Russia offers $110,000 to crack Tor anonymous network • Hacker News Board

Re: Russia offers $110,000 to crack Tor anonymous network

#51

Post by mnem » Mon, Jul 28, 2014, 3:45 PM UTC

bjelkeman-again wrote: post #33

noblethrasher wrote: post #25

Earlier quoted context omitted.

Well, TOR was originally developed by the US Naval Research Lab for the purpose of securing government comms. Source: https://www.torproject.org/about/overview

I was of a slightly different impression, but have no idea what is the "truth". "Tor was not started by the US Navy. The US Naval Research Labs (NRL) started a project in the 1990s called onion routing7. Tor uses the basic onion routing principles and applies them to the Internet. The volunteer Tor group started in 2001. The formal charity, The Tor Project, started in 2006. We continue to work with Dr. Paul Syverson…

Not started by the US Navy but started by US Naval Research Labs instead? Is there any practical difference except where it appears on a military budget sheet? :)

If you ignore some of the drama, Pando has a very long and fairly comprehensive look at its funding (at least, it seemed comprehensive to me, I am not a Tor expert) - http://pando.com/2014/07/16/tor-spooks/

Re: Russia offers $110,000 to crack Tor anonymous network

#52

Post by JulianMorrison » Mon, Jul 28, 2014, 3:46 PM UTC

Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

They may not intend to pay it. Just inspiring worries about the safety of TOR might be enough for their nefarious purposes.

Re: Russia offers $110,000 to crack Tor anonymous network

#53

Post by JulianMorrison » Mon, Jul 28, 2014, 3:51 PM UTC

nanoscopic wrote: post #32

I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…

Even simpler: create a website which responds in a recognizable way, serially rather than concurrently. If person A received recognizable packet P at time T, and the site was serially serving that connection at time T to recognizable-but-pseudonymous person X, then A==X.

Re: Russia offers $110,000 to crack Tor anonymous network

#54

Post by Kalium » Mon, Jul 28, 2014, 3:52 PM UTC

JasonIpswitch wrote: post #28

kar-kub wrote: post #23

Last paragraphs are very interesting: "In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government co…

I've seen two explanations for why the US government gives money to the Tor Project. One reason is to support dissidents in countries like China. Another is that US agents use Tor, but that the network requires a degree of popularity in order for agents to "hide" in it.

I should think that both are likely true.

Re: Russia offers $110,000 to crack Tor anonymous network

#55

Post by goatforce5 » Mon, Jul 28, 2014, 3:55 PM UTC

I'd assume you wouldn't have to look to hard to find someone willing to pay $110k+ to identify specific individual Tor users, let alone find general exploits in Tor.

Re: Russia offers $110,000 to crack Tor anonymous network

#56

Post by scarmig » Mon, Jul 28, 2014, 3:55 PM UTC

Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

I saw this headline and immediately thought, "that's much too low."

But I've got no idea how much that vulnerability would actually go for. Millions? Tens of millions? Anyone with a stronger understanding of the market have any rough estimate?

Re: Russia offers $110,000 to crack Tor anonymous network

#57

Post by AJ007 » Mon, Jul 28, 2014, 4:00 PM UTC

kar-kub wrote: post #23

Last paragraphs are very interesting: "In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government co…

It isn't just FUD, there are some serious questions that have been raised which are ignored by the EFF crowd. At the bare minimum it has been used as an intelligence honeypot because most users have no idea what they are doing. Google, FB, and so on forcing SSL may have reduced this value a little bit.

Re: Russia offers $110,000 to crack Tor anonymous network

#58

Post by EGreg » Mon, Jul 28, 2014, 4:01 PM UTC

Must be some small agency there, not really representing "Russia"

And anyway why cant people then just use Freenet or some such network?

Re: Russia offers $110,000 to crack Tor anonymous network

#59

Post by leonh » Mon, Jul 28, 2014, 4:21 PM UTC

jonahx wrote: post #35

nanoscopic wrote: post #32

I already posted publicly online how to find the identity of a Tor user. To reiterate: 1. Get the Tor user in question to visit a website controlled by you ( or at least a site where you can cause JS to run; such as an advertisement ) 2. Know which ISP the user is on, and be allowed to install a high speed device watching all traffic for a sequence of specific sized packets. 3. Use the JS to send a specifically craft…

I assume a Tor user with js turned off would be immune to this?

I don't think so. What you could do is have the webserver set up chunked encoding on a resource (say an image) and vary the size of the chunks for each user.

Re: Russia offers $110,000 to crack Tor anonymous network

#60

Post by cantankerous » Mon, Jul 28, 2014, 4:23 PM UTC

scarmig wrote: post #56

Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

I saw this headline and immediately thought, "that's much too low." But I've got no idea how much that vulnerability would actually go for. Millions? Tens of millions? Anyone with a stronger understanding of the market have any rough estimate?

I'm like you, I'm not sure how to assign a dollar value to this vulnerability. The implications of a broken TOR are huge for all players, especially over time. Considering TOR protects the livelihood (and lives even) of so many people who employ it, it doesn't seem unreasonable to put the ticket price up in the tens of millions to me. TOR's mission-critical for the work of a lot of folks, shady-dealings or no.