Live data from Hacker News

Freedom Hosting sites compromised, founder arrested

twitlonger.com

11–20 of 140 posts

Re: Freedom Hosting sites compromised, founder arrested

#11
They make note that the vulnerability used is only in Firefox 17--the current ESR (extended support release). What they do not mention is that the Tor Browser Bundle[1]--created so users can simply download one executable and feel protected by Tor--is based on this very release.

Among all internet users, Firefox 17 is probably rare, but among Tor users? My bet is that it owns a significantly higher chunk of the market.

[1] Tor Browser Bundle: https://www.torproject.org/projects/torbrowser.html.en

Re: Freedom Hosting sites compromised, founder arrested

#13
post #2

We should be clear that this isn't a vulnerability in the Tor software or network, but an (apparent) vulnerability in this unrelated "Freedom Hosting" company's site: https://blog.torproject.org/blog/hidden-services-current-eve...

And possibly in Firefox (!), with some sort of JavaScript exploit. This is the most worrying part for me--does anyone have any info on what the payload does?

Doesn't have to do much. Once you execute pretty much any (non-sandboxed) code on a machine, you can bypass something like TOR easily. From this point, any network packet sent by the payload to the feds effectively de-anonymizes the user completely. Also, by including a tracking cookie in the JS, they can cross reference all user activity on the compromised websites with the newly discovered IP address.

Re: Freedom Hosting sites compromised, founder arrested

#14
post #3

Europeans point of view: Am I the only one who feels that the US is taking over the Internet and all of our privacy with it?

Europeans point of view: European bureaucrats are not any better, think about David Cameron idea of Porngate

AFAIK, the European parliament is so far reasonable regarding the Internet and privacy.

However, the Commission (the executive branch, and especially the Trade Commisioner, Karel De Gucht) has been pushing hard for ACTA, going as far as lying, several times, to the Parliament. When the Parliament rejected ACTA, De Gucht said he would look for other means to bypass the decision.

Re: Freedom Hosting sites compromised, founder arrested

#15
post #3

Europeans point of view: Am I the only one who feels that the US is taking over the Internet and all of our privacy with it?

Europeans point of view: European bureaucrats are not any better, think about David Cameron idea of Porngate

Funny, I just realized that I never think of the UK when reading about Europe. In a surveillance context it certainly feels closer to the US. And then I watched this far to often a couple of years ago ... in a desperate wish to find some humanizing qualities ... https://www.youtube.com/watch?v=SdlT7v476qY

Re: Freedom Hosting sites compromised, founder arrested

#16

Earlier quoted context omitted.

Europeans point of view: European bureaucrats are not any better, think about David Cameron idea of Porngate

Funny, I just realized that I never think of the UK when reading about Europe. In a surveillance context it certainly feels closer to the US. And then I watched this far to often a couple of years ago ... in a desperate wish to find some humanizing qualities ... https://www.youtube.com/watch?v=SdlT7v476qY

> ... I never think of the UK when reading about Europe.

Neither do most UK dwellers.

Except when it suits them, off course.

Re: Freedom Hosting sites compromised, founder arrested

#18
I must yet again point to a company like Endgame Systems[1] as being a likely contractor for this service rendered for the FBI.

Some of Endgame's products used by the likes of the NSA: "There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year. The Cayman botnet-analytics package gets you access to a database of Internet addresses, organization names, and worm types for hundreds of millions of infected computers, and costs $1.5 million."

Exploiting an unknowable amount of users of a service as to hunt them. Using illegally harvested data from botnets, while others get hunted and prosecuted for coding them.

This tiered society where the legally immune can profit off acts that get others jailed. The market manipulation that comes with bribing companies for data access, the government giving less regulatory oversight to companies it has secret 'deals' with.

For the sake of society, economy, basic morality. It must end.

[1] http://wiki.echelon2.org/wiki/Endgame_Systems

Re: Freedom Hosting sites compromised, founder arrested

#19
post #17

Here is real reason why little sisters force everything into browser. Because they care about security >:-) People should stop using web/browsers for everything.

The idea of having JS enabled is directly at odds with a secure system, too. All TOR sites should have non-JS friendly interaction. There's really negligible benefit compared to exploits like the on in TFA.

Re: Freedom Hosting sites compromised, founder arrested

#20
post #3

Europeans point of view: Am I the only one who feels that the US is taking over the Internet and all of our privacy with it?

It's not just that they're stealing everyone's privacy. They're acting like "it's foreigners, so we don't have to care" - even the latests attempts to rein in NSA make no effort to cut back its international misbehavior. Basically, I think most civilized people have been operating on the premise that democratic western states are behaving in a vaguely civilized way towards people in other such states. But it's clear…

> America

The American government, you mean.

Post reply on HN