Slashdot Mirror
Scientists Detect Two Dozen Computers Trying To Sabotage Tor Privacy Network
New submitter fynbar writes "Computer scientists have identified almost two dozen computers that were actively working to sabotage the Tor privacy network by carrying out attacks that can degrade encrypted connections between end users and the websites or servers they visit (PDF). 'Two of the 25 servers appeared to redirect traffic when end users attempted to visit pornography sites, leading the researchers to suspect they were carrying out censorship regimes required by the countries in which they operated. A third server suffered from what researchers said was a configuration error in the OpenDNS server. The remainder carried out so-called man-in-the-middle (MitM) attacks designed to degrade encrypted Web or SSH traffic to plaintext traffic. The servers did this by using the well-known sslstrip attack designed by researcher Moxie Marlinspike or another common MitM technique that converts unreadable HTTPS traffic into plaintext HTTP.'"
If only 24 "bad" computers can cause that big of an issue then the TOR network clearly has bigger problems.
I'm surprised that there was so few detected doing it.
"... almost two dozen computers that were actively...", "Two of the 25 servers... ".
Oh, they clear that up nicely - "Almost two dozen" is actually 25. Perhaps dozen is like gallon: different sizes in different countries.
We keep hearing about all these SSL/HTTPS issues where a user is accidentally tricked into using HTTP instead. Is there an addon for Firefox/Chrome that will only allow you to make HTTPS connections?
It would be nice if there was a mode like their 'private browsing' modes that you could enter and then only access secured sites.
Every time you see a headline in the form of "Scientists discover new foo" you can pretty much stop reading right there. The author is most likely the sort of person that confuses science with wizardry and isn't very likely to produce an article of any real substance. You could actually just replace every instance of scientist with wizard and impart the same level of information.
Any sufficiently analysed magic is indistinguishable from technology.
Repeated attempts to destroy Tor's image to deter troublesome future widepread-adoption of this privacy tool?
no hymens to fuss about.. fail to shoot each other still..... where did they go astray?
The mention in the article that there are only 1000 exit nodes generally available on TOR is kinda stunning.
That's 20 nodes per US state.
If that is it.... Then what is left of Freedom is in deep trouble.
Slashdot does this automatically, you don't even need to use Tor. Try typing 'https://slashdot.org' in your address bar and see what happens.
Reading TFA (yes, I did) revealed next to nothing. Other than a brief mention of "From Russia with love" and that their IPs were assigned to Russia, I can't glean any useful info on who owns those servers.
Muchas Gracias, Señor Edward Snowden !
.... if we make it, we can break it.
Have anybody ever in here seen anyone using Tor for legal purposes?
The only people who use Tor are ones who have something to hide.
beta.slashdot.org, to improve our web experience and push interactive, rich client technology to the 21st century!
Wanking on useless bling instead of doing the important. Sigh.
Go back to looking at Korean porn, IT guys. There's no suck thing as a computer scientist.
I think you may be the one into the porn given that Freudian slip there...
Even if this were to occur and you are on a bad exit node, wouldn't you still get a warning from the browser about the certificate being bad?
US feds own them, i know cause of the ip addresses its not common knowledge....only a fe wpeople on earth know the full extent of federal us ip range activity
That cant be cracked.
Full end-to-end encryption where the client and the server certificates are signed by the same solves this Tor-endnode problem.
Whenever an roque end node tries to run a sssltrip MitM, it will be detected at the client. And that can be reported to the Tor network.
It's called Eccentric Authentication.
See: http://eccentric-authenticatio...
Isn't it kind of obvious that Tor would be a target to be attacked?
Between government agencies and other shady characters, I should think that as soon as you announce you've got something which provides anonymity, someone would be trying to break it.
Sure, they've identified some specific things, but did anybody actually believe Tor and things like it wouldn't be targets?
Lost at C:>. Found at C.
With regards to the SSL stuff? Should I disable all SSL certs in the browser and then enable only the ones that my https sites ask for? Or is it safe to leave them alone. Or will it break everything if I disable them since I won't know which to turn back on? And what about non-browser ssl traffic? Does the update service use ssl libraries too? Isnt there a separate certs list for ssl programs that are not browsers?
So-called 'security' companies make vast profits selling abusive software systems to regimes and organised criminal gangs across the planet. Their software needs to be tested and proven before sale, so of course systems like Tor will be targeted by every kind of experimental attack. Each time an experiment proves that the software has some 'usefulness' under certain circumstances, this fact can be used to locate and convince buyers.
Part of Snowden's leaks PROVED that every script-kiddie and other form of hacker will gain profitable employment at the NSA if they develop ANY useful method of attack. Snowden listed in detail the extraordinary catalogue of hacking solutions deployed by the NSA- and some person or team had to create each of these. If you think the NSA gets such work done by simply hiring ordinary programmers from Uni, you are far stupider than I assumed the average Slashdot reader to be.
And again, I'll point out that hackers for intelligence operations and hackers for the cyber-crime gangs based in Israel and the Ukraine are from the exact same pool. The cyber-crime gangs exploit the same weaknesses and back-doors that Microsoft codes into all its products for the NSA.
The answer is to EXPECT the obvious forms of attack, and to learn the most troubling (to the NSA) forms of security protocol. Trust no security products from big companies, or specialist commercial security services. Learn how to delete your data properly (ie., overwrite with files of random data indistinguishable to the OS and storage device from 'real' data). Learn how to encrypt your data properly with Truecrypt. Learn what end-point encryption means, and assume any other form of encryption on line is as weak as no encryption.
Things like Tor cannot help but be a trap to those that most need the use of such a service. Human Rights activists that use services like Tor in Middle East dictatorships wholly maintained by the USA, UK and Israel will have their communication fully intercepted by the intelligence agencies of these three nations. As a consequence, activists calling for rights for women and gays- calling for free elections- calling for freedom of conscience- will be raided, tortured, and imprisoned when the NSA/GCHQ hands over complete details about these people to the religious extremist enforcers of Saudi Arabia, the UAE, etc.
Did you know that Britain actually has senior British police personnel, on secondment, operating in the UAE- and that they oversee the raids against activists, and their subsequent torture and conviction in kangaroo courts? The inhumanity of Team Blair and Team Obama has no equal in history.
People have to stop hanging their hopes for privacy on HTTPS/PKI and also a network (Tor) built on the premise of accessing an insecure web.
If there is going to be any real privacy on the Internet going forward, it will have to be based on a new layer like the Invisible Internet Project (I2P). People should start using it now in a P2P fashion -- securing emails, chats, torrents and such -- and in time there is a chance the momentum will attract larger and larger web services, too. Make a habbit of telling people you can be reached at your I2P address (in this sense, it becomes no more onerous than installing an app like Skype).
Its fucking horrible and one of my laptops at home REFUSES to show any version of slashdot except the beta. It redirects classic.slashdot.org to beta.slashdot.org.
I tell you right now, the day that becomes permanent is the day I never fucking visit this site ever again. Please fire those fools and leave the classic slashdot UI alone.
I suggest s/scientist/walrus/g