Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers breach FSB contractor, expose Tor deanonymization project

zdnet.com

Post reply on HN
Print view View original

81–90 of 123 posts

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#81

Post by Mirioron »

jorblumesea wrote: post #50
vbezhenar wrote: post #37

Earlier quoted context omitted.

Running Tor exit node is dangerous. Very few people would dare to do so. Most of hosters will forbid that. Now running ordinary Tor node is not dangerous. It does not consume a lot of resources (I'm running node on 256 MB OpenBSD VPS) and hosters don't care at all. It takes few minutes to install and set it up. So there's absolutely no reason for people not to run Tor node on every server they have access to. And I'm…

Govts have almost unlimited resources and willpower. They could easily just detect the tor nodes running, then spin up n /2 + 1 to compensate, giving them majority control. This could be automated.

And if two governments do this at the same time?

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#82

Post by notafraudster »

burtonator wrote: post #63
stordoff wrote: post #59

Earlier quoted context omitted.

As I understand it, part of the risk is proving that you didn't perform the illegal act, and that an investigation itself can be damaging (loss of equipment/public reporting that you are being investigated for being involved in illegal behaviour). If you maintain a strict separation between your traffic/equipment and the exit node, this may be less of a risk, but is subject to the laws of your jurisdiction. > In the…

> that an investigation itself can be damaging This is the main part. It's extrajudicial punishment. TONS of governments engage in this behavior. This is why MJ as illegal for so long. It allowed the US to imprison 1M more minorities since the 80s.

I agree with the principle of your point re: marijuana in specific -- it was often used as a way to stack charges, and especially in a racialized way.

But I'm not sure it applies here. Clearly if the US is investigating a serious computer crime that came from your server, they can't take it on your say-so that it actually came from somewhere else. They need to be able to investigate. And typically for forensic reasons that's going to involve an infrastructure seizure.

Now, the failure to return infrastructure over a long period of time is more extrajudicial punishment, and they do that too sometimes. Lots of people haven't gotten laptops back for years via this.

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#83

Post by ineedasername »

thatfunkymunki wrote: post #80
ineedasername wrote: post #79

hacked into SyTech's Active Directory Sure, why not? Active Directory doesn't really scream top-secret security to me. Maybe someone with more knowledge can chime in here: Is AD really considered best of breed for what it offers, esp. in terms of security? Or am I not giving it enough credit?

Is there any better solution for large scale AAA than Kerberos/AD? I think it does the job pretty decently for the large problem that it encompasses.

Maybe I'm just judging too much from personal experience working under a system that may be poorly implemented.

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#84

Post by ermir »

dontbenebby wrote: post #52
theamk wrote: post #45

Earlier quoted context omitted.

Correlation attacks are attacing anonymity. If you are an embassy, there is no need for anonymity. Ok, an embassy connected to vpn.whitehouse.gov and sent 20 gb of data, so what? (unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either)

>unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either But is an embassy always only "phoning home"?

Yes, it's good practice for an embassy to use a VPN to their home country for 100% of incoming and outgoing traffic (at least that's how I would do it).

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#85

Post by walshemj »

creato wrote: post #70
Santosh83 wrote: post #11

Nobody with an ounce of intelligence can believe for one moment that the most powerful intelligence agencies in the most powerful country of the world will stand idly by and watch a protocol/network be completely opaque for them. Whether there is evidence or not (in such cases there may never be enough evidence), it is safe to assume that many if not most Tor exit nodes are govt run (various govts), and one or more o…

I was pretty confused, because the title mentions "FSB", but all of this discussion in this thread is about the US. I literally assumed that FSB must be an acronym for some US intelligence agency I don't know of. Then I went and read the article, and it really is about the Russian FSB.

You would have to avoided a lot of media and news not to know what the FSB is

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#86

Post by deathanatos »

theamk wrote: post #45
dontbenebby wrote: post #43

Earlier quoted context omitted.

So you're claiming that using a VPN makes correlation attacks impossible? Do you have any sources on this? I'd love to read up to better understand your thinking.

Correlation attacks are attacing anonymity. If you are an embassy, there is no need for anonymity. Ok, an embassy connected to vpn.whitehouse.gov and sent 20 gb of data, so what? (unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either)

I feel like if I were a network operator for something that sensitive I might send some bursts of traffic to nothing just to keep anyone trying to infer "lots of traffic" → "something going on" on their toes.

(Though certainly things like packet timing, packet size, etc. might make more thorough analyses harder to escape…)

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#87

Post by toxik »

dclusin wrote: post #31
onetimemanytime wrote: post #15

Earlier quoted context omitted.

How do various embassies contact the mothership? I heard that a lot of them use TOR, and for smaller countries it makes sense. Big countries I suppose have their brew (which is not necessarily safer.)

One time pads[1] are an effective and cheap measure. Certain privileged diplomatic luggage (not exactly sure of the protocols) cannot be searched by the host country. You can bring them to your embassies on a regular basis. 1 - https://en.wikipedia.org/wiki/One-time_pad

Or just set up an OTP then use the OTP to send new OTPs securely, boom.

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#88

Post by devxvda »

Mirioron wrote: post #81
jorblumesea wrote: post #50

Earlier quoted context omitted.

Govts have almost unlimited resources and willpower. They could easily just detect the tor nodes running, then spin up n /2 + 1 to compensate, giving them majority control. This could be automated.

And if two governments do this at the same time?

Then you have 2(n/2+1) = n+2 servers. QED.

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#89

Post by theamk »

dontbenebby wrote: post #52
theamk wrote: post #45

Earlier quoted context omitted.

Correlation attacks are attacing anonymity. If you are an embassy, there is no need for anonymity. Ok, an embassy connected to vpn.whitehouse.gov and sent 20 gb of data, so what? (unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either)

>unless you are thinking about high level things, like "lots of traffic" -> "something going on", but tor won't help with that either But is an embassy always only "phoning home"?

Yes, if you are an embassy, you can be pretty sure that the host country is watching all of your traffic very carefully. Having all the traffic go via VPN is just sanity.

(and for really secure stuff you will want a channel with constant rate, constant size packets, as others said)

Re: Hackers breach FSB contractor, expose Tor deanonymization project

#90

Post by theamk »

toxik wrote: post #87
dclusin wrote: post #31

Earlier quoted context omitted.

One time pads[1] are an effective and cheap measure. Certain privileged diplomatic luggage (not exactly sure of the protocols) cannot be searched by the host country. You can bring them to your embassies on a regular basis. 1 - https://en.wikipedia.org/wiki/One-time_pad

Or just set up an OTP then use the OTP to send new OTPs securely, boom.

If you do this, it is no longer OTP.
Post reply on HN