Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

wired.com

Post reply on HN
Print view View original

11–20 of 58 posts

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#11

Post by lambada »

ultramancool wrote: post #10
Sniperfish wrote: post #2

Nothing within that suggests Tor has been cracked but highlights that enforcement agencies do not need to crack Tor if other elements of the infrastructure (Flash, Firefox) have vulnerabilities.

There are of course simple ways around that sort of issue. You can create a 2 VM system: - proxy VM - 2 NICs, one public, one internal to VMs only, runs Tor, exposes only Tor SOCKS5 port to internal network, firewalls everything else - main VM - 1 NIC, internal only, connects only to other VM on Tor SOCKS5 port. Preventing any application from being able to connect. This VM needs to be somewhat locked down from the h…

The scheme you propose is exactly what Whonix provides. https://www.whonix.org/wiki/Main_Page

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#12

Post by wcummings »

>Now Metasploit has a new and surprising fan: the FBI. WIRED has let Metasploit side project called the “Decloaking Engine” to stage its first known effort to successfully identify a multitude of suspects hiding behind the Tor anonymity network.

Looks like this is vanilla proxy piercing with flash. This would only work against misconfigured tor clients.

https://www.torproject.org/docs/faq.html.en#TBBFlash

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#14

Post by KwanEsq »

Nanzikambe wrote: post #9
plethora99 wrote: post #5

This kind of scares me. I don't know much about the case, but the guy is an IT worker, and it's hard for me to believe he'd have such terrible opsec, and he says it wasn't him. I'm all for catching pedophiles and everything, but how did we know it was actually him behind the computer at the time the flash file was loaded? What if it were a friend at the house (maybe even someone intending to frame him), or a virus on…

The exploit sent his MAC address to them; so barring the use of a VM or macchanger (doubtful if he was loading Flash against all advise) that would at very least identify the traffic as coming from his computer. Whether that proves who was at the keyboard or not is an entirely different debate.

No, it didn't. Re-read the article. The sending of MAC addresses occurred in a different, later operation with a new method (custom Firefox exploit code), rather than the Flash based IP-only method that is the focus of this article.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#15

Post by meowface »

This article is talking about 2 different things.

If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an innovative tactic, you can find it on all sorts of sites. If you use the Tor Browser Bundle, it will route Flash through Tor so you're immune.

However, during Operation Torpedo, the FBI deployed an "implant" on Freedom Hosting's servers which was an exploit for CVE-2013-1690, a vulnerability in Firefox. Wasn't a 0-day, but a lot of people using TBB had not patched yet. This was just some Javascript which executed a small bit of Windows shellcode, sending each victim's IP address, MAC address, and a serial number to an FBI-controlled server. The only way to be safe from this was with an updated Firefox version, and/or running NoScript.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#16

Post by pakled_engineer »

A separate BSD firewall box to prevent any connections outside Tor would've prevented this, or thegrugqs p.o.r.t.a.l. box. These attacks will only get better, FF 0day isn't all that expensive so simply disabling JavaScript won't be an option in the future, which prevented the second attack where a custom exploit was used by the FBI.

What's the legal defense if a random .onion address is posted claiming it's leaked juicy Sony emails and scripts and it turns out to be an illegal porn site full of FBI snitchware? How do they draw a legal distinction between a pervert and an idiot who clicks a link?

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#17

Post by rjaco31 »

pakled_engineer wrote: post #16

A separate BSD firewall box to prevent any connections outside Tor would've prevented this, or thegrugqs p.o.r.t.a.l. box. These attacks will only get better, FF 0day isn't all that expensive so simply disabling JavaScript won't be an option in the future, which prevented the second attack where a custom exploit was used by the FBI. What's the legal defense if a random .onion address is posted claiming it's leaked ju…

>FF 0day isn't all that expensive so simply disabling JavaScript won't be an option in the future

Do you have any example of exploit that would no require javascript? AFAIK they are usually about javascript memory handling in order to evade the sandbox

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#18

Post by emidln »

plethora99 wrote: post #5

This kind of scares me. I don't know much about the case, but the guy is an IT worker, and it's hard for me to believe he'd have such terrible opsec, and he says it wasn't him. I'm all for catching pedophiles and everything, but how did we know it was actually him behind the computer at the time the flash file was loaded? What if it were a friend at the house (maybe even someone intending to frame him), or a virus on…

Regarding an IT worker making this mistake. The delta of one mistake separates a good opsec plan from one functionally identical to nothing. Even people who have a pretty good idea of what it takes to pull off opsec on the google-searchable web aren't necessarily interested in all of the hoop jumping to stay anonymous. Convenience is one hell of a sumbitch.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#19

Post by userbinator »

rjaco31 wrote: post #17
pakled_engineer wrote: post #16

A separate BSD firewall box to prevent any connections outside Tor would've prevented this, or thegrugqs p.o.r.t.a.l. box. These attacks will only get better, FF 0day isn't all that expensive so simply disabling JavaScript won't be an option in the future, which prevented the second attack where a custom exploit was used by the FBI. What's the legal defense if a random .onion address is posted claiming it's leaked ju…

>FF 0day isn't all that expensive so simply disabling JavaScript won't be an option in the future Do you have any example of exploit that would no require javascript? AFAIK they are usually about javascript memory handling in order to evade the sandbox

I'm not too sure about Firefox specifically but I know there were some vulnerabilities in image format handling etc. that could be exploited without JS; this is the most prominent one that comes to mind:

http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability

However, to evade detection and frustrate any reverse-engineering attempts, even these sorts of exploits are usually "packaged" in an obfuscated JS wrapper, so they would still require it enabled to work.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#20

Post by rday »

> Like any encryption or privacy system, Tor is popular with criminals.

Out of curiosity, what is the bar for "popular"? Are the majority of criminals using Tor?

I expect Public Defenders are much more popular with criminals. I also expect saying "Public Defenders are popular with criminals" would sound like I'm trying to discredit those people...

Post reply on HN