Slashdot Mirror
Lizard Squad Targets Tor
mrspoonsi tips news that Lizard Squad, the hacker group who knocked Xbox Live and the PlayStation Network offline on Christmas morning, has now turned its attention to Tor. After tweeting that they were targeting a Tor-related zero-day flaw, the group is now in control of 3,000 exit nodes — almost half of them. "If one group is controlling the majority of the nodes, it could be able to eavesdrop on a substantial number of vulnerable users. Which means Lizard Squad could gain the power to track Tor users if it infiltrates enough of the network."
They set up their botnet as tor nodes. How exactly is that a zero-day flaw?
As reported by /. http://tech.slashdot.org/story...
so i believe they are working on a fix.
It's not a typo if you understood the meaning!
They have just kicked the hornets nest..... people who have the ability to track them down and take their revenge
It must have been happening already for that 'prediction' to be so accurate.
“He’s not deformed, he’s just drunk!”
I haven't seen any explanation of how this is a zero-day exactly; so far, this looks more like a Sybil attack.
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
https://twitter.com/kaepora/st...
https://twitter.com/kaepora/st...
You can see this whole list of tor nodes here: https://torstatus.blutmagie.de...
All Lizard nodes resolve to *.bc.googleusercontent.com
Almost certainly the US Three Letter Agencies as well as foreign intel have known about this flaw - and how to leverage it - for a long time. Clearly, tor is not secure and hasn't been for awhile.
If you want news from today, you have to come back tomorrow.
If someone is able to kick down half the TOR nodes out there, it must be a 0-day, or a combination of 0-days in use. It would be interesting to find out what OS has the bug, and preferably where it lies, so it can be addressed. If it is an issue with the TOR software, that is a completely different bag of worms, and it might be that the source code might need an audit similar to TrueCrypt's to find potential security holes.
If one group is controlling the majority of the nodes, it could be able to eavesdrop on a substantial number of vulnerable users.
I'm willing to bet the NSA has prior art on this.
Only to idiots, are orders laws.
-- Henning von Tresckow
Not the same issue at all. All this is is IdiotSquad starting up a bunch of Google Compute VMs as tor exit nodes.
Your hair look like poop, Bob! - Wanker.
They haven't taken over 3000 Tor relays - they have set up 3000 new relays of their own, thus having control of over 50% of the available relays.
> Clearly, tor is not secure and hasn't been for awhile.
If by "clearly" you mean "innuendo, rumors, and undocumented third-party hearsay" you would be correct.
Not the same issue at all. All this is is IdiotSquad starting up a bunch of Google Compute VMs as tor exit nodes.
True, but if they are able to compromise TOR anonymity it still is an issue.
Making DDoS attacks and deploying relay nodes for Tor. Huh how superchaker they are. Only 3000 bots? The gotta be real losers.
to what ?
Oh, that's right; there's nothing left to switch to, IS THERE?
What the hell is up with slashdot when running through nodes based in France? Combined with the lack of 'new circuit' function it's really goddam annoying.
This is a standard Sybil attack.
Anyone in network security who looked at Tor would immediately have come up with it. Distributed system? Check. Exit nodes chosen essentially randomly? Check. Well duh, introduce n malicious exit nodes such that the probability of a malicious one being selected increases beyond some threshold.
This is seriously one of the first things anyone in security would have thought up. This is the kind of question you'd get on the first page of an exam in network security.
Keep believing your US Government honeypot is "secure". The rest of us will be laughing when you get arrested for browsing your pedo sites.
that the "Lizard Squad" is just the U.S. gov cyber squad. I think they - the U.S. - were responsible for hacking Sony, and conveniently blamed it on North Korea.
... and be done with it. Isn't this what the BadExit flag is for?
I'm tired of hearing about these "anonymous" "hacking" "groups" and their supposed "achievements". I don't care if you get arrested. Prove to me that you're legit.
Buck Feta. You know what to do.
Keep believing your US Government honeypot is "secure". The rest of us will be laughing when you get arrested for browsing your pedo sites.
Considering the type of attack in question, tor can be anyone's honeypot.
That it is "sold" as something like a "darknet" is shameful.
If you want news from today, you have to come back tomorrow.
This is seriously one of the first things anyone in security would have thought up
Ah, the /. 30-second expert. Indeed, the TOR guys did think of that too.
Malicious exit nodes do not per se compromise TOR, though they are in a position to take advantage of some potential exploits (also, exit nodes are irrelevant to .onion servers) It's been known since the start that if an attacker both controlled the exit node and could directly tap your line, there'd be and endless stream of exploits possible - and IIRC the NSA had just such attacks in its arsenal. But that doesn't scale - you have to be actively monitoring a specific target to de-anonimize them, you can't do it to everyone. If the NSA actually got warrants when they did that to Americans [pause for laughter] I think it's a fine system.
TFA seems to be about taking over more than half of all TOR nodes, which can hardly be done in secret, and really makes 0-days in the TOR bundle visible.
Far more worrying, especially for the conspiracy theorist, is the never-ending stream of vulnerabilities in .onion servers allowing the operators to be de-anonymized. It's hard to believe TOR wasn't designed that way. TOR seemed designed from the start as a system to let Chinese dissidents use American servers safely, but not allow Silk Road-style sites (servers illegal in the US) to stay up. That IMO would be pretty cool if the US itself weren't growing ever more repressive.
Socialism: a lie told by totalitarians and believed by fools.
Malicious exit nodes do not per se compromise TOR...
What other obvious use would there be?
I need a car analogy, damn it...
If you want news from today, you have to come back tomorrow.
It was made for them.
Also they found out who was running that drug store.
Malicious exit nodes do not per se compromise TOR...
What other obvious use would there be?
I need a car analogy, damn it...
Ok, Ok, how's this?
What if you were driving down the road, and lost control of your car, and plowed into an onion patch?
How may onions have to be run over for the field to considered compromised?
If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
Each time this group makes the news, the sales of lizard stock art skyrockets. I'm starting to think the whole thing is a PR stunt funded by Getty Images.
Ok, Ok, how's this?
What if you were driving down the road, and lost control of your car, and plowed into an onion patch?
How may onions have to be run over for the field to considered compromised?
Depends on the number of onion plants. If it's around 6000 onion plants, maybe around 3000 or so?
And you better be driving a big 'ol redneck Haus pickup truck with a cow catcher on the bumper.
If you want news from today, you have to come back tomorrow.
"Lizard Squad" has been DOS'ing game servers, twitch.tv, and more for months. Surely the NSA has tracked these idiots down, and the FBI has had more than enough time to parallel construct a plausible investigation that didn't involve getting tipped off by NSA. Right? So why are these morons still sitting around in their parents' houses interfering with millions of regular people who are just trying to play games or browse the web? Big companies are being targeted, lots of money is being lost through the game server outages, why haven't these morons been put under the jail by now? They threw the entire weight of the federal government at Aaron Swartz for downloading a bunch of PDF files and yet the Loser Squad has been DOS'ing many companies for months with impunity? Makes me wonder if NSA et. al. aren't the ones behind the attacks.
You have to be able to control which exit nodes you use.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
No, you missed the analogy. You lost control of your car. The drive by wire accelerator, brake, steering and handbrake don't work.
Just consider yourself lucky you didn't "accidentally" drive into a pole.
the outward node has a public key, the receiving node has the private key, nothing in between gets anything useful.
I mean, why overcomplicate shit?
Hell, for that matter - airgap it.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
that depends, how much tyre rubber needs to be deposited before you can't taste onion anymore?
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Are they the lizardsquad or the lowest hanging fruit squad? If they had skills they'd do something that isn't totally gay.
Having to work for a living is the root of all evil.
Actually the parent appears to be correct- they aren't actually taking over relays. There's a 5 hour old tweet on the torproject's twitter with the following statement:
"This looks like a regular attempt at a Sybil attack: the attackers have signed up
many new relays in hopes of becoming a large fraction of the network.
But even though they are running thousands of new relays, their relays
currently make up less than 1% of the Tor network by capacity. We are
working now to remove these relays from the network before they become
a threat, and we don't expect any anonymity or performance effects based
on what we've seen so far."
You know the senders and receivers. That's what Tor tries to stop.
you have to be actively monitoring a specific target to de-anonimize them, you can't do it to everyone. If the NSA actually got warrants when they did that to Americans [pause for laughter] I think it's a fine system.
You laugh, but at what point in an investigation would you be aware of the target's nationality?
Do you know the nationalities of the Lizard Squad members, for example? When would you, before or after this process?
Am I an American citizen? I can't get a driver's license without something like three forms of proof I live here, so tell me how does this work on the Internet?
Warrants for de-anonimizing Americans on the Internet... explain that paradox.
IP addresses are not people, the Internet has no borders, information wants to be free, etc.
IMO, there are no rights on the Internet UNTIL it has borders.
Tor-users have nothing to fear. Incompetent and/or lazy Tor .onion operators should be worried. Right now there is no idiot-proof solution to easy and secure deployment of Tor .onion servers. There is for end-users. It's called Tails (at least for those fairly competent and reasonably tech savvy).
They haven't taken over 3000 Tor relays - they have set up 3000 new relays of their own, thus having control of over 50% of the available relays.
If you capture over half of the traffic that moves over Tor haven't you for all practical purposes taken control of the network?
dey be haxxin'.
Bunch of bored kids over Christmas break that got fed up with CounterStrike and Call of Duty, so they are wreaking havoc for fun and getting way too much news time for it. I have almost gagged when I have seen a reporter saying on TV with a straight face that "it is not confirmed whether the attackers are linked to North Korea" and that "The attack is not thought to be a terrorist attack". *double facepalm*
I am not sure what is more sad, whether these jerks getting off on griefing others or the mom of one kid who couldn't play XBox over Christmas because of the DDOS and she lamented on camera - "What is he going to do now? He has nothing else to do!" I don't know - like going outside for a while?
Our society is really going downhill :(
They have half of the nodes, but 1-2% of the traffic. They set up a bunch of new nodes, not took over existing nodes. As a result, they have a bunch of nodes that not many people are using. As the issue gets more attention, more of their new nodes are cut out of the loop.
You didn't READ TFA. Typical for a low-ID user I suppose, your brain has rotted away from trying to parse so many fake-article-ads that you discuss an article without even knowing what it contains. They aren't "taking over" anything, they set up 3000 NEW nodes in an attempt to funnel traffic through some of their own exits.
That's not to say that TOR can't be exploited in some way, just about every piece of software more than a few thousand lines long has some sort of security problem in it. Do yourself a favour and actually read some of the articles before you comment on them though, makes you look like less of a fucktard. Well, less of a fucktard than usual, but that's about the best a long time, low ID loser can hope for.
I don't get it. I mean, what would be the point of an anonymous broadcaster if you don't know where to go to authenticate the information? Yes, that'd be a valid use-case IMO, but it falls on its arse when it comes to actually validating stuff.
I have information that *needs* to be out there, but I'm not going to broadcast it and not stand by it, that nullifies its value completely. I will stand by what I say, I will claim right when I piss people off because I will offer what they will not: evidence.
When I'm transmitting information that isn't for general consumption*, I will airgap it and/or I will encrypt it. I won't broadcast it over a fucking anonymiser.
*for measurement of "general consumption" read: stuff the Ears already have I don't particularly care if they know I've got it, they already know I'll fucking use it.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
"low-ID"? WTF are you talking about?
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
They were the the ones that broke Enigma after all...
(Seriously, over 30 minutes timeout event for a crappy one-liner?)