Slashdot Mirror
Black Hat Researchers Actively Trying To Deanonymize Tor Users
An anonymous reader writes: Last week, we discussed news that a presentation had been canceled for the upcoming Black Hat security conference that involved the Tor Project. The researchers involved hadn't made much of an effort to disclose the vulnerability, and the Tor Project was scrambling to implement a fix. Now, the project says it's likely these researchers were actively attacking Tor users and trying to deanonymize them. "On July 4 2014 we found a group of relays that we assume were trying to deanonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks. ...We know the attack looked for users who fetched hidden service descriptors, but the attackers likely were not able to see any application-level traffic (e.g. what pages were loaded or even whether users visited the hidden service they looked up). The attack probably also tried to learn who published hidden service descriptors, which would allow the attackers to learn the location of that hidden service." They also provide a technical description of the attack, and the steps they're taking to block such attacks in the future.
But I have my doubts about about technological fixes to the jackboot/battering-ram/nightstick vulnerability.
I find it kinda funny that TOR is used by many Black Hats is being hacked by Them. TO expose who they are...
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I wonder how feasible it would be to modify tor, or maybe make a tor version 2 protocol so that the onion layers are determined packet by packet, instead of by the stream.
I'm not all that knowledgeable when it comes to the tor protocol, but it sounds like each stream is bounced off a series of relays.. If you could change that to each packet, or split the stream into a few other streams that took different routes (and let the stream get reassembled from packets from multiple streams at the destination), then it seems like you could make this sort of attack a lot harder..
I'm not sure about people trying to discover the location of the tor hidden service, but it seems like it would help protect the client -> server integrity quite a bit..
They can't hang us all like Spartacus. All the telephone poles in Italy are gone.
Fascinating. If they can detect suspicious fraud nodes, TOR could build into their project a blacklist support that they publish and honor in their code. Then it becomes a whack-a-mole issue, which is better han the current situation.
Ummm...what with Russia trying to de-anonymize TOR and all. Bad Rooskies.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Black Hat Researchers Actively Trying to Demonize Tor Users
Then I thought it was perhaps
Black Hat Researchers Actively Trying to Deamonize Tor Users
Before I figured out they meant
De-anonymize
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
TOR clearly needs to be beefed up. Here is what we need in addition:
1.) Multiple routes through the mixnet for each payload connection.
2.) Camouflage Traffic which ensures a constant bitrate visible to attackers. Visible traffic rate should change with a much slower rate than actual payload traffic.
3.) User-configurable number of hops. Better support of more than three hops (this probably requries some sort of buffering because TCP/IP does not like long delays)
And sure as hell it is impossible to develop a mixnet that will generate Camouflage traffic so that the attacker just sees a constant flow of packages ?
Neither is it possible to build carriages not propelled by horses, I guess.
apparently 3 proxies aren't enough, should rather be 7 :-)
I would be more interested in why this was "cancelled". Maybe it never was possible and this whole business of "we have an exploit" is just part of a larger campaign to spread FUD about Tor.
It's because Russia's offering $$$ for a TOR hack...
http://www.themoscowtimes.com/...
on the bright side, TOR will be better in the end because of it.
And the demonizing was being done only by the hat researchers who were black?
I see many naysayers & detractors here querying why black-hats would want to break the very services they rely on, but surely that's exactly what they should be doing?
If you want to rely on a service for your own security, it's in your best interests to find all the weaknesses - especially with open source projects, which rely on the community to find & fix faults.
Well - if they're not *also* doing this, you might argue that they aren't really doing their job.
I suspect that there are *MANY* groups (like over 200) trying to do this. At least one for every country's own intel agencies; and a lot of corporate security groups too.
"We spent several months trying to extract information from the researchers who were going to give the Black Hat talk, and eventually we did get some hints from them about how "relay early" cells could be used for traffic confirmation attacks, which is how we started looking for the attacks in the wild. They haven't answered our emails lately, so we don't know for sure, but it seems likely that the answer to Q1 is "yes"."
Fucking slashdot, can't even be bothered to RTFA to check the headline. It's only suspected, not proven, that black hat researchers did this.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Nothing new to see here...
-=/\- Jizzbug -/\=-
I think the answer lies in figuring out how to increase throughput on bitmessage networks.
RIP TRICERATOPS, YOU NEVER EXISTED