Slashdot Mirror
NSA Agents Leak Tor Bugs To Developers
An anonymous reader writes: We've known for a while that NSA specifically targets Tor, because they want to disrupt one of the last remaining communication methods they aren't able to tap or demand access to. However, not everybody at the NSA is on board with this strategy. Tor developer Andrew Lewman says even as flaws in Tor are rooted out by the NSA and British counterpart GCHQ, other agents from the two organizations leak those flaws directly to the developers, so they can be fixed quickly. He said, "You have to think about the type of people who would be able to do this and have the expertise and time to read Tor source code from scratch for hours, for weeks, for months, and find and elucidate these super-subtle bugs or other things that they probably don't get to see in most commercial software." Lewman estimates the Tor Project receives these reports on a monthly basis. He also spoke about how a growing amount of users will affect Tor. He suggests a massive company like Google or Facebook will eventually have to take up the task of making Tor scale up to millions of users.
When the NSA is plugging holes for you...
He suggests a massive company like Google or Facebook will eventually have to take up the task of making Tor scale up to millions of users.
If one of those guys gets their hands on it you can forget about using it to hide anything from the government.
"Google or Facebook will eventually have to take up the task of making Tor scale up to millions of users as they sell the traversing information to the NSA."
Beware of Greeks bearing gifts....
"You have to think about the type of people who would be able to do this and have the expertise and time to read Tor source code from scratch for hours, for weeks, for months, and find and elucidate these super-subtle bugs or other things that they probably don't get to see in most commercial software."
Come on... NSA undoubtedly has highly developed automated tools for identifying flaws source code, or at least rating the probability of a flaw existing within any section of code so that analysts can focus their time on the areas most likely to produce results.
Am I alone in thinking that the NSA doesn't really care about exploiting flaws in TOR but rather is more interested in encouraging its use because they've exploited something else?
"Lack of speed can be overcome. In the worst case by patience." --Znork
While I love and appreciate Tor as a means to remain anonymous online, I work for a company that's the victim of quite a bit of "comment" spam hailing from among other places Tor. The spam ranges from individual businesses promoting themselves for their own benefit under false pretenses, all the way to professional spammers gaming the system (mostly locksmiths). I hope if the Tor network expands the list of exit nodes remains maintained so I can continue to blacklist content from those sources... it's heavy handed but beats swimming in spam.
If you are a Tor programmer, and if there are really NSA/GCHQ insiders who actually help you to correct bugs... For Pete sake, just keep quiet about it!!!
Now, both agencies will have to initiate a mole-hunting operation, and you will lose these valuable insiders!
On the other hand, it may paralyze these agencies for months, maybe even years, while they try to figure out who has been leaking invaluable bug information back to the Tor project.
So it might be a wash. Either way, it also probably means that people inside the Puzzle Palace and the Donut are beginning to realize that enough is enough, so that is also encouraging.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Guess what departments are going to have to redo their lifestyle polygraphs now!
The NSA has two directives that often conflict with each other:
1) Protect communications that are critical to our nation's security. This is mostly military/government comms, but they have a role in securing banking and other civilian networks. An example of what comes from this side of the NSA is SELinux - which is now heavily used by Android to provide additional security against malware.
2) Compromise and monitor the communications of our enemies. These guys overstepping their bounds are what has been routinely making the news lately.
While I can't see an obvious reason for the guys in category 1 to want to strengthen Tor, it's possible. (Potentially on behalf of another agency... Think in terms of Tor's use by Chinese dissidents.)
I'm fairly certain the people in categories 1 and 2 don't get along with each other. While in theory their goals should not conflict (one focuses on our enemies, one focuses on strengthening friendlies), the truth is that it's hard for the guys in category 1 to strengthen friends without also making those tools available to our enemies - and the guys in category 2 are routinely overstepping their bounds and attacking friendlies.
retrorocket.o not found, launch anyway?
Nah this is just Sony Electronics wanting to leverage their entertainment holdings to sell TVs and PLayers with proprietaty formats while Sony Entertainment wants to maximize sales. Or maybe I got it backward. Anyhow lots of diversified companies have internal conflicts. The IBM PC which uses all non-IBM parts was not made by the primary Computer division at IBM. Samsung also has internal competition with conflicting objectives,
Some drink at the fountain of knowledge. Others just gargle.
"Given enough Five Eye-balls, all bugs are shallow!" :-P
Why announce that publicly? The NSA and GCHQ will now attempt to to shut down the leaks and arrest the leakers. Even if they fail, it is certain to scare the leakers and make leaking more difficult.
Why give those agencies clues to help them figure out who are the leakers?
Ceci n'est pas une signature.
I've heard that Tor was initiated by three-letter government agencies in the first place, and that the last thing they want to do is shut it down or ruin the anonymity it gives it's users, because they're using it in their own operations to start with. Compromising it would inevitably lead to their own enemies getting their hands on the exploits, and ultimately on their own operatives, so why wouldn't they have a covert program of improving the overall security of Tor? Now, on the other hand, I wouldn't at all be surprised if a fair number of exit nodes are being operated by three-letter-agency employees -- and for that matter, by enemies of said three-letter-agencies, as well.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Just because you are paranoid doesn't mean they aren't after you...
Doesn't this make peoples PC open and vulnerable to viruses/malware and are they not also one of the bad guys, making me have to pay a yearly fee to my antivirus provider? Can we sue the NSA for part of what we have been paying all theses years for viruses THEY released??
Jack of all trades,master of none
Isn't TOR partially funded by the government? And also used by government agents? It would be really awkward if one of the "let's overthow this government that America doesn't like" movements hidden by TOR traced back to government agents.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Tor was a US Gov project. Yall are idiots.
"Originally sponsored by the U.S. Naval Research Laboratory,[16] which had been instrumental in the early development of onion routing under the aegis of DARPA"
... to make Tor a mainstream app. What percentage of potential users actually use Tor?
It's not in the billions.
If NSA could make Tor viral, how cool would that be?
It little behooves the best of us to comment on the rest of us.
As it stands right now, it is SOP for an admin to block all exit nodes at the incoming router, the IP stack on the machine, the web server, and the application
And there's plenty of reasons to do so. There's a reason that companies have firewalls that block outgoing connections as well as incoming. Or would you rather they allowed traffic from anonymous internet sources to route through their networks?
Home users are a different story, but I don't see why most corps would want to allow TOR. They have enough issues securing their networks as it is (see: UPS breach).
Reed's law that is.
NSA doesn't give a rip. Their job is to get into Tor. If they find out military or CIA secrets it is not a problem because they are on the same side. Ideally, they'd find exploits or put them in and patch it for the military's client only... but their primary goal is to get themselves in, secondary goal is to help the other agencies (so they are not going to publicly give Tor patches... or if they do decide that is more important, do you think they would be public about it? I would think they would purposely leak patches.)
Democracy Now! - uncensored, anti-establishment news
"He suggests a massive company like Google or Facebook will eventually have to take up the task of making Tor scale up to millions of users."
What the hell? Then he doesn't know how Tor works. If a large entity controls a ton of the entry and exit nodes, they can traffic match and identify users. The LAST thing we need is a giant entity ruining it by adding millions of servers.
I don't know, aren't there computer nerds out there who obsess over code? Who would "have the expertise and time to read Tor source code from scratch for hours, for weeks, for months, and find and elucidate these super-subtle bugs or other things that they probably don't get to see in most commercial software"? Umm, probably the same type of nerds who frequent reddit every single night to grammar nazi everyone or perhaps act as moderators (unpaid).
Not that they're necessarily all tech-savvy. My point is that there are obsessive people out there, and it wouldn't surprise me if they knew how to code and acquired fancy software to do so.
Google and Facebook securing Tor is absurd. Google managed to turn a relatively secure OS into a data mining gold mine.
not everyone who works for the NSA is a douchebag.
I'm sure most of them still are, but this is encouraging nonetheless.