Black Hat Researchers Actively Trying To Deanonymize Tor Users

An anonymous reader writes: Last week, we discussed news that a presentation had been canceled for the upcoming Black Hat security conference that involved the Tor Project. The researchers involved hadn't made much of an effort to disclose the vulnerability, and the Tor Project was scrambling to implement a fix. Now, the project says it's likely these researchers were actively attacking Tor users and trying to deanonymize them. "On July 4 2014 we found a group of relays that we assume were trying to deanonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks. ...We know the attack looked for users who fetched hidden service descriptors, but the attackers likely were not able to see any application-level traffic (e.g. what pages were loaded or even whether users visited the hidden service they looked up). The attack probably also tried to learn who published hidden service descriptors, which would allow the attackers to learn the location of that hidden service." They also provide a technical description of the attack, and the steps they're taking to block such attacks in the future.

Comments

I'd like to believe weakness are temporary...

[i kan reed]

But I have my doubts about about technological fixes to the jackboot/battering-ram/nightstick vulnerability.

Black Hats shoot themselves in the foot.

[jellomizer]

I find it kinda funny that TOR is used by many Black Hats is being hacked by Them. TO expose who they are...

Re:Black Hats shoot themselves in the foot.

[ron_ivi]

Hard to tell who "them" is.

It's being used by, and trying to be hacked by, many groups.

University researchers, governments, MPAA/RIAA, computer security companies, etc.

Seems the project should encourage as many people as possible attempting to hack it -- because that increases the odds that when people finds a hack, at least some of them will report the weakness back to the project.

On the other hand, if the project discourages hacking attempts, only malicious groups will find the hacks.

Re:Black Hats shoot themselves in the foot.

[wile_e_wonka]

If Black Hats don't hack it then the NSA will. But the NSA will quietly keep the vulnerability(ies) to themselves and use them to collect data. Whereas a Black Hat looking to rely on TOR will be best off figuring out its weaknesses in order to make it more effective.

In other words, people who rely on TOR would be completely stupid to not try to hack it to determine its vulnerabilities. The only odd thing about this isn't really odd at all when you think about these hackers are--they're exposing vulnerabilities in a particularly spectacular fashion.

Can we get a hyphen?

[damn_registrars]

The first time I saw the headline I thought it said

Black Hat Researchers Actively Trying to Demonize Tor Users

Then I thought it was perhaps

Black Hat Researchers Actively Trying to Deamonize Tor Users

Before I figured out they meant

De-anonymize