Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

wired.com

Post reply on HN
Print view View original

51–58 of 58 posts

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#51

Post by meowface »

debacle wrote: post #43
meowface wrote: post #15

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an…

Isn't it recommended that users turn off JavaScript when trying to anonymize?

Yes.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#52

Post by PhantomGremlin »

pbhjpbhj wrote: post #47
lotsofcows wrote: post #39

Apparently it's a surprise to Wired that a group that engages in hacking uses a tool commonly used for hacking.

The surprise is surely that a group expected to use complex and highly technical exploits which come from the minds of top government crackers instead uses years old hacks distributed with a tool known, rightly or wrongly, as the preserve of script-kiddies everywhere?

Who exactly are the "top government crackers"? Probably not the FBI. It's unlikely that the CIA or NSA would give the FBI the time of day, let along give them access to the latest exploits. Many reports have highlighted the lack of cooperation between government agencies. E.g. [1]

   agency cultures resistant to change and
   new ideas; inappropriate incentives for
   promotion; and a lack of cooperation
   between the FBI, CIA and the rest of
   the United States Intelligence Community.
   ...
   FBI personnel practices continue to treat
   all staff other than special agents as
   support staff, classifying intelligence
   analysts alongside the FBI's auto mechanics
   and janitors
Who knows if any of that is true anymore, but it's unlikely that giant organizations (especially government bureaucracies) can change their stripes in timeframes shorter than decades.

[1] https://en.wikipedia.org/wiki/Federal_Bureau_of_Investigatio...

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#53

Post by wazoox »

smtddr wrote: post #31
meowface wrote: post #15

This article is talking about 2 different things. If you write a simple Flash program that opens a socket to a remote server, you can embed that on a site and use it to identify certain people running through Tor or any other SOCKS/HTTP proxy. It will only catch people who have configured their proxy very poorly. This has been known for well over a decade and it just catches the low-hanging fruit; it's really not an…

>>It will only catch people who have configured their proxy very poorly. To add to this, in Firefox if you use this: http://i.imgur.com/ajT98xC.png , Flash does not obey it. I kinda think Mozilla should put some kind of warning-text on this dialog window to warn uses that it doesn't apply to flash, silverlight or any plugins. This surprised me at first but it makes sense if you think about it. You really have to do a…

Wait a minute, how does flash reach the web if your access is only through a proxy, then?

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#54

Post by smtddr »

wazoox wrote: post #53
smtddr wrote: post #31

Earlier quoted context omitted.

>>It will only catch people who have configured their proxy very poorly. To add to this, in Firefox if you use this: http://i.imgur.com/ajT98xC.png , Flash does not obey it. I kinda think Mozilla should put some kind of warning-text on this dialog window to warn uses that it doesn't apply to flash, silverlight or any plugins. This surprised me at first but it makes sense if you think about it. You really have to do a…

Wait a minute, how does flash reach the web if your access is only through a proxy, then?

https://forums.adobe.com/message/4262734

Hmmmmmm..... So from what I gather here, if the ActionScript is using the regular getURL[1] that call is passed to the browser and will be proxied. But if flash tries to open up a raw socket[2] on its own, it won't know about the proxy and will just fail(or reveal your true IP)

1. http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?cont...

2. http://help.adobe.com/en_US/FlashPlatform/reference/actionsc...

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#55

Post by smtddr »

alex_duf wrote: post #46
smtddr wrote: post #31

Earlier quoted context omitted.

>>It will only catch people who have configured their proxy very poorly. To add to this, in Firefox if you use this: http://i.imgur.com/ajT98xC.png , Flash does not obey it. I kinda think Mozilla should put some kind of warning-text on this dialog window to warn uses that it doesn't apply to flash, silverlight or any plugins. This surprised me at first but it makes sense if you think about it. You really have to do a…

Careful, sshuttle doesn't route UDP, and by default does not route DNS requests either. For Firefox, I don't think they should bother anyway, the world is killing flash, if you want to be anonymous on the internet use noscript and don't install flash in the first place.

Oh wow! Thanks for this heads up!

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#56

Post by pbhjpbhj »

PhantomGremlin wrote: post #52
pbhjpbhj wrote: post #47

Earlier quoted context omitted.

The surprise is surely that a group expected to use complex and highly technical exploits which come from the minds of top government crackers instead uses years old hacks distributed with a tool known, rightly or wrongly, as the preserve of script-kiddies everywhere?

Who exactly are the "top government crackers"? Probably not the FBI. It's unlikely that the CIA or NSA would give the FBI the time of day, let along give them access to the latest exploits. Many reports have highlighted the lack of cooperation between government agencies. E.g. [1] agency cultures resistant to change and new ideas; inappropriate incentives for promotion; and a lack of cooperation between the FBI, CIA…

>Who exactly are the "top government crackers"? //

I was saying that was the expectation, that one perceives that the government has the best people on the job, the brightest minds in the pen community. I'm open to that not being true but surely with their financial clout the US Gov has some such people at hand whether that be in the NSA/FBI or [other] armed forces?

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#57

Post by meowface »

smtddr wrote: post #54
wazoox wrote: post #53

Earlier quoted context omitted.

Wait a minute, how does flash reach the web if your access is only through a proxy, then?

https://forums.adobe.com/message/4262734 Hmmmmmm..... So from what I gather here, if the ActionScript is using the regular getURL[1] that call is passed to the browser and will be proxied. But if flash tries to open up a raw socket[2] on its own, it won't know about the proxy and will just fail (or reveal your true IP) 1. http://help.adobe.com/en_US/AS2LCR/Flash_10.0/help.html?cont... 2. http://help.adobe.com/en_US/F…

This is correct.

Re: The FBI Used the Web’s Favorite Hacking Tool to Unmask Tor Users

#58

Post by cbd1984 »

coldtea wrote: post #28
cbd1984 wrote: post #24

Earlier quoted context omitted.

> People always demanding hard proof seem to have an inability to draw conclusions for themselves. I shall notify the scientific journals of this conclusion forthwith. Next up: "The abstract is just TL;DR culture which is killing literacy. If you want to know what's in a paper, read it. "

> I shall notify the scientific journals of this conclusion forthwith. No, you should just re-read the part that says: > Welcome to real life, where you have to make up your mind with what you have available. People have to learn to use and correlate the information they have, historical information, precedent etc, and make up a model for what's going on, instead of demanding some sanctious data to be passed upon the…

This contributes nothing to the discussion and is jerkish besides.
Post reply on HN