decided they don't want to try to stop this kind of attack?
Or perhaps al Qaeda made the whole thing up just to see if they can manipulate the movements of our government by taking advantage of info gathering with a campaign of false intel.
The thought of a deliberate leak by terrorists to test American reactions crossed my mind too.
It also crossed my mind that it might have been a real terrorist plot with a deliberate leak, but with a built-in understanding that the plot was to be scrubbed or rescheduled if America took any noticeable counter-measures, such as closing an embassy.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Only TOR's modified version of Iceweasel 17 is at risk -- the ESR version in Debian's repo already has the patch.
Still, people using Debian's repos might want to take the time to grab another version from another repository or distro just for peace of mind. From apt-cache policy on my system (Simply Mepis 12, which is close enough to Debian that their repos are compatible):
iceweasel Version table:
22.0 -------- http://ftp.us.debian.org/debian/ experimental/main i386 Packages
19.0.2 -------- ftp://ftp.mepis.com/mepis/ mepis-12.0/main i386 Packages
17.0.7esr ----- http://ftp.us.debian.org/debian/ unstable/main i386 Packages
While I'm happy for the attack against pedo's, this is a warning for people using Tor for more honorable reasons:
The people are mentioning that this requires javascript and the Tor bundled browser are somewhat missing the point. That this might not be admissible evidence is also besides the point. The fact is, potentially anyone on the deep web could use attacks this way to reveal true identities. A zero day could be used that affects other browsers regardless of javascript, or perhaps non browser based exploits (irc clients, email etc).
To be perfectly protected (outside of Tor itself being compromised), use 2 VMs (or two boxes):
One runs linux and the Tor software with 2 network interfaces on seperate networks.
One interface connects to the internet, the other to some non private net.
Enable forwarding.
Use iptables to force all traffic except the Tor executable through the Tor transparent proxy port on the linux machine.
Don't allow access to any services from anywhere - use console to manage it, and don't use it for anything else.
On a second VM, connect it to the non routable interface on the Linux VM and install whatever OS you want (preferably something different).
Set its default route to be the private Linux VM address.
Never ever put any information that can be linked back to your real identity into the VMs.
Never transfer files between the VMs and other machines linked to you.
Now all of the second VMs traffic is transparently sent thru Tor, it has no route outside of Tor, and no ability to control Tor - so even if it is exploited it cannot communicate directly anywhere. The second VM would need to be compromised, then the first also compromised for traffic to be sent raw.
I've probably missed something, but that's the idea. Running Tor on the same machine you want to be anonymous on is just bad.
"Find every pedo and kill them slowly"
Mother nature is killing us all slowly. I figure I've got decades, maybe a century, tops, before she finishes the job.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
No no no, you don't understand. That 100% rate just proves how good and trustworthy the whole secret system is!
This is the most surprising story I've ever read. I'm all about the feds finally growing some balls and using whatever techniques necessary to arrest some scumbags but this could easily be the tip of the iceberg given all the NSA crap going on. If they feel like they can do anything, they will and it's a slippery slope. In this particular case, I'm glad they finally stopped letting those losers hide behind legal BS.
BUT, seriously, who the hell would use TOR on a browser and then use it for non-tor stuff? I didn't know that was even possible given how the tor browser bundle works. This is seriously going to catch like zero people, lol. But A+ for effort. Then again, some pedos are notoriously dumb.
I'm kinda mad that tormail is down though. That was a huge privacy/anti-NSA tool. Obviously they took that down on purpose as "collateral" just so it's gone. That sucks.
Stopping people from sharing photos of the abuse of children no more stops the abuse of children than stopping people from sharing photos of murder would stop murder.
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
We're now in the age of Big Data crime enforcement, where to be abnormal, in the sense of deviating too far from the median/norm is all it takes to be flagged as a suspect. The danger I see in the future is that, in order to avoid being caught in the net of the federal surveillance agencies people will deliberately start acting within the "norm", like visiting the sites online, Facebook/Twitter/G-something for your communication needs, or CNN/Fox/BBC for your "news", or whatever local site is "popular" in your area. To have an opinion will be to choose from an approved list, much like a multiple-choice exam or, worse, like the presidential election.
But this is one reason why I2P is so much better than TOR: There is next-to-zero expectation from I2P sites for you to allow Javascript.
OTOH, Javascript is turned on by default in the TORBrowser.
Any users accessing a Freedom Hosting hosted site since 8/2 with javascript enabled
Is this like an American August 2nd, or a rest-of-the-world 8 February?
And no, I did not RTFA. Worried that the FBI would be tracking everybody who is even interested in this news.
The exploit transmits your identifying information to IP address 65.222.202.54. The information includes a unique tracking number generated by the exploit server, your computer's MAC address, your computer's host name, and any other IP addresses and host names visible on your local network.
This IP address traces back to a Verizon business account just outside Washington D.C., not far from FBI and CIA headquarters. You can see the IP location trace here, complete with a zoomable Google map. However note that the location trace is probably just an approximate location. Zooming all the way in shows a local shopping center, but that's probably just the location randomly landing at the "center" of a town or other service area.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Cool, they also chose the proper posture for the eagle.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
I think there is a practical difference between a 2-party system and a n-party system where n > 2. It's not what you think, though, and I'm not sure which one is really better in practice.
At least from my observations, a two-party system produces heavy polarization. Nowhere have I seen such a polarization as the one in US between Democrats and Republicans. Everyone is sure that their POV is the good one and cannot comprehend how someone can possibly support the other party. As you say, you can choose your flavor of police state.
A system of three roughly equally big parties, however, seems to emphasize consensus. As none of the three parties can hope to form a government alone, they will need to secure the cooperation of at least one of the two other. None of them can afford to become the lone different party, because that would just result always in the other two parties forming a government (unless the winning party manages to persuade enough smaller parties to join a coalition government with the two other parties left out). The result is that you have three basically identical parties that are more or less only differentiated by how they market themselves. Of course there are politicians in the parties that would like to be different, but in order to secure a government with another of the parties, you will need to make concessions, which usually excludes the points of view that are unique to one party.
So, the end result is that you can choose from three flavors which are not really that different. Not that consensus policymaking would necessarily be bad - it's not.
In my country a fourth big party has recently emerged. It will be interesting to see how this affects the dynamics as we've only seen something like two elections where this was the case.
Of course it also depends on the system used in elections. I think the US-style "winner takes it all" system basically forces only two big parties to emerge.
Still, as someone who lives in a country with more than two big parties, I don't think I'd ever want to see a government effectively controlled by only a single party, not for any period of time.
There is no war on terror. It's all just media propaganda. There has not been a single major terrorist attack the last 100 years which was not a false-flag attack. If you still haven't figured out that 9/11 was an inside job then consider this: There's hundreds of videos and pictures who clearly show massive steel beams being thrown up and away during the _demolition_ of WTC 1 and 2. The official story is that gravity made these buildings come down. Gravity does not make things fall up. Try dropping something and check it out for yourself. You're in a fascist dictatorship with an illusion of freedom, just like everyone else within the NATO alliance.
9/11: Never forget it was a false-flag operation
This is already the case. If you write something which goes against government propaganda in Norway (and other NATO countries) then the government tortures you. It's already dangerous to have opinions different from the government approved list. I know a lot of people here will violently oppose this truth, but deal with it: we have to truthfully asses the current situation in order to improve it, and improvement really is needed. Free speech is a nice theory that I would like to see become practice.
9/11: Never forget it was a false-flag operation
Is this related to Outsourcing to CHINDIA?
Casteism
Scared idiots bought up all the ammo. See any gun show for example.
> you can check Wikipedia etc. for confirmation
... until the Intelligence Reform and Terrorism Prevention Act of 2004 was enacted in response to the September 11 attacks. Since then, the director reports to the Director of National Intelligence, who in turn reports to the President.
Wikipedia says you're wrong, I'm right. Quoting Wikipedia:
You might be right, but the source you mentioned says I'm right.
The Tor Browser Bundle for Linux has FF spoofing its user-agent as "Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0", for some reason. So the script will run on Linux and try to download the attack even if the attack might not succeed.
Liberty in your lifetime
I sometimes wonder about these "security" or "privacy" based distributions.
Maybe it's just the paranoid in me, but wouldn't they be an easy target for honeypots? Also, how do they get updates, etc.