Slashdot Mirror
Carnegie Mellon Denies FBI Paid For Tor-Breaking Research (wired.com)
New submitter webdesignerdudes writes with news that Carnegie Mellon University now implies it may have been subpoenaed to give up its anonymity-stripping technique, and that it was not paid $1 million by the FBI for doing so. Wired reports: "In a terse statement Wednesday, Carnegie Mellon wrote that its Software Engineering Institute hadn’t received any direct payment for its Tor research from the FBI or any other government funder. But it instead implied that the research may have been accessed by law enforcement through the use of a subpoena. 'In the course of its work, the university from time to time is served with subpoenas requesting information about research it has performed,' the statement reads. 'The university abides by the rule of law, complies with lawfully issued subpoenas and receives no funding for its compliance.'"
...what was the $1 million for? What did the taxpayers get out this?
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
So, when gathering the info, they technically provided free labor to the FBI in doing so, right? Even if it's just pointing them to the correct paperwork.
"Carnegie Mellon wrote that its Software Engineering Institute hadn’t received any direct payment for its Tor research from the FBI or any other government funder."
Now if that word "direct" had not been there I would have a little more faith.
As well know , there are hundreds of ways to indirectly pay for stuff...... "Hey here's some money for your sports team", "hey here's some money for your building funds", etc etc etc etc etc
The FBI first said it was innacurate they had paid 1 million USd. To which we could only conclude that they paid some other amount.
Now this... so Carnegie Mellon did it for free?
"hadn’t received any direct payment for its Tor research from the FBI or any other government funder"...
So they have received indirect payments or have received direct payments from non-government funders.
That's like when the Bush administration found "dozens of weapons of mass destruction related program activities" in Iraq, but no actual WMDs.
Someone got paid without administration getting in on the goods.
No direct payment.
CMU's statement is so full of non-denials and red herrings that a first-year philosophy student wouldn't be fooled.
Assuming it improves the security of projects like Tor and isn't weaponized* in the extreme, we _want_ smart people doing this research.
* If the research is made public, the FBI and others have the same access as everyone else, and given their resources, they're likely to act on e.g. vulnerabilities before they're fixed and eliminated from the wild.
I wonder what other research the government also subpoenas - perhaps that of the aircraft manufacturer who had a nifty idea but whose bid didn't get the job?
I guess they couldn't be bothered to say "no" to the FBI. A "subpoena" does not over-ride intellectual property rights. With all the money Carnegie Mellon has, they might have at least put up a little fight.
But the fact is that this is not the first time that Carnegie Mellon has done work for the government against the public interest.
You are welcome on my lawn.
sh*z is getting to be too much. a silly falacy, a made-up issue.
terrorism works in the new days just as it did in the old days - spy against spy; trying to strike when least unexpected. seems the only thing that's changed is that some countries may know/intelligence an attack against some other country, then decide to -not- let them know, as some sort of b.s. strategic locally-political/economic advantage. (after the fact, pretend you knew nothing, and couldn't possibly have, unless you already had "X-Y-Z" in your lawfully-legal arsenal, which was already being dipped into - but can't be admitted lawfully as evidence in the current "this side of fascist" state of a country...)
the fbi didn't need "carnivores" (as they were so quaintly referred to once) to psych out 9-11; it took a bush to pronounce an intelligence report titled "bin laden to strike within the u.s." as "alright, you covered your ass" to make it plain and simple... the old spy-work works best, and doesn't usually need so much encryption-backdoors to make effective. eyes are being too distracted by the shiny and new, and not paying attention to the old tried-and-true ways that will never fail.
and for that matter, don't get me started on the "ps4's are encrypted" b.s... the nsa's getting really pathetic, and begging the question why they even have a reason to exist in the first place. what the -eff- are you people doing there? if you can't provide any intel better than the effing cia, then maybe we'd better de-budget you, along with every weapons-manufacturer on the payola.
Watch for weasel words...
also "the phones found contained encrypted messages with the content xxxyyyzzz". if it was encrypted, how the fuck did they open up the content.
for the law enforcement folk everything not just regular sms is encrypted.. never mind if it is or not. and there's plenty of reasons why one would not use sms - the high cost of international messaging would be one!
The whole $1 million payment accusation comes from "sources in the information security community". That's a hell of accusation to put out there, damaging a school's reputation, without anyone willing to stand up behind it.
...like a carefully worded statement designed to be strictly factually correct to remove the stink from CMU, but that there is probably mostly truth in the original story. Just the wording of their statement seems so carefully selected that you just know the reality is that they did do it, but not exactly the way they are defending their selves. So they can sound innocent when they probably are not.
"hadn’t received any direct payment"
direct? How about an INdirect payment?
Yes, all they did was merely destroy the trustfulness of the CERT process to warn EVERYONE of vulnerabilities in software, instead of delightedly handing it over to the descendants of J Edgar Hoover and not bothering to tell the software maintainers anything. This is the main point; the million pieces of silver were just added insult.
OK lets accept for not that CMU did not receive payment for their data and that they only gave up their data upon subpoena, it really was just icing to the real issue. That of the un-ethical disclosure of peoples private data resulting in an indirect FBI evidential fishing exercise, which is allowed in discovery unless the evidential collection is prompted (hence the $1) which would render it 'fruit of the poisoned three' and why there is perhaps so much emphasis being placed upon payment.
Remember this, any entity involved in security research or even just a business can be subpoenaed for their data and required by law to not disclose the fact of the request. Further, resisting such requests can lead to extended legal difficulties; just ask Ladar Levison ( https://en.wikipedia.org/wiki/... ).
So what CMU did wrong here (if current evidence is correct) was to collect and keep significant personal information as a result of their 'Research', which is incompatible with what security research is about. If there had been an Ethical Review Board of the ongoing CMU research this should have been noticed and changes made.
Thus, what could CMU have done.
* They could have set up an internal Review Board to review the ethical, legal and other issues of such research {they admit they did not}
*They could have designed the data collection part of their exploit to anonymize data such that connection inferences can be made without disclosing actual IP addresses ( simply make a salted hash of each IP address ) {they did not}.
* They could have limited collection to just what was needed to prove the exploit and then shut it down {they did not}, instead they ran it for over 3 months.
* Upon proving the method they could have immediately followed responsible disclosure and briefed TOR group {they did not}
* If the research was launched initially by an FBI request or similar, they should have taken legal advice and realised that they could not do this ethically or follow the above and thus NOT agreed to do it {Clearly if so, they failed}
So in closing take note, in the current legal and criminal climate DON'T collect and store unnecessary information unless you can prove that you can protect it from disclosure in untargeted extralegal ways, lest you and your establishment end up be in hot water ( see Sony, Ashley Madison, CMU, NSA etc etc)
Seems the Tor Project have a lot to answer for slandering a research institution and making facts up.
Yes, we all think you really are that fucking stupid. You can't read the 10 or so comments just above yours where they detail that the Software Engineering Institute is federally funded, and so quite literally, the research was indirectly funded because it was federally funded.. Heck, that response was like 45 minutes before yours.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Carnegie Mellon wrote that its Software Engineering Institute hadn’t received any direct payment for its Tor research from the FBI or any other government funder.
Ok. So I guess they received indirect payments for doing this?
"Apk doesn't think DNS servers are worth running & believes Microsoft Active Directory can run w/out DNS." - by Coren22 (1625475) on Tuesday October 27, 2015
Where'd I say it? Show us. I say AD needs internal DNS far back as 2007 http://forums.tweaktown.com/wi...
See "To warn users who have ActiveDirectory/AD LAN-WAN setups to NOT use external DNS servers" there on OpenDNS free (I use it) + AD in my security guide.
+ how to migrate hosts across a LAN (admin/scripts not GPO)-> http://slashdot.org/comments.p...
---
I'm RIGHT on admin priv + hosts (WFP/SFP)!
"figured out why privilege escalation's a bad thing?" - by Coren22 on Tuesday September 22, 2015
How else can I programmatically update hosts itself?
---
"it requires elevation to write hosts" - by Coren22 (1625475) on Wednesday September 23, 2015
Hypocrite later admits it!
Even MalwareBytes AntiMalware DEMANDS it or it can't do a job fully like many security tools!
---
"Needing admin privileges every time a program updates is poor design" - by Coren22 (1625475) on Tuesday November 10, 2015
Mine doesn't to get new data to update hosts vs. threats. Only hosts itself updates need it vs. WFP/SFP. Users set it too. It's not programmatic impersonation.
---
"90's tech to fight modern war" - by Coren22 (1625475) on Tuesday November 10, 2015
Ozymandias/Watchmen per a namesake:
"I resolved to apply antiquities teachings" (hosts) "to our world today & began my path to conquest - Conquest not of men but of the evils that beset them: Fossil Fuels (antispyware), Oil (antivir), Nuclear Power (addons) are like a drug & you gentlemen along w/ foreign interests are the pushers"
It works Aryeh Goretsky NOD32/ESET hosts = good security-> http://it.slashdot.org/comment...
Oliver Day (Symantec) too-> http://www.securityfocus.com/c...
MalwareBytes' hpHosts' Admin hosts+recommends APK Hosts File Engine 9.0++ SR-2 32/64-bit-> http://hosts-file.net/?s=Downl...
APK
P.S.=> Con't. in #2/5... apk
"I guess we should avoid your crap, it looks like it is marked as malware. Good luck getting that removed." - by Coren22 (1625475) on Monday November 02, 2015 @03:52PM (#50850445)
62 sources of good repute show + /. users say otherwise:
Proven safe by 57 antivirus programs in its 64-bit model https://www.virustotal.com/en/...
+
Same for the 32-bit model https://www.virustotal.com/en/...
&
Per VirScan its installer too -> http://f.virscan.org/APKHostsF...
---
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news... /.'ers say my work is good too:
"his hosts program is actually pretty good" - by xenotransplant (4179011) on Monday August 10, 2015 @03:34PM (#50287195)
"I like your host file system." - by Karmashock (2415832) on Wednesday September 09, 2015 @03:57PM (#50489401)
"APK is kinda right... I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works." - by bmo (77928) on Thursday October 15, 2015 @11:30AM (#50736071)
"his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources" by alexgieg (948359) on Friday September 25, 2015 @09:57AM (#50596461)
---
You tried using Computer Associates antivirus that I overturned on false positives (1/8 over time) were caught in ACCOUNTING SCANDALS FRAUD http://www.bing.com/search?q=c...
Reputable source (not): They had to sell off their PC security suite too (crap too) LOWERING the 'threat level' on THAT program (not my hosts file engine) TO ZERO!
* YOU ARE WRONG ON EVERY ACCOUNT NOTED!
APK
P.S.=> Con't in part #3/5... apk
"Virus scanners/Adblock software don't need admin priv to update" - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
Neither does my program. AV does to remove threats - Adblock addons = Vastly INFERIOR in abilities + efficiency vs. hosts as I proved & no one proved me wrong to date!
---
"your software does" - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
No, hosts do due to WFP/SFP - Intake update of new hosts data doesn't!
---
"won't reveal your source code" - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
I don't owe you it. I don't give away work to be stolen by others so it's misused like GOOGLE CHROME http://it.slashdot.org/story/1...
---
"What's stopping you from pointing my bank's web site at your private server?" - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
I don't keep a server. Security guru (not - you create no ware for security & your forensics skills = non-existent): Put it in a VM, trace it using process monitor + wireshark to prove it (don't need code)!
---
"the possibility of being caught, which would be pretty hard to catch w/ such a large hosts file, as no one can go through it manually." - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
I place hardcoded fav sites @ top of hosts for speed & reliabilty - you'd spot it easily & bulk of hosts is sorted blocked known bad threats.
---
"What are you going to do when Windows gets rid of the hosts file completely?" - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
Hasn't happened!
---
"They have already taken steps to make it useless in Windows 10." - by Coren22 (1625475) on Tuesday November 10, 2015 @04:14PM (#50904323)
It works there!
Telemetry tracking's killing 10 by itself: Win10 = Win8 = flops - who're you fooling other than yourself?
APK
P.S.=> Con't. in #4/5... apk
Coren22 'eats his words' vs. me 2x yet again:
"introduces risk you are relying on a 3rd party to update a hosts file potentially opening you up to MITM attacks" - by Coren22 (1625475) on Tuesday November 17, 2015
How can my program do it?
Only things it puts in as non-blocking IP addy to hostnames is ones users give it as their favs to speed up @ the TOP of hosts REVERSE DNS VERIFIED!
(For more speed, & reliability + security - in RAM as 1st resolver queried = faster & more secure vs. remote DNS w/ all its security issues in Kaminsky flaw, DNSChanger malware IP stack settings, routers bushwhacked in DNS settings, rogue DNS, Open DNS servers abused by malware. It aids in reliability vs. redirects).
YOU'D SPOT IT INSTANTLY AS THEY ARE @ TOP OF CUSTOM HOSTS & can easily edit anything you want out of it!
(Rest = known bad sites from 10 reputable security community sites for blocking - the MAJORITY of what's in my hosts files!)
---
"maybe one day you can get a score 5 comment" - by Coren22 (1625475) on Tuesday November 17, 2015
See subject & ~ 12 +5 upmods making you "eat your words" vs. me (1st one: You tried using what I post there against me to FAIL):
+5 'modded up' posts by "yours truly" (11):
http://news.slashdot.org/comme...
http://tech.slashdot.org/comme...
http://news.slashdot.org/comme...
http://science.slashdot.org/co...
http://tech.slashdot.org/comme...
http://hardware.slashdot.org/c...
http://news.slashdot.org/comme...
http://news.slashdot.org/comme...
http://hardware.slashdot.org/c...
http://yro.slashdot.org/commen...
http://yro.slashdot.org/commen...
"You believe you are getting the better of me" - by Coren22 (1625475) on Tuesday November 17, 2015
YOU GOT THE BEST OF YOURSELF in tech fails & lies about me. Your immature signatures about me SCREAM you're butthurt! You did it to yourself.
APK
P.S.=> Con't. in #5/5... apk
"defame me saying things he knows aren't true - by Coren22 (1625475) on Wednesday November 04, 2015
Hypocrite You're projecting & your signatures do the rest.
"the feeling of icky his software - by Coren22 (1625475) on Wednesday November 04, 2015
I show /.'ers say differently by quoted testimonials - Show us you've done better: YOU can't!
"maybe someone will think they are true - by Coren22 (1625475) on Wednesday November 04, 2015
Quotes of you = true - & You can't keep your word + projecting what YOU do (AD/DNS lie).
"I don't have time for the Troll APK, and refuse to respond anymore to a post signed APK" - by Coren22 (1625475) on Tuesday November 03, 2015
I protect users speeding them up, helping reliability, & security + anonymity online w/ more ability & efficiency than ANY 1 solution doing more w/ less - do you? No.
"I should change my signature again to rile him up more." - by Coren22 (1625475) on Tuesday November 03, 2015
Childish sigs = all you've got!
"I refuted his assertions - by Coren22 (1625475) on Wednesday November 04, 2015
&
"You claim I have never proved you wrong...a flat out lie." - by Coren22 on Monday November 16, 2015
&
"I proved you wrong on numerous occasions" - by Coren22 on Monday November 16, 2015
Where & on what tech? "Cat got your tongue"??
"written in shitty Delphi, "How to secure Windows" docs I could have written in my sleep when I was 20" - by Coren22 on Monday November 16, 2016
You're 30++ & haven't done either!
Show you've done MORE vs.a small partial list of mine & better, + earlier:
http://slashdot.org/comments.p...
THEN talk vs. TALKING OUT YOUR ASS!
CIS Tool took fixes from me http://slashdot.org/comments.p... which you doubted & my layered security guides got me paid http://pcpitstop.com/news/winn... MILLIONS use.
APK
P.S.=>
"I never admit you were right" - by Coren22 (1625475) on Tuesday November 10, 2015
You PROVED I am... apk
On the word "directly" (that's a 'red flag' in & of itself) & others made points that are important on that note seconding me, along w/ the guy I replied to - put it THIS way: There's a ZILLION & 1++ ways to 'wash money clean'... happens all the time.
By the way: YOU have to STILL "face the music" here -> http://slashdot.org/comments.p... AND HERE -> http://slashdot.org/comments.p...
Where I FINALLY have you cornered & on specifics (only some of what's in your 'greatest hits fails lists' mind you) - so don't YOU, of all people, DARE to call ME 'stupid', stupid... you're already "eating your words" there & you've seen what I am capable of exhausting you, your sockpuppets (MyAlternateID) & fellow trolls of your modpoints... once that happened?
YOU HAD TO FACE UP TO ME DIRECTLY, finally!
APK
P.S.=> That's where you FINALLY got the balls together but failed badly anyhow... do you aspies have trouble reading? Seems it - like you take things way, Way, WAY too literal & don't finish reading things in their entirety (you'll see when you get there & I also posted EXACTLY how I use dns, not internal, but external (OpenDNS in combination with hosts & why))... apk
CMU u got some 'splainin' to do!