I bet NSA is willing to pay much more.
Russia offers $110,000 to crack Tor anonymous network
31–40 of 87 posts
Re: Russia offers $110,000 to crack Tor anonymous network
#32I already posted publicly online how to find the identity of a Tor user.
To reiterate:
1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement )
2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets.
3. Use the JS to send a specifically crafted sequence of sized packets with specific time periods in between them. After sending this preamble, send sized packets to send the 'pseudo identity' of the user ( whatever pseudonym you wish to attach back to their real IP )
4. Use your monitored ISP device to detect the preamble, then log IP and the data.
Note this method could be done en-masse and would only require high speed FPGA devices at each ISP "trunk". Inject JS code correlating users back for any system which you wish to identify the users.
Done. Whichever Russian demonstrates this and wins the $100k; throw me a bone please. :)
Re: Russia offers $110,000 to crack Tor anonymous network
#33Last paragraphs are very interesting: "In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government co…
Well, TOR was originally developed by the US Naval Research Lab for the purpose of securing government comms. Source: https://www.torproject.org/about/overview
I was of a slightly different impression, but have no idea what is the "truth".
"Tor was not started by the US Navy. The US Naval Research Labs (NRL) started a project in the 1990s called onion routing7. Tor uses the basic onion routing principles and applies them to the Internet. The volunteer Tor group started in 2001. The formal charity, The Tor Project, started in 2006. We continue to work with Dr. Paul Syverson from NRL on improving onion routing and therefore Tor."
Re: Russia offers $110,000 to crack Tor anonymous network
#34I don't know why anyone would do this for $110,000. Especially after the entry fee, probably wouldn't make much money after the hardware costs, though if you're good enough to take on TOR, you probably also have a botnet. Also, why the hell would anyone give it to the Russians? Of all people, they're definitely who need exclusive access to a TOR hack. Especially if you consider that some of those people who are using it in Russia could be regular people who are trying to not be persecuted for their sexual orientation. Bad idea overall.
Re: Russia offers $110,000 to crack Tor anonymous network
#35I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…
I assume a Tor user with js turned off would be immune to this?
Re: Russia offers $110,000 to crack Tor anonymous network
#36Earlier quoted context omitted.
They don't want to 'buy' the exploit outright, just fund the R&D. Thank you sensationalist media.
I don't understand, it seems like researchers have to pay to enter and then are only given the funding if successful, that's not exactly funding R&D, more of a contest. It seems really strange that Russia would be offering this kind of bounty in effort to improve the program's security, don't they know how many activists and dissidents use it. Is the sole reason to aid their own spies? They should just provide funds…
It is definitely R&D to find a vulnerability in TOR or lack thereof, it's just that BBC as usual is arbitrarily choosing what to report and what to stay silent about.
Look no further than the tender page: http://zakupki.gov.ru/epz/order/notice/zkk44/view/common-inf...
Here they explicitly state that it's a tender for 'Выполнение научно-исследовательской работы, шифр «ТОР (Флот)»' (Research and Development works, code "TOR (Navy)")
Then it's a closed tender (stated in the same document), meaning that they come up with a list of organisations they invite to participate in this tender. No organization they did not invite can participate.
So you see this is nothing like a bounty.
>it seems like researchers have to pay to enter
I wager they are required by law to demand some sum of money, maybe this sum is determined as a function of a tender value; I don't believe there is some additional meaning to asking people to pay 5500 usd to participate in a closed tender.
Re: Russia offers $110,000 to crack Tor anonymous network
#37ugh, capitalism. someone somewhere will actually do work towards this goal with that much money in mind as a worthwhile payoff. ending tor anonymity should have at least 2 more 0s on the end of the figure.
Re: Russia offers $110,000 to crack Tor anonymous network
#38Earlier quoted context omitted.
I don't understand, it seems like researchers have to pay to enter and then are only given the funding if successful, that's not exactly funding R&D, more of a contest. It seems really strange that Russia would be offering this kind of bounty in effort to improve the program's security, don't they know how many activists and dissidents use it. Is the sole reason to aid their own spies? They should just provide funds…
It is definitely R&D to find a vulnerability in TOR or lack thereof, it's just that BBC as usual is arbitrarily choosing what to report and what to stay silent about. Look no further than the tender page: http://zakupki.gov.ru/epz/order/notice/zkk44/view/common-inf... Here they explicitly state that it's a tender for 'Выполнение научно-исследовательской работы, шифр «ТОР (Флот)»' (Research and Development works, code…
[deleted]
Re: Russia offers $110,000 to crack Tor anonymous network
#39Last paragraphs are very interesting: "In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government co…
Fuck them and fuck TOR, when I had a similar service years ago the feds shut down my data center and started cold calling me with weird questions.
You get in bed with these guy, not only will I never use your service, you yourself (TOR devs) will pay the price when they are done with you.
Re: Russia offers $110,000 to crack Tor anonymous network
#40How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.
The "hackathon" spirit has caught on at the state level. Get a bunch of college kids to slave away for free and give the best one a paltry sum for their efforts and retain all rights to the work.