Heartbleed and TOR in practice

#1

Post by bdpuk » Thu, Apr 17, 2014, 4:06 PM UTC

Heartbleed and TOR in practice
digitalassurance.com

Re: Heartbleed and TOR in practice

#2

Post by ufmace » Thu, Apr 17, 2014, 4:25 PM UTC

Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.

Re: Heartbleed and TOR in practice

#3

Post by m00dy » Thu, Apr 17, 2014, 4:29 PM UTC

ufmace wrote: post #2

Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.

i was going to say the same thing :)

Re: Heartbleed and TOR in practice

#4

Post by mpyne » Thu, Apr 17, 2014, 4:45 PM UTC

ufmace wrote: post #2

Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.

I would be shocked if they weren't involved in outing Silk Road, in some sort of multiagency effort. It's not clear NSA couldn't de-anonymize specific TOR services if they wanted to even before we knew about Heartbleed though.

Re: Heartbleed and TOR in practice

#5

Post by DatBear » Thu, Apr 17, 2014, 5:06 PM UTC

After all the NSA leaks and then Heartbleed, being anonymous anywhere really seems like a pipe dream to me.

Re: Heartbleed and TOR in practice

#6

Post by dmix » Thu, Apr 17, 2014, 5:22 PM UTC

DatBear wrote: post #5

After all the NSA leaks and then Heartbleed, being anonymous anywhere really seems like a pipe dream to me.

Large-scale traffic analysis (dragnet surveillance) + hacking into exit nodes already made compromising TOR users technically feasible before the heartbleed exploit.

The whole cypherpunk/online anonymity movement which spawned TOR was largely predicated on nation states acting legally. But when they can secretly hack into every router, fiber cable, and gateway endpoint without any question of legality then anonymity and privacy online is no longer an option for anyone, even the most technically-proficient.

Re: Heartbleed and TOR in practice

#7

Post by antocv » Thu, Apr 17, 2014, 5:23 PM UTC

ufmace wrote: post #2

Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.

I dont think heartbleed was necessary to crack Silk Road server - after all its just another php server, those arent really known for being air-tight.

Especially the programmer who basically copypasted stuff from stackoverflow.

Re: Heartbleed and TOR in practice

#8

Post by Buge » Thu, Apr 17, 2014, 6:54 PM UTC

ufmace wrote: post #2

Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.

I saw a study showing it is possible to deanonymize a hidden service by doing traffic analysis for several months.