Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

wired.com

Post reply on HN
Print view View original

221–230 of 280 posts

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#221

Post by chopin »

moutarde wrote: post #194
belorn wrote: post #125

The use of malware in police enforcement is truly a unique event in society. At what other point in history has police distributed a completly illegal tool onto unsuspected and non-targeted civilians? It feels like a total unexplored area of liability laws, so I look with excitement to when the first lawsuit starts. Some people have compared malware with guns. This is to me a very bad comparison, since guns actually…

I think the most troubling aspect of this case is that the FBI modified the computers systems before Ireland seized them as evidence. It seems absurd that law enforcement can effectively tamper with evidence before it is secured, then use that tainted evidence as part of a prosecution.

Is there any indication that this evidence is used? This was under discussion around the Bundestrojaner in Germany whether such a computer can be used as evidence. I doubt that this won't come under severe scrutiny at least in Germany.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#222

Post by tete »

From my point of view there appears to be a huge campaign to discredit Tor or short FUD going on.

Okay, lately there appears the be a huge campaign to discredit Tor going on. The botnet, the Freedom Hosting thing.

We should fight back on that. Tor is still the best took we have and maybe these attacks are the best sign of it.

If you consider switching to a VPN like many do..

That's a bad idea. VPNs are no technology for anonymity. There are various reasons. They don't defend against various attacks, but more importantly they are owned by private entities. Did you hear of this PRISM thing? [rhetoric question] Well, guess what a private company.. even outside of the US would do if any government would ask for a backdoor, maybe even offering money.

A reason why there are these great releases about attacks on Tor is the fact that it is the best tool we have. There are attacks on it, but way less than on any comparable technology. Numerous institutions, universities, etc. work on both finding attacks and improving Tor. The Tor community is attracting the smartest people in the world, just like the NSA is. There is no other anonymity software with so many scientific papers written about it. There are attacks, none of them reaching beyond what can be done to VPNs, etc. and there are tons of improvements that are outlined, that only need a tiny bit more research or only the actual implementation. If you want to work on a real quality product for the greater good there probably is no better place than the Tor Project.

If you wanna help right now (meaning in seconds to minutes) here are some places to go.

If you want to host a Tor Bridge on the cloud for free or really cheaply: https://cloud.torproject.org/

If you are using Firefox: https://addons.mozilla.org/en-US/firefox/

If you are using Chrome/Chromium: https://chrome.google.com/webstore/detail/cupcake/dajjbehmbn...

If you have a website/blog: http://crypto.stanford.edu/flashproxy/

If you have more than just a few minutes: https://www.torproject.org/getinvolved/volunteer.html.en

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#223

Post by Blahah »

tete wrote: post #222

From my point of view there appears to be a huge campaign to discredit Tor or short FUD going on. Okay, lately there appears the be a huge campaign to discredit Tor going on. The botnet, the Freedom Hosting thing. We should fight back on that. Tor is still the best took we have and maybe these attacks are the best sign of it. If you consider switching to a VPN like many do.. That's a bad idea. VPNs are no technology…

Flashproxy seems pretty dark unless I've misunderstood it - automatically opting website visitors in to becoming a transient TOR node is deeply unethical.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#224

Post by Tloewald »

unreal37 wrote: post #87
Tloewald wrote: post #69

This would make the FBI guilty of a whole bunch of felonies, would it not? (Independent of whether what they were doing is morally right or wrong, isn't this exactly what they imprison hackers for?)

You cannot arrest the U.S. government for felonies.

But you can arrest individuals who, using their office, engage in felonies. If this is organizational, i believe we could use RICO.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#225

Post by majelix »

signed0 wrote: post #218
jacquesm wrote: post #206

Earlier quoted context omitted.

And if your bank does not do 2 factor authentication switch to another bank.

Which banks actually do this? I've never encountered one.

Here's a list of them that use Verisign's VIP: https://idprotect.vip.symantec.com/wheretouse.v

Others may use in-house solutions. Here's Bank of America's two factor solution: https://www.bankofamerica.com/privacy/faq/safepass-faq.go

We're almost to a point where the question isn't whether or not they support it, it's finding out that they have a program, clicking through tiny text links at the bottom of pages, and figuring out how yet-another-implementation works.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#226

Post by atmosx »

skwirl wrote: post #94
alan_cx wrote: post #83

Earlier quoted context omitted.

Do you assume that the techniques used for something most would assume to be reasonable will not ever be used in less desirable ways?

Police "techniques" involve guns, tear gas, helicopters, etc. At any time the police could in theory fly to your house, launch tear gas into your windows, and shoot you in the head as you run out. And I don't know about you, but I'm not exactly worried about that happening to the point where I want to take guns, tear gas, and helicopters away from the police. This is the FBI taking down criminals engaging in a clear…

The FBI as every state organization is a position of power give by the state and it's citizen to protect them from illicit activities. All of them, not some of them.

When the FBI engages in unethical and illicit practice, it's like stating that rules do not apply for them. Given for granted that they are in a position of power a priori, it's hard for me to see how this is good thing and how accountability can be held.

Also you seem to be convinced that the judge and court will apply the rule of law to the FBI as they would have done with you and me.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#227

Post by FajitaNachos »

khoffrath wrote: post #214
nitrogen wrote: post #195

Earlier quoted context omitted.

That reminds me of a story I read about how the satellite companies foiled carders by slowly building up a new decryption system out of apparent garbage released across a long string of updates. I don't dare to search for it though, so I don't have a link.

http://www.codinghorror.com/blog/2008/05/revisiting-the-blac... Original article: http://news.slashdot.org/story/01/01/25/1343218/directvs-sec... Fascinating background story here: http://www.wired.com/politics/security/news/2008/05/tarnovsk...

Nice article. It's the first time I've heard of it, and I enjoyed reading it.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#228

Post by SEMW »

jlgreco wrote: post #170
tptacek wrote: post #150

Earlier quoted context omitted.

You mean changing the number of "2048" to "4096"? I'm not sold on that being a meaningful improvement to his security, but even so, you realize that change costs him nothing , right? He needed to generate a new key... why not set it to 4096 bits? Everything he does with that key happens in human scale time --- even a 500ms per message delay wouldn't be noticeable. So, some evocatively named Linux distro recommends th…

> You mean changing the number of "2048" to "4096"? No, certainly not. I agree with you; the change from 2048 to 4096 isn't interesting. The interesting part is that he 1) generated a new key (okay, not actually interesting in itself) , 2) is using it in an isolated install, 3) this isolate install is on entirely separate hardware, not just a VM, 4) this separate hardware is new hardware that has never been networked…

> Is going to such an extreme... really necessary?

Since Schneier's now doing analysis of unreleased Snowden documents for the Guardian, he now has reason to believe that the NSA has a strong motive to see what documents he's working on.

Seems to me that the level of tin-foil-hattery that's reasonable to protect against an organisation likely to be targeting you specifically needs to be an order of magnitude greater than that which is reasonable to protect against a general-population surveillance dragnet.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#229

Post by twoodfin »

atmosx wrote: post #226
skwirl wrote: post #94

Earlier quoted context omitted.

Police "techniques" involve guns, tear gas, helicopters, etc. At any time the police could in theory fly to your house, launch tear gas into your windows, and shoot you in the head as you run out. And I don't know about you, but I'm not exactly worried about that happening to the point where I want to take guns, tear gas, and helicopters away from the police. This is the FBI taking down criminals engaging in a clear…

The FBI as every state organization is a position of power give by the state and it's citizen to protect them from illicit activities. All of them, not some of them . When the FBI engages in unethical and illicit practice, it's like stating that rules do not apply for them. Given for granted that they are in a position of power a priori, it's hard for me to see how this is good thing and how accountability can be hel…

It is unethical or illicit for me to tap someone's phone or install malware on their computer. That doesn't mean it's illicit or unethical for the FBI to do so. The whole point of having a state is to trust it with powers that individuals should not exercise on their own authority.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#230

Post by [deleted] »

twoodfin wrote: post #229
atmosx wrote: post #226

Earlier quoted context omitted.

The FBI as every state organization is a position of power give by the state and it's citizen to protect them from illicit activities. All of them, not some of them . When the FBI engages in unethical and illicit practice, it's like stating that rules do not apply for them. Given for granted that they are in a position of power a priori, it's hard for me to see how this is good thing and how accountability can be hel…

It is unethical or illicit for me to tap someone's phone or install malware on their computer. That doesn't mean it's illicit or unethical for the FBI to do so. The whole point of having a state is to trust it with powers that individuals should not exercise on their own authority.

[deleted]
Post reply on HN