The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
1–10 of 58 posts
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#2Nothing within that suggests Tor has been cracked but highlights that enforcement agencies do not need to crack Tor if other elements of the infrastructure (Flash, Firefox) have vulnerabilities.
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#3Every one of these threads, here and on Reddit, ends up packed with accounts demanding "proof" of vulnerability or saying it's a silly conspiracy to say that the typical Tor install provides very weak protection.
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#4Every one of these threads, here and on Reddit, ends up packed with accounts demanding "proof" of vulnerability or saying it's a silly conspiracy to say that the typical Tor install provides very weak protection.
Why does this surprise you? The internet is made up all of all sorts of fabricated content, proof should be required.
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#5This kind of scares me. I don't know much about the case, but the guy is an IT worker, and it's hard for me to believe he'd have such terrible opsec, and he says it wasn't him. I'm all for catching pedophiles and everything, but how did we know it was actually him behind the computer at the time the flash file was loaded? What if it were a friend at the house (maybe even someone intending to frame him), or a virus on a computer in his home using his computer like a VPN, or router malware, or even a passerby or neighbor hijacking his wifi? I give out my wifi password to guests all the time and never change it and might have to change that policy if you can be thrown in prison for years (not to mention irreversible reputational damage) if a request from your home IP hits the wrong server.
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#6Every one of these threads, here and on Reddit, ends up packed with accounts demanding "proof" of vulnerability or saying it's a silly conspiracy to say that the typical Tor install provides very weak protection.
Why does this surprise you? The internet is made up all of all sorts of fabricated content, proof should be required.
[deleted]
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#7Possible...Though it could also be an example of "parallel reconstruction," with the real method of exposure actually something else. NSA etc.
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#8Every one of these threads, here and on Reddit, ends up packed with accounts demanding "proof" of vulnerability or saying it's a silly conspiracy to say that the typical Tor install provides very weak protection.
Why does this surprise you? The internet is made up all of all sorts of fabricated content, proof should be required.
People always demanding hard proof seem to have an inability to draw conclusions for themselves.
Are there are missing facts and figures? Yes.
Welcome to real life, where you have to make up your mind with what you have available. People have to learn to use and correlate the information they have, historical information, precedent etc, and make up a model for what's going on, instead of demaning some sanctious data to be passed upon them, like a Holy Book.
As Alan Kay said, "a point of view is worth 80 IQ points"
(Not to mention that the "hard facts" they tend to accept (government statements, reports etc) could as well be fabricated, and historically have more often than not been).
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#9This kind of scares me. I don't know much about the case, but the guy is an IT worker, and it's hard for me to believe he'd have such terrible opsec, and he says it wasn't him. I'm all for catching pedophiles and everything, but how did we know it was actually him behind the computer at the time the flash file was loaded? What if it were a friend at the house (maybe even someone intending to frame him), or a virus on…
The exploit sent his MAC address to them; so barring the use of a VM or macchanger (doubtful if he was loading Flash against all advise) that would at very least identify the traffic as coming from his computer.
Whether that proves who was at the keyboard or not is an entirely different debate.
Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users
#10Nothing within that suggests Tor has been cracked but highlights that enforcement agencies do not need to crack Tor if other elements of the infrastructure (Flash, Firefox) have vulnerabilities.
There are of course simple ways around that sort of issue. You can create a 2 VM system:
- proxy VM - 2 NICs, one public, one internal to VMs only, runs Tor, exposes only Tor SOCKS5 port to internal network, firewalls everything else
- main VM - 1 NIC, internal only, connects only to other VM on Tor SOCKS5 port. Preventing any application from being able to connect. This VM needs to be somewhat locked down from the host at minimum though, no VM file sharing, probably best to avoid other VM services too.
The only way to break this scheme would be to exploit the Tor proxy port itself to break into the proxy VM from the main VM or to break out of the VM itself. Likely harder than a large codebase like Firefox/Java/Flash. Of course, remember to snapshot and restore once you're configured to avoid any risk of persistent malware.