Feds Accused Of Distributing Malware That De-Anonymizes Tor Users
from the left-hand,-meet-the-anonymous-right-hand dept
It's somewhat well known that the popular Tor anonymous browsing system gets a significant amount of funding from the US government. In the past, the suggestion had always been that the State Department was a major supporter because of its belief that Tor would help dissidents in other countries communicate better via anonymous systems. However, now there's a lot of buzz because it appears that a bit of malware that was discovered this weekend targeting Tor users, may have come directly from the FBI itself. The implication isn't against the Tor project at all, but rather it appears that whoever pushed out this malware did so by using a vulnerability targreting people using the Tor Browser Bundle -- a Firefox bundle that builds in Tor -- browsing a variety of hidden sites (available only to Tor users) hosted by the somewhat infamous Freedom Hosting. Freedom Hosting's boss, Eric Eoin Marques was arrested in Ireland last week as the US is trying to extradite him. But, what was more interesting was what some people discovered on all Freedom Hosting pages:Shortly after Marques' arrest last week, all of the hidden service sites hosted by Freedom Hosting began displaying a “Down for Maintenance” message. That included websites that had nothing to do with child pornography, such as the secure email provider TorMail.So why do people think the feds are involved? The bit of malware scoops up various identifying information -- MAC address and Windows hostname -- and then sends it to a server in Virginia to find the real IP address of the computer in question. The Virginia server is controlled by the infamous contractor SAIC, who works with numerous government agencies.
Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address located in eastern Virginia.
By midday Sunday, the code was being circulated and dissected all over the net. Mozilla confirmed the code exploits a critical memory management vulnerability in Firefox that was publicly reported on June 25, and is fixed in the latest version of the browser.
Though many older revisions of Firefox are vulnerable to that bug, the malware only targets Firefox 17 ESR, the version of Firefox that forms the basis of the Tor Browser Bundle – the easiest, most user-friendly package for using the Tor anonymity network.
It's no secret that law enforcement has wanted to identify folks who are trying to be anonymous. And, as discussed just last week, the FBI has been using malware at an increasing rate. So it wouldn't be a huge surprise to find out that little tricky bit of malware was designed to provide more info on Tor users who might be up to nefarious activity (or, you know, they might just want to surf anonymously). I imagine that this is not the end of this particular story...
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: eric eoin marques, fbi, government, malware, state department, tor
Companies: freedom hosting, saic
Reader Comments
Subscribe: RSS
View by: Time | Thread
http://arstechnica.com/tech-policy/2013/08/researchers-say-tor-targeted-malware-phoned-home-to-n sa/
[ link to this | view in chronology ]
Re:
The actual source code is available there as well in decompiled code done by Vlad Tsyrklevich. link
Long story short, most tech folks usually run in VMs with a Linux live distro and were not effected. The code itself uploads only the MAC address, IP Address, and URL to servers in Virgina, and it was directly targeting Windows users with the Tor Browser installed. Lesson learned, use a VM (defeats MAC Address), use a VPN before entering TOR (defeats IP Address), and mostly don't use Windows.
The fact that they infected TorMail is very disconcerting however and questionable to say the least.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
[ link to this | view in chronology ]
But when I tell these FACTS here at Techdirt, I get censored.
out_of_the_blue, Nov 30th, 2012 @ 1:54pm
Lie down with dogs, you get up with fleas.
I'm short on sympathy, as usual.
Listen. There MAY be "legitimate" uses for TOR, but as the obvious purpose IS to avoid some sort of laws, if police find the trail ends at you -- due to deliberate suppressing of logs on a system having purpose of hiding identity -- then you're left holding the bag, and jurors ain't gonna believe you're (totally) innocent. Smear tactics do work: you'll get a "probably guilty of something" verdict, is all.
Besides that, nothing will matter to the state except that you are HIDING something from them: that's a far greater "crime" to a state than anything actual. You self-identity just by operating these. So beware.
Now, I'd like to point out to those who believe these networks do provide anonymity is that's only true IF none are operated by gov't or its contractors, AND in any event, exit points are as easily found as any IP, so it's a simple matter to shut down ALL of those (in time). You guys who think you'll "route around" the police state keep assuming that the state will act lawfully and pretty much as at present.
Mike here quite unusually fails to mention his favorable prior pieces on "deep dark network" though is on the automatic related links.
http://www.techdirt.com/articles/20121130/07495221185/tor-exit-node-operator-charged-with- distributing-child-porn.shtml#c35
[ link to this | view in chronology ]
Re: But when I tell these FACTS here at Techdirt, I get censored.
I know I am just wasting my time, but I just so happen to have some time that needs wasting so...
I think it is worth pointing out that most people here would be more than willing to have an intelligent discussion. The reason most people report these post is because of your "holier than thou" tone. This results in us having no sympathy when your comments get hidden.
[ link to this | view in chronology ]
Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
you don't seem to mind playing the man and not the ball yourself
[ link to this | view in chronology ]
Re: Re: Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: But when I tell these FACTS here at Techdirt, I get censored.
No, the obvious purpose of Tor has to do with avoiding surveillance.
Yes, avoiding surveillance can mean someone wants to avoid having the police bust down their door and send them to county lockup for a Blue Light Special (one nightstick, hold the lube).
But it can also mean that someone wants to avoid having the government read their metadata, see what fully-legal political/news/etc. sites they visit, or other such potentially suppressive actions.
The act of avoiding surveillance exists in a neutral state; the reason why people do it makes it ‘good’ or ‘evil’, kinda like how phones exist to perform a specific action (allow two or more people to converse with each other over long distances) but also have a ‘neutrality’ to them until a person decides to use them for a specific ‘good’ or ‘evil’ purpose.
Don't go judging the technology based on its users; instead, judge the users based on what they do with the technology.
[ link to this | view in chronology ]
Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: But when I tell these FACTS here at Techdirt, I get censored.
Since you're always talking about morality, is it moral behavior to hide your identity from a government that's gone corrupt?
If only these Internet services were used exclusively for what you *think* they are...
[ link to this | view in chronology ]
Re: But when I tell these FACTS here at Techdirt, I get censored.
Your always ranting about Google and how evil they are tracking our actions, but here you suggest that Tor users all are just criminals hiding from the law. You ever stop to think maybe some Tor users are actually just avoiding the evil google tracking?
[ link to this | view in chronology ]
Re: Re: But when I tell these FACTS here at Techdirt, I get censored.
[ link to this | view in chronology ]
Re: But when I tell these FACTS here at Techdirt, I get censored.
Giving a fact is easy, like 1+1=2 is a fact. But proving it is more difficult than that.
http://tachyos.org/godel/1+1=2.html
You dispense facts like there is a fact fire sale. But where is your proof? When do you ever bother to prove any of your facts?
With the amount of shit you throw onto the wall I'm surprised more doesn't stick.
[ link to this | view in chronology ]
It's not surprising
/s
[ link to this | view in chronology ]
missing an a in targeting.
[ link to this | view in chronology ]
With almost all small computers, desktop, laptop, et, running only one operating system world wide there in a NSA dream world that allows NSA access to almost every computer. Small wander that when Microsoft was sewed for its monopolist practices by state governments the federal squished the suit.
Then there is of course sites like Facebook where is has became the chick thing to post all one confidential history for world view. Again a false monopoly sanctioned by the NSA States of America.
The said part is that computer geeks believe that they are immune to government snooping because they are geeks. This was much the attitude of the German and Russian scientists in the 1930s. Unfortunately they were not immune to the negative effects of the real world and lead mosquitoes. Wonder how the 21 century geeks are going to fair with total surveillance in a totalitarian world.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
It's a delightful train-wreck that keeps me coming back
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Tor Updates
However, checking the Tor website, something was not right. I un-installed the old setup and downloaded the newest version. After installation I check the version number. It was quite different than the 'up to date' previous version.
Y'all might want to check yours.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
https://www.eff.org/https-everywhere
https://addons.mozilla.org/en-US/firefox/addon/722
h ttps://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/c alomel-ssl-validation/
https://addons.mozilla.org/en-US/firefox/addon/6623
and probably more.
Note: in a better world, the Firefox developers would be making all of this functionality part of the base package instead of screwing around with the UI for the 38th time in a doomed attempt to dumb it down enough to scrape the bottom of the user barrel.
[ link to this | view in chronology ]
Re: Re:
We can but dream, can't we?
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Tor Financial reports
Major Program:
U.S. Department of Defense
Pass-Through from SRI International
Basic and Applied Research and Development in
Areas Relating to the Navy Command, Control,
Communications, Computers, Intelligence, 12.335 N66001-11-C-4022 $ 503,706
Surveillance, and Reconnaissance
Non-Major Program:
U.S. Department of State
Pass-Through from Internews Network
International Programs to Support
Democracy, Human Rights 19.345 S-LMAQM-08-GR-618 $ 227,118
and Labor
National Science Foundation
Pass-Through from Drexel University
Computer and Information Science
and Engineering 47.070 CNS-0959138 143,062
[ link to this | view in chronology ]
Hackers Making (very) Big Money selling flaws to Governments
[ link to this | view in chronology ]
An odd thing...
Coincidence? Maybe. I'd use Tor if that was me.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]