Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Russia offers $110,000 to crack Tor anonymous network

bbc.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Russia offers $110,000 to crack Tor anonymous network

#61

Post by middleclick »

AJ007 wrote: post #57
kar-kub wrote: post #23

Last paragraphs are very interesting: "In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government co…

It isn't just FUD, there are some serious questions that have been raised which are ignored by the EFF crowd. At the bare minimum it has been used as an intelligence honeypot because most users have no idea what they are doing. Google, FB, and so on forcing SSL may have reduced this value a little bit.

What are these questions?

Re: Russia offers $110,000 to crack Tor anonymous network

#62

Post by leonh »

robertfw wrote: post #43
jonahx wrote: post #35

Earlier quoted context omitted.

I assume a Tor user with js turned off would be immune to this?

I wonder if something similar could be done with detecting specifically sized images?

I think this will be a bit harder, as you don't really have control in what order the images are being loaded. They could be loaded in parallel for example. If you try to circumvent it by adding delay's on the server side you quickly block the browser as you will reach the maximum amount of parallel connections.

Re: Russia offers $110,000 to crack Tor anonymous network

#63

Post by middleclick »

mnem wrote: post #51
bjelkeman-again wrote: post #33

Earlier quoted context omitted.

I was of a slightly different impression, but have no idea what is the "truth". "Tor was not started by the US Navy. The US Naval Research Labs (NRL) started a project in the 1990s called onion routing7. Tor uses the basic onion routing principles and applies them to the Internet. The volunteer Tor group started in 2001. The formal charity, The Tor Project, started in 2006. We continue to work with Dr. Paul Syverson…

Not started by the US Navy but started by US Naval Research Labs instead? Is there any practical difference except where it appears on a military budget sheet? :) If you ignore some of the drama, Pando has a very long and fairly comprehensive look at its funding (at least, it seemed comprehensive to me, I am not a Tor expert) - http://pando.com/2014/07/16/tor-spooks/

The Pando article is FUD at its best.

Yes, the government funds Tor. Pando thinks that all of the US government is akin to the NSA and wants to spy on people. This is not how it works. The government is not just one body and there are many parts of it that probably don't agree with what the NSA is doing.

Yes Tor is funded by the US government. My question is, how does it matter? The protocol is open. The code is open. There are research groups at some major universities researching on Tor.

Let the code speak, not fear mongering.

Re: Russia offers $110,000 to crack Tor anonymous network

#64

Post by orbifold »

kar-kub wrote: post #23

Last paragraphs are very interesting: "In its 2013 financial statements, the Tor Project - a group of developers that maintain tools used to access Tor - confirmed that the US Department of Defense remained one its biggest backers. The DoD sent $830,000 (£489,000) to the group through SRI International, which describes itself as an independent non-profit research centre, last year. Other parts of the US government co…

The primary intended purpose of the tor network was to provide cover for US agents. Many of the core developers of TOR have at various times either directly worked for US intelligence or have been funded by them. It was opened to the public and popularized, because an anomization network that is only used by spies is pointless. Most of the current exit nodes are currently located in the US, so there is no question that almost all TOR traffic is monitored by the NSA. The tradeoff is that while TOR makes it slightly harder to identify targets, the majority of them use TOR and there are still ways to identify them if they are not extremely careful (this has been revealed in some of Snowdens documents).

Re: Russia offers $110,000 to crack Tor anonymous network

#66

Post by uptown »

scrollaway wrote: post #2

As Schneier says: "The reward of $114,000 seems pretty cheap for this capability. And we now get to debate whether 1) Russia cannot currently deaonymize Tor users, or 2) Russia can, and this is a ruse to make us think they can't." https://www.schneier.com/blog/archives/2014/07/russia_paying...

"or 2) Russia can, and this is a ruse to make us think they can't."

Even if they could ... why say anything at-all? Perhaps - to encourage use of an exploitable method of communication, but even-then why would somebody looking to hide use a form of communication they know is actively being targeted by the government they're looking to evade?

Re: Russia offers $110,000 to crack Tor anonymous network

#67

Post by aroman »

jcromartie wrote: post #40
Steuard wrote: post #6

How on Earth is $110,000 a reasonable value for this level of vulnerability? (And with a multi-thousand dollar up front cost to boot.) I'm not remotely an expert on security, much less nefarious black-market hacks, but I would think that a whole lot of nations around the world would be willing to pay millions (each!) for this capability. Heck, if not for this, I would have included Russia on that list.

The "hackathon" spirit has caught on at the state level. Get a bunch of college kids to slave away for free and give the best one a paltry sum for their efforts and retain all rights to the work.

How is that the "hackathon" spirit?

Re: Russia offers $110,000 to crack Tor anonymous network

#68

Post by AnthonyMouse »

robertfw wrote: post #43
jonahx wrote: post #35

Earlier quoted context omitted.

I assume a Tor user with js turned off would be immune to this?

I wonder if something similar could be done with detecting specifically sized images?

You're all making this much too complicated. Who needs the client to make multiple requests when you control the server? Client does "GET /" and the server starts sending a large index.html using irregular sized packets at specific intervals.

But suppose we broke it, now we have to fix it, right? Start padding everything to power-of-two size boundaries with a minimum of 16. Or if that would make Tor traffic too identifiable, then instead add random()%packetsize padding to each packet. Either would reduce the number of detectable packet sizes below a 1500 byte MTU to 8 at the cost of less than doubling the bandwidth consumption.

Re: Russia offers $110,000 to crack Tor anonymous network

#69

Post by jessaustin »

kiiski wrote: post #21
jessaustin wrote: post #12

Earlier quoted context omitted.

It wasn't clear to me from the article that there was any sort of time limit. Presumably a researcher could simply enter the contest once he was sure he had an exploit? The math doesn't really work out for profitability.

The deadline is August 13th, and the winner (if any) will be announced on the 20th. (According to an Helsinki Times article, but the English translation[1] doesn't have the dates) [1]: http://www.helsinkitimes.fi/finland/finland-news/domestic/11...

Then the point stands. If a Russian researcher has an exploit on the 13th and thinks the prize is worth it, she'll enter. Why would anyone else enter? With that in mind, the proposed profit model seems unlikely.

Re: Russia offers $110,000 to crack Tor anonymous network

#70

Post by TeMPOraL »

aroman wrote: post #67
jcromartie wrote: post #40

Earlier quoted context omitted.

The "hackathon" spirit has caught on at the state level. Get a bunch of college kids to slave away for free and give the best one a paltry sum for their efforts and retain all rights to the work.

How is that the "hackathon" spirit?

It's the spirit ever since the term "hackaton" caught the attention of the employers and the events are organized by companies for their profit instead of hobbysts/enthusiasts just for fun.
Post reply on HN