Slashdot Mirror
FBI Is Classifying Its Tor Browser Exploit Because 'National Security' (vice.com)
Joseph Cox, reporting for Motherboard:Defense teams across the US have been trying to get access to a piece of malware the FBI used to hack visitors of a child pornography site. None have been successful at obtaining all of the malware's code, and the government appears to have no intention of handing it over. Now, the FBI is classifying the Tor Browser exploit for reasons of national security, despite the exploit already being used in normal criminal investigations well over a year ago. Experts say it indicates a lack of organization or technical capabilities within the FBI. "The FBI has derivatively classified portions of the tool, the exploits used in connection with the tool, and some of the operational aspects of the tool in accordance with the FBI's National Security Information Classification Guide," government attorneys wrote in a filing earlier this month. It came in response to the defense of Gerald Andrew Darby, who is charged with child pornography offenses.
This a JS exploit, not a Tor problem. It really doesn't matter what this exploit does or how it works. If you have JS enabled in Tor, you're already pwn3d.
Funded originally be DARPA, as I recall. Because how could you not trust DARPA?
Please do not read this sig. Thank you.
The CIA classified my grocery list. Never mind that the information on the grocery list came from the weekly flyer that came in the mail. Never mind that the neighbors up and down the street may have a similar grocery list. Never mind that the CIA has no business classifying my grocery list in the first place.
Isn't national security the reason for classification in the first place?
....It's a laughably silly exploit that anyone can do and they paid 10 million dollars to get.
Do they fear that someone might use the exploit against themselves?
Nonsense. They fear that it will be fixed. All exploits are fixable.
They deny the right of the browser developers to fix it.
I was LinuxFest Northwest earlier this year and had in interesting conversation with a lawyer from ACLU of Washington who gave a talk on cryptography and fearmongering. It was interesting because he advocated a position that the law should compel the government to publicly reveal any exploit gained or utilized by the government. I pointed out that this would be difficult to support for many people who believe in strong national defense (and foreign intelligence as a key aspect of that). The suggestion I made was to moderate his position as follows: if an exploit is developed (or purchased) by the US government for foreign intelligence purposes, then the government can decide to withhold the exploit on national security grounds, but as soon as it is employed for any domestic law enforcement purpose (surveillance, intelligence gathering, criminal investigation/prosecution) then the release would be compelled.
I think the idea has possibilities, but after the slew of stories I've seen here on /. and in other media about our rights constantly and quickly being eroded in more fundamental ways, I'm wondering if efforts are best focused elsewhere.
Mis-use of classification is a Federal felony crime.
Does that mean that if I independently discover said exploit and report it via accepted responsible disclosure mechanisms that I none-the-less commit a felony?
J.Edgar Hoover is alive and well. Why stop here? Who needs evidence anymore? For fucks sake just plant what you need and come in guns blazing. But yet police officers can have relationships with high school students and prosecutors turn a blind eye. What scum.
I doubt they came up with it themselves, they probably bought it from someone that does not have a security clearance and in that case it should not be classifiable.
18 U.S. Code  798 - Disclosure of classified information: ...
(a) Whoever knowingly and willfully communicates
prejudicial to the safety or interest of the United States or for the benefit of any foreign government to the detriment of the United States any classified informationâ"
(1) concerning the nature, preparation, or use of any code, cipher, or cryptographic system of the United States or any foreign government;
You would have to know that it is a government secret.
Note nothing it in the statute says that removing the classification label makes it okay. If you know it is secret and you willfully communicate it to an authorized person, that's a felony.
I'd say not revealing the exploit hurts national security because that's just one more unpatched vulnerability which can be exploited to hack US citizens/companies/agencies. Does the FBI really think they're the only ones who know of the exploit?
national security: you can use that reason to justify just about anything. there seems to be no limit, including ignoring/undermining the constitution in the name of national security. Of course B.J. Franklin said it best.
"Imagination is more important than knowledge" - Einstein
The NIT should not be used in civilian criminal court if the government wishes to protect it under a national security designation. Many decades ago in Butte County California, information from a U2 spy photo was used to secure a search warrant for a back yard marijuana grow operation. The government refused to provide the U2 photo for a probable cause hearing--case dismissed. I believe attorney Jerry Kenkel from Latimer & Kenkel, Chico California handled the case. The first and only known use of a U2 spy photo in an American civilian court. Beside the disturbing unanswered questions concerning U2 spy photos of American's back yards and subsequent analysis, if the government wishes to protect the NIT under a national security designation they need to reserve such spy technology for nation state spying and keep it out of civilian courts.
One can guarantee if anyone attempts to secure or harden TOR or any other onion product enough to ensue the TLAs can't gain access they will be visited by some "Men in Black" with some NSLs to hand out. Never to be seen again! The TOR site need to have a Warrant canary "https://en.wikipedia.org/wiki/Warrant_canary" specific to this situation, unless they already have been issued NSL or other mandates, then all bets are off, probably the latter! It's a shame the Gov. thinks it's the boss, the people are the boss, the constitution clearly says so! This is not for our own good, it's for the Gov. spying operations, and we already have way too much of that!
The FBI have more moles and holes than all of the cheese in Switzerland. Never trust their press, never trust them face to face. Never trust what you hear of them. They are a multi-national spy agency.
http://thenextweb.com/insider/2016/01/28/how-the-fbi-became-the-worlds-largest-distributor-of-child-sex-abuse-imagery/
That explains that.
Tor is a potentially very large honeypot itself if you don't change your PC clock and/or time zone. Also, every version of Tails after 1.4.1 is exploitable by the CIA.
This is only part of that story.
https://www.techdirt.com/articles/20140124/10564825981/nsa-interception-action-tor-developers-computer-gets-mysteriously-re-routed-to-virginia.shtml
One safe copy of Tails exists unless somebody uploads a torrent with the same SHA as this one. The rest are compromised.
https://kat.cr/tails-1-4-1-i386-iso-multilang-tntvillage-t10922671.html
See this: http://i.imgur.com/QLGyQYf.jpg
CHANGE YOUR PC CLOCK NO MATTER WHAT YOU ARE USING TO INACCURATE EVERYTHING WHILE REGULAR SURFING
IT DESTROYS THE CIA/FBI METHOD OF TRACKING VIA TIME LOGGING @ GOOGLE
MOD THIS UP TO +2 TO GET IT SCRAPED BY GOOGLE, IF YOU EVEN CAN.
I know the US Government computers and websites have already been hacked but they think they are gods... Well for gods it was funny that in Ottawa, Ontario the US embassy tried to tap the local cell phone of all the visiting diplomats to Parliament hill but they were caught and the cell phone sniffers they used were blocks to not to interfere with the cell phone in the Elgin Hotel
Thanks for that.