Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Russia offers $110,000 to crack Tor anonymous network

bbc.com

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Russia offers $110,000 to crack Tor anonymous network

#41

Post by throwaway27237 »

daj40 wrote: post #34

I don't know why anyone would do this for $110,000. Especially after the entry fee, probably wouldn't make much money after the hardware costs, though if you're good enough to take on TOR, you probably also have a botnet. Also, why the hell would anyone give it to the Russians? Of all people, they're definitely who need exclusive access to a TOR hack. Especially if you consider that some of those people who are using…

> Also, why the hell would anyone give it to the Russians?

If you're concerned about the morality of it, who would you consider "okay" to sell it to? (I'm assuming the tor project itself does not have funds to pay for vulnerabilities)

Re: Russia offers $110,000 to crack Tor anonymous network

#42

Post by malka »

nanoscopic wrote: post #32

I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…

>( or at least a site where you can cause JS to run; such as an advertisement )

So you cannot find the identity of a tor user.

* Either the TOR user is a 'newbie' (no offense), and he will use the tor package wich come with a version of firefox where JS is disabled by default

* Either he is a seasoned user and knows that disabling JS while using TOR is mandatory.

Re: Russia offers $110,000 to crack Tor anonymous network

#43

Post by robertfw »

jonahx wrote: post #35
nanoscopic wrote: post #32

I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…

I assume a Tor user with js turned off would be immune to this?

I wonder if something similar could be done with detecting specifically sized images?

Re: Russia offers $110,000 to crack Tor anonymous network

#44

Post by [deleted] »

Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

[deleted]

Re: Russia offers $110,000 to crack Tor anonymous network

#45

Post by mseebach »

nanoscopic wrote: post #32

I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…

I don't know the exact parameters of the competition, but I doubt pretty strongly if the solution is allowed to manipulate the targeted user's behavior, and, oh, by the way, install a high speed listening device on the trunk of every ISP in the world.

If you have to know already which ISP the suspected user is using, you're not really finding the user, you're just confirming their identity.

And as others have pointed out, running with JS enabled is a vulnerability. If the user is that careless, it's probably easier to get them to load a particular file over plain HTTP and just listening to requests for that file.

Re: Russia offers $110,000 to crack Tor anonymous network

#46

Post by [deleted] »

Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

[deleted]

Re: Russia offers $110,000 to crack Tor anonymous network

#47

Post by don_draper »

Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

They should have just put the proposal on elance

Re: Russia offers $110,000 to crack Tor anonymous network

#48

Post by ddoolin »

jbigelow76 wrote: post #29
tormeh wrote: post #20

Earlier quoted context omitted.

Why wouldn't they? This is exactly the stuff I'd want to pay for if I was an intelligence agency; you want the hackers to come back with more exploits, after all.

No intelligence company would pay for it if it were publicized they had paid for it. It's more useful to keep quiet and let people think Tor is still anonymous.

Could the person who sold it to them publicize it? Assuming they would be outside of Russia or unbound from any sort of gag order (not likely)?

Re: Russia offers $110,000 to crack Tor anonymous network

#50

Post by broolstoryco »

nanoscopic wrote: post #32

I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…

> 2. Know which ISP the user is on

How easy would it be to do this (even with JS on)?

Post reply on HN