Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attacking Tor: How the NSA targets users' online anonymity

theguardian.com

Post reply on HN
Print view View original

151–160 of 184 posts

Re: Attacking Tor: How the NSA targets users' online anonymity

#151

Post by simgidacav »

guelo wrote: post #110
shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

The weak point as usual are the endpoints. The attack vector described in these documents is JavaScript via some library called E4X. Makes me wonder why Tor bundle doesn't come with NoScript enabled by default.

Utopistically, how nice would be if the whole web provided no-javascript versions of the sites? In the end 90% of the cases javascript is used just to do fancy things, while actual functionalities could be achieved with much less pain (and vulnerability).

Re: Attacking Tor: How the NSA targets users' online anonymity

#152

Post by api »

belorn wrote: post #113
shawn-furyan wrote: post #37

One heartening aspect of the Snowden revelations as a whole is that they have pretty much just confirmed that the things we thought were strong (public crypto research, tor) are in fact strong and the things that we thought were iffy are in fact iffy(Certificate Authorities, Unvetted Crypto, Cloud Services, The Wires, Implementations). This bodes well for the prospect of navigating out of this whole mess successfully…

One iffy part I would like to add is government itself. It was generally thought that government would not keep security vulnerabilities hidden, prioritizing to protect citizens rather than having a minor advantage in hacking. Together with the earlier leaks regarding sabotaged security standard, US government is the most damaging entity to computer security today. Anything they do need to be viewed under the underst…

I never thought that. I always assumed all cyber-war capable governments had hidden caches of 0-day vulnerabilities.

Re: Attacking Tor: How the NSA targets users' online anonymity

#153

Post by taftster »

shawn-furyan wrote: post #80
anologwintermut wrote: post #70

Earlier quoted context omitted.

Prior to this one should not have (and arguably should sill not) assumed Tor is safe against the NSA. Tor was explicitly not designed to protect against a global passive adversary. That's the price it pays for low latency. With the amount of network data the NSA has, they probably constitute such an adversary. It is actually rather surprising that Tor gives them this much trouble.

It's a question of opportunity cost. The NSA has extensive resources, but it's unlikely that they can employ overwhelming resources (such as would be theoretically necessary to break tor) for every situation where overwhelming resources specifically directed are a theoretical weakness. At the moment, implementations are a much easier target, and so I don't necessarily think that it's surprising that they do have trou…

Yes - exactly. Opportunity cost is something that is not discussed enough. Conceivably, any "target" is vulnerable to every communication at the right price point. From technology solutions (provided by NSA), to in-field solutions (provided by CIA), we shouldn't believe that we can be totally "safe" from unwanted eavesdroppers.

It's not "if" Tor (and friends) are vulnerable. We should assume and operate like they are, but with some level of acceptable tradeoff. It's like a safe or ATM - neither of these guarantees perfect security; they just provide enough security for the expected loss of their contents.

The problem - it's just very hard to evaluate the opportunity cost, since we don't really know how wide-spread or "easy" it is for privacy to be breeched. These types of revelations help establish the "market price" for which we can use as a basis for evaluating our options for communications (including traditional man-to-man transport).

I personally don't have any communication which I consider privileged enough to warrant the extra hassle of running Tor, etc. I consider a TLS connection with my bank secure enough for my concerns and I don't have the desire to pull otherwise questionable content from any type of onion router. Therefore, I enter the market with a different expectation of features and cost I'm willing to pay.

Re: Attacking Tor: How the NSA targets users' online anonymity

#154

Post by ris »

tedks wrote: post #44
tptacek wrote: post #7

Metacommentary: I've taken a jaundiced view of "liberation tech" efforts in the past and this is as good an illustration as any of why. Among "amateur" libtech projects, Tor is about as good as you get --- an active community, extremely widespread use, technical people with their heads screwed on right and as much humility as you can reasonably expect of people whose projects are (candidly) intended to thwart world g…

>(here, there's a subtext that Tor actually made NSA's job easier) I'm not sure how you reached that conclusion. The slides mention that Tor is: * Very difficult to identify on the network-level, since Tor-tls traffic is indistinguishable from Apache-tls traffic as of 2011 * Impossible to fully deanonymize * Only exploitable via a handful of browser exploits. Further, later in the "Tor is the King" slide deck, there'…

Even TAILS worries me slightly. Why? Homogeneity. The same thing that makes a freshly booted TAILS "clean" and exactly the same as any other freshly booted TAILS also means that it's a "known quantity" to an attacker.

A lot of obscure vulnerabilities that would normally require a "perfect storm" to be used together to compromise a system are much easier to construct once you know a lot about the target system. And it would be well worth the time for an attacker to develop an exploit that would work against all TAILS users.

In the same way the Firefox heap spraying attack was specifically targeted against users of the Tor Browser Bundle. There, homogeneity was a large part of victims' downfall. TAILS is arguably many times more homogeneous.

ASLR and related technologies are a (very very basic) start but we may not have better answers to things like this until we have the likes of binary diversity as described in http://lwn.net/Articles/565113/ being usable (Even then, a final binary compilation stage would need to be taken by an application user before use).

Edit: and yes, you don't need to point out that the TBB vulnerability did heap spraying in Firefox's JIT and so binary diversity would probably have been minimally effective.

Re: Attacking Tor: How the NSA targets users' online anonymity

#155

Post by mpyne »

moutarde wrote: post #131
mpyne wrote: post #128

Earlier quoted context omitted.

> That used to be a tin-foil hat idea just a few months ago, and we know better now. If NSA comes carrying gifts, it warrant being very careful in accepting them from a party with such hostile priorities. Well, not really. The "tinfoil" idea is that NSA is breaking into crypto so that they can blackmail politicians, black-bag innocent citizens, etc. But it was never widely assumed that NSA wasn't trying to break ever…

The NSA shouldn't just be an attacker it should also provide defence. If one of their many contractors can leak details to the press for idealogical ends it's pretty safe to assume that much worse secrets have already been leaked to other nation states (China, Russia etc....) for financial gain. I think it's entirely reasonable to assume that a lot of exploits the NSA has discovered and not revealed (because it think…

> The NSA shouldn't just be an attacker it should also provide defence.

Uh, it actually does exactly that. That is the second major mission objective of NSA, is to ensure that the USA's own communications are secure. For example, the SHA-1 hash standard that underpins much of our cryptosystems was developed wholly by NSA as an alternative to MD5 (which was apparently even at the time thought to be weak at NSA).

However there's a difference between ensuring that the theoretical underpinnings of COMSEC are adequate and releasing 0-days. There will always be exploits in web browsers used by people, so NSA is not "helping the citizens" by releasing each and every one of those secretly to browser developers. They can effectively only hamstring them own mission goals by doing that.

Re: Attacking Tor: How the NSA targets users' online anonymity

#156

Post by HoochTHX »

akjj wrote: post #118
belorn wrote: post #113

Earlier quoted context omitted.

One iffy part I would like to add is government itself. It was generally thought that government would not keep security vulnerabilities hidden, prioritizing to protect citizens rather than having a minor advantage in hacking. Together with the earlier leaks regarding sabotaged security standard, US government is the most damaging entity to computer security today. Anything they do need to be viewed under the underst…

> It was generally thought that government would not keep security vulnerabilities hidden Was that what people thought? Were there vulnerability reports in open-source software that were coming from the NSA or thought to be coming from the NSA? Surely everyone knew that the NSA was capable of finding exploits in software, and I would think that it would be hard to keep secret whether or not they're being reported. >…

> It was generally thought that government would not keep security vulnerabilities hidden

It depends on which they find it on, according to this talk, https://www.youtube.com/watch?v=E4Zx5rQFk4U , If vulnerabilities are found on secure systems they are immediately classified, For them to be able to report they have to refind and document the vulnerability on a non secured system.

Re: Attacking Tor: How the NSA targets users' online anonymity

#157

Post by espeed »

Foxacid sounds like an NSA version of BeEF (http://beefproject.com/), which hooks browsers that would then be monitored from the Lockheed-Martin-style SOC (https://www.youtube.com/watch?v=x1tCJfy_iZ4 :-).

However, for those with more limited resources, Ryan Barnett is working on an open-source monitoring system for BeEF (https://vimeo.com/54087884).

Re: Attacking Tor: How the NSA targets users' online anonymity

#158

Post by ris »

chakalakasp wrote: post #48
kilroy123 wrote: post #25

Sounds like, if you're going to do something very sensitive on tor, you need to: - always have an update to date version of tor bundle! - compile the bundle yourself from source - run it virtually, and always roll back to a clean snapshot (before installing it tor) when done - if possible use from a network that is not your own (open wifi, public wifi, etc.) - spoof your mac address - do not run JS, Java applets, etc…

If you are doing something that would make the NSA interested in you (and I would highly highly discourage that), you'd need to focus more on tradecraft. Get the laptop from a source that can't be traced to you, like a thrift store in a city where you don't live or normally frequent. Disguise yourself, pay in cash, and either make sure there are no security cameras or wait a good year before you do whatever you are g…

"Park a long distance from your wifi source where there are no cameras"

This implies that you've been driving round (in your disguise of course) in a car. With a registration plate.

Re: Attacking Tor: How the NSA targets users' online anonymity

#159

Post by mpyne »

belorn wrote: post #147
mpyne wrote: post #128

Earlier quoted context omitted.

> That used to be a tin-foil hat idea just a few months ago, and we know better now. If NSA comes carrying gifts, it warrant being very careful in accepting them from a party with such hostile priorities. Well, not really. The "tinfoil" idea is that NSA is breaking into crypto so that they can blackmail politicians, black-bag innocent citizens, etc. But it was never widely assumed that NSA wasn't trying to break ever…

There is a difference between trying to break cryptography, and prioritizing breaking cryptography over protecting civilians. This is true for almost everything in the world. I want for example that the police try to stop criminals, but I do not want them to go around with minigun's and spraying the street with bullets. I want the police to prioritize the safety of civilians. Same goes for NSA. They are perfectly fre…

> When they sabotage standards, or keep vulnerabilities secret so they and criminals can break into peoples computers, then NSA is not prioritizing protecting civilians.

Even the standards that they have been shown to sabotage (Lotus Notes, Clipper, Dual_EC_DRBG), they have sabotaged it in a way that should have reduced the security of the system against NSA, but not in general. I'll note that I disagree with this concept (I'm not a mathematician but it seems to me that it is difficult to prove theoretically that the NSA private key could never be derived when you know the plaintext and ciphertext). However even on these NSA was trying to maintain the security of the cryptosystem itself, it's not as if they introduced a deliberate backdoor where the thing falls apart if you guess the right 8-letter password.

I see your point about knowing about software vulnerabilities and not acting on them. But the problem is that software will always have vulnerabilities, and the citizenry at large isn't exactly good at keeping always up-to-date. So if NSA divulges every 0-day they know, then they don't help the public that much, but do help the enemies of the public protect their software that much better.

You could almost argue that the NSA "buying up 0-days" is directly beneficial to the citizens, by ensuring that at least those vulns don't end up in the hands of someone who'd actually do something rotten with them.

Re: Attacking Tor: How the NSA targets users' online anonymity

#160

Post by r0muald »

roywiggins wrote: post #124
onedev wrote: post #88

Earlier quoted context omitted.

What if you ran scripts on your phone and computer so that it would appear as if you were browsing the internet and using your computer during your regular usage times? Also using public transportation (and paying for it in cash) will help mitigate the first issue your brought up.

Personally I had the idea a while back for a sort of time-release dead drop. Stuff a Raspberry Pi into a fake power strip, put your seekrit information onto the SD card, and go plug it in somewhere in a city you 'happen' to be passing through, near to a public wifi spot. Then a year later it wakes up and uploads the data publicly via Tor and self-wipes. Even if it's traced back to the Pi, they'll have to trace the Pi…

How can you buy a Pi untraceably? Last time I checked you could buy them from e-stores using credit cards..
Post reply on HN