Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

wired.com

Post reply on HN
Print view View original

31–40 of 58 posts

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#31

Post by smtddr »

meowface wrote: post #15

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an…

>>It will only catch people who have configured their proxy very poorly.

To add to this, in Firefox if you use this: http://i.imgur.com/ajT98xC.png , Flash does not obey it. I kinda think Mozilla should put some kind of warning-text on this dialog window to warn uses that it doesn't apply to flash, silverlight or any plugins. This surprised me at first but it makes sense if you think about it. You really have to do a system-wide VPN type thing. Something like this: https://github.com/apenwarr/sshuttle will actually tunnel everything on your PC.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#32

Post by ChuckMcM »

meowface wrote: post #15

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an…

Interesting to me though is that that article seems to imply that if you are after an Onion server you only need one "idiot" using it in order to unmask it. By compromising that user, their compromised system will get you information about the server. Or did I mis-read what they were implying?

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#33

Post by darkarmani »

plethora99 wrote: post #5

This kind of scares me. I don't know much about the case, but the guy is an IT worker, and it's hard for me to believe he'd have such terrible opsec, and he says it wasn't him. I'm all for catching pedophiles and everything, but how did we know it was actually him behind the computer at the time the flash file was loaded? What if it were a friend at the house (maybe even someone intending to frame him), or a virus on…

> This kind of scares me. I don't know much about the case, but the guy is an IT worker, and it's hard for me to believe he'd have such terrible opsec

There is a wide range of "IT workers". I would guess that 50% of them could easily make this mistake. Security is hard. Maintaining a bunch of computers with poor security is easy (ask sony).

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#34

Post by noirbot2 »

vilhelm_s wrote: post #26
meowface wrote: post #15

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an…

According to the article, Operation Torpedo happened one year earlier than the Freedom Hosting hack. I don't think we have seen the results of the latter yet.

The Freedom Hosting event was over 1.5 years ago. I'm starting to wonder if there was some procedural / legal issue with that operation. I don't know what would delay the investigation this long otherwise.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#35

Post by digi_owl »

ChuckMcM wrote: post #32
meowface wrote: post #15

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an…

Interesting to me though is that that article seems to imply that if you are after an Onion server you only need one "idiot" using it in order to unmask it. By compromising that user, their compromised system will get you information about the server. Or did I mis-read what they were implying?

You're misreading it. They already had a guy at the web hotel. The injected code unmasked the visitors, allowing the FBI to go out and arrest them along with taking down the site itself.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#36

Post by digi_owl »

sp332 wrote: post #29
cbd1984 wrote: post #23

Earlier quoted context omitted.

You know what else is popular with criminals? Walls. Mailing using envelopes instead of postcards, especially those envelopes with the ink patterns that make it harder to see through them. Not yelling things into a cell phone at top volume when you're out in the street. The First, Fourth, and Fifth Amendments to the American Constitution, and equivalents elsewhere in the world.

Cash! Dollar bills are like anonymous physical bitcoins!

Bitcoins are about as anonymous as a numbered bank account are, if that.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#37

Post by sp332 »

digi_owl wrote: post #36
sp332 wrote: post #29

Earlier quoted context omitted.

Cash! Dollar bills are like anonymous physical bitcoins!

Bitcoins are about as anonymous as a numbered bank account are, if that.

Right. That's why cash is like anonymous bitcoins.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#38

Post by Crito »

sp332 wrote: post #29
cbd1984 wrote: post #23

Earlier quoted context omitted.

You know what else is popular with criminals? Walls. Mailing using envelopes instead of postcards, especially those envelopes with the ink patterns that make it harder to see through them. Not yelling things into a cell phone at top volume when you're out in the street. The First, Fourth, and Fifth Amendments to the American Constitution, and equivalents elsewhere in the world.

Cash! Dollar bills are like anonymous physical bitcoins!

Bitcoin but without the audit trail! Now who could possibly want such a thing besides criminals...
Post reply on HN