Slashdot Mirror
Former Tor Developer Created Malware To Hack Tor Users For The FBI (dailydot.com)
Patrick O'Neill writes: Matt Edman is a cybersecurity expert who worked as a part-time employee at Tor Project, the nonprofit that builds Tor software and maintains the network, almost a decade ago. Since then, he's developed potent malware used by law enforcement to unmask Tor users. It's been wielded in multiple investigations by federal law-enforcement and U.S. intelligence agencies in several high-profile cases. The Tor Project has confirmed this report in a statement after being contacted by the Daily Dot, "It has come to out attention that Matt Edman, who worked with the Tor Project until 2009, subsequently was employed by a defense contractor working for the FBI to develop anti-Tor malware." Maybe Tor users will now be less likely to anonymously check Facebook each month...
Yes, please. Anonymous or otherwise, FB needs to be removed as a main gatekeeper for the masses.
The cesspool just got a check and balance.
All your privacy are belong to us - "the" FBI
Acting for your own paycheck instead of thinking about what's best for humanity, Matt? You're a despicable little traitor, Matt. Let's hope you like the surveillance society you contributed to, Matt, and I hope you already know you'll be stalked by the FBI for the rest of your life, Matt.
Even on Slashdot, I'm startled by the people willing to give up anonymity.
When the FBI wanted Apple to unlock the terrorist's phone, people pointed out that encryption wasn't the problem. They said that terrorists evaded detection with burner phones. The response, of course, is to require identification to use a prepaid sim card. It's trading away anonymity to retain privacy.
I'm also disappointed at how many people would like to get rid of anonymous posting. There are people who abuse anonymity, sure, but is it worth giving up anonymity to silence trolls?
Free speech often isn't free. The only kind of speech that needs protection is the kind of speech that offends someone. If nobody is offended, the speech won't be censored and the person speaking won't face retribution. The most threatened type of speech is the kind that benefits most from anonymity.
I wonder if he'd be less likely to continue the work is a hacker collective attacked and destroyed his personal privacy.
> Cornhusker used a Flash application to deliver a user's real Internet Protocol (IP) address to an FBI server outside the Tor network. Cornhusker—so named because the University of Nebraska's nickname is the Cornhuskers—was placed on three servers owned by Nebraska man Aaron McGrath, whose arrest sparked the the larger anti-child-exploitation operation.
So they took control of this guy's servers somehow, and then placed a flash object on all of them. So the only people it would catch are people who proxied their standard browsers via tor or used the tor package ... and installed Flash anyway.
This isn't .. even an exploit really. You could just put a fucking flashed based video player on a .onion and watch the logs.
In the same vein that you have a right to employ secure encryption, the spooks have a duty to decrypt it. There really is a national security interest in this now that every nation on earth is involved in it or interested in being so.
The trick is to constantly remind the folks with the unlimited budgets that they work for us.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Is IF/WHEN you're hired to write either ONLY interfaces OR portions of a ware (as in a subsystem) BUT NOT THE ENTIRE THING...
* "Been there, done that" in my career & I wondered WHY things were done that way during them (& when I asked/complained since knowing the BIG PICTURE helps too? I was told I didn't need to know)...
APK
P.S.=> You build a piece of a larger whole but you never see the ENTIRE 'machine' (ware) @ work OR what it's for... apk
Whoever pays the highest rate wins our (temporary) loyalty. Welcome to society where no one agrees on a set of values.
Tor has always been funded by the CIA/Navy.. It has been infiltrated since day 1
Subject says it all.
This sig intentionally left blank.
And you're just the type of person they want to hire. Someone who believes that the ends justifies the means, just like Stalin, and Hitler, and Mao, and Pol Pot, and so many others... Sure, they were a bit more violent, but they didn't start off with murdering people they don't like in the dark, they started off by convincing people that the ends justified the means.
I stopped reading the daily dot because they started paying Sabu (the anonymous snitch that put Hammond in jail). Did they kick him out? Even with adblockers I don't feel comfortable entering their domain.
It's disgusting to see an article about a traitor in a website that has one in their payroll.
and fucking JUDAS.
The only way this shitstain keeps his head if I meet him is if he convinces me they were going to send his mom and sisters to federal PIMA prison if he didn't comply.
Otherwise, there is a special circle in Hell for moral cripples like this.
Hope those 40 pieces of silver bought you a whole lot of new shiny for your broken ego.
Said the AC.
It little behooves the best of us to comment on the rest of us.
"Yeah, it runs in the family; grandma turned in Anne Frank's family, so my decision was a no-brainer. The law is the law, you know."
https://slashdot.org/submissio... https://github.com/Tox/tox.cha...
First, why would any activity to break Tor cause people to use it less? Is the submitter implying that it is better to keep your mouth shut and cower in a corner? Seems to me he is.
Second, anybody that accesses FB via Tor is already known and identified when they log in because FB knows how they are. Keeping that in mind, the last sentence of the "story" could not be any more stupid, unless the submitter is actively trying to spread fear. Again, I think he is.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
"This isn't .. even an exploit really. You could just put a fucking flashed based video player on a .onion and watch the logs."
It's entirely possible that Matt said the exact same thing to his bosses.
It makes the ethics of what he did a bit less clear to me. He spent years telling people how to be secure on Tor, then spent a few more unmasking those who didn't listen.
No, I think that's actually perfectly valid.
Because if you want to protect your anonymity, you have to take steps to do so. Tor is not a magic bullet, it has known flaws since the beginning (e.g., exit nodes) and doing stupid things will make you readily identifiable.
In fact, too many people are using Tor as a tool improperly - it's like using encryption improperly. You get a false sense of security when in reality you're making yourself plainly visible. Or using HTTPS and storying your passwords in plain text
No, "just use Tor" will not make you magically anonymous, especially if you immediately go and log into Facebook and Amazon and everywhere else. But too many people believe it will and blithely continue using the 'net as if Tor magically anonymizes them.
So demonstrating that people are stupid isn't a crime - in fact it should be published far and wide so people using it know what people can get at.
This isn't .. even an exploit really. You could just put a fucking flashed based video player on a .onion and watch the logs.
Prisons are generally full of people who aren't smart enough to cover their tracks well enough, or not run Flash.
Catching enough low-hanging fruit as a cop makes you look efficient.
--
BMO