Slashdot Mirror

← Back to Stories (view on slashdot.org)

New 'Hardened' Tor Browser Protects Users From FBI Hacking (vice.com)

Posted by EditorDavid on from the communicating-anonymously dept.

An anonymous reader quotes an article from Motherboard: According to a new paper, security researchers are now working closely with the Tor Project to create a "hardened" version of the Tor Browser, implementing new anti-hacking techniques which could dramatically improve the anonymity of users and further frustrate the efforts of law enforcement...

"Our solution significantly improves security over standard address space layout randomization (ASLR) techniques currently used by Firefox and other mainstream browsers," the researchers write in their paper, whose findings will be presented in July at the Privacy Enhancing Technologies Symposium in Darmstadt, Germany.
The researchers say Tor is currently field-testing their solution for an upcoming "hardened" release, making it harder for agencies like the FBI to crack the browser's security, according to Motherboard. "[W]hile that defensive advantage may not last for too long, it shows that some in the academic research community are still intent on patching the holes that their peers are helping government hackers exploit."

9 of 103 comments (clear)

  1. Government vs. Government by mi · · Score: 4, Insightful

    it shows that some in the academic research community are still intent on patching the holes that their peers are helping government hackers exploit.

    So, to recap, the government-paid researchers are fighting the efforts of government-paid hackers to make the tool, that the government paid to create as a secure one, less so.

    Whichever side wins, we, the taxpayers lose...

    --
    In Soviet Washington the swamp drains you.
    1. Re:Government vs. Government by Sarten-X · · Score: 4, Interesting

      Yeah, that pretty much sums it up.

      Why, is that a problem?

      See, these government guys are different from those government guys, who have an entirely different agenda from that government branch, because it's really coming from the authority of this government office, rather than that government office, and has an entirely different chain of command with entirely different officials from an entirely different Congressional committee.

      Nobody wakes up in the morning and says "Today, I'm going to oppress my fellow citizens and make their lives worse!". Instead, all the government employees work toward the common goal of "advance America's interests", according to their specific areas of expertise. One group says build a thing because it helps America, and another group says to break it because it helps America's enemies.

      Apart from paranoia, there is no reason to believe that either side isn't doing their best. If you trust that the Tor researchers (stemming from DARPA and the U.S. Navy) could possibly create a secure network, and trust that the Tor project could possibly create a secure browser, then you can trust that this browser is secure. That the government who funded it is now also trying to break it has little effect on how trustworthy the software itself actually is.

      --
      You do not have a moral or legal right to do absolutely anything you want.
  2. Billion-dollar holes... by SeattleLawGuy · · Score: 5, Interesting

    it shows that some in the academic research community are still intent on patching the holes that their peers are helping government hackers exploit.

    So, to recap, the government-paid researchers are fighting the efforts of government-paid hackers to make the tool, that the government paid to create as a secure one, less so.

    Whichever side wins, we, the taxpayers lose...

    You have multiple countries with teams of very smart people working to crack everything crackable that protects privacy--because what allows private communication necessarily allows evasion of monitoring.

    Of course, there are a lot of kinds of monitoring. Most obvious categories include:

    1. Good purposes (attacking and/or defending against terrorists/child pornographers/organized crime/repressive regimes; tracking and blocking malware and other electronic attacks; etc...).
    2. Middle-ground purposes (arguably ends-justify-the-means-behavior like violating some civil liberties while hunting white-collar criminals, child support nonpayment grey market income, doing propaganda against people in group #1).
    3. Bad purposes (hunting political opposition, tracking and classifying people based on their political opinions or other things that should be prevented by freedom of speech, finding dirt for blackmail, gathering evidence of and prosecuting someone for common civil ordinance violations and petty crimes in a way which chills and stifles free speech and gives the monitoring agency unfettered power, etc...)

    --
    Real lawyers write in C++
    1. Re:Billion-dollar holes... by axewolf · · Score: 5, Insightful

      GOOD
      BAD
      Does it ever get tiring cramming reality down to 0s and 1s?

      Your simplistic morality is an intellectual torture device.

      ALL MONITORING IS AGAINST YOUR INTEREST
      Fight for your interest. Stop apologizing for societal problems caused by other people by sacrificing your rights. The solution to "terrorism", child porn, etc etc etc is not more crime that is just as a grave of an offense against natural law.

      What you have is a government that assumes you will never amount to shit, and that you SHOULD never amount to shit, so you don't deserve any rights and should be forced to help in any way with whoever's interest the government happens to be serving that day. What if that person's interests directly compete with yours? The fact is that this is ALWAYS the case.

      It's always for the little man to bear the burden of morality. Doesn't that clue you in to the nature of it?

  3. Re:Better idea by gweihir · · Score: 5, Insightful

    Which law? There are a bout 150 different versions and the FBI will hack anybody (which is criminal in almost all countries for them to do). So, you are right, if the FBI stopped breaking the law, this problem would go away.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  4. Protects against hacking by zedaroca · · Score: 5, Insightful

    The new version will protect against hacking, not from FBI hacking. The research with the hack the FBI used was published, so other people could use the same method. So basically this update protects people from a known vulnerability. This kind of reporting does more harm than inform, as it gives the impression that the main purpose of TOR is to commit crimes.

    1. Re:Protects against hacking by NotInHere · · Score: 4, Interesting

      Well yeah I agree with you that the impression that TOR is mainly used to commit crimes is bad, but the paper has mentioned the FBI hacking in its introduction.

      The technique they use is in fact per-function ASLR, and probably the places it can be used are as vast as for ASLR. Its not just limited to TBB or Firefox.

      It'll surely severely limit the ability of doing ROP (return oriented programming), a very popular exploit technique.

  5. Re: This only helps terrorists and criminals by nehumanuscrede · · Score: 4, Insightful

    Bad news.

    In this day and age, " The Government " IS the threat.

    We the people aren't sending drones over to kill folks.

    We're not spearheading the "War on Drugs".

    We're not doing regime changes, implementing no fly lists, spying on anyone and everything and doing our damdest to undo The Constitution.

    We don't lock people up in a prison with no means to even challenge their accusers. Nor do we outsource torture to get around local laws.

    We're not trying to force our will on any other people or governments.

    The Government, on the other hand, is guilty of every single statement above and a whole lot more I don't need to type. Not to mention the crap we don't even know about

    So, yeah, if there is anything to be wary of, it's the Government

  6. Re: Better idea by Nunya666 · · Score: 4, Insightful

    Generalizing, if you haven't done anything wrong then you have no need to fear constant surveillance.

    Just being accused of doing something wrong can be enough to fuck up your life forever. You could be stuck in jail until your court date, and then go bankrupt because of the attorney's fees.