Feds are Suspects in New Malware That Attacks Tor Anonymity (opens in new tab)

(wired.com)

186 pointsmagikarp12y ago33 comments

33 comments

28 comments · 8 top-level

mtgx12y ago· 6 in thread

This is illegal right? Can we use the CFAA against them? Give them a taste of their own medicine for once.

It's not illegal when you're above the law. Law enforcement in the US (well, the entire executive branch of the federal government) seems to think the law doesn't apply to them. "When the President does it, that means it is not illegal..." In the present climate, it's "When the President does it, or authorizes someone to do it..."

Centigonal12y ago

This atmosphere of apathy is a major cause of said present climate. LE isn't meeting much material resistance, even now. There's lots of media coverage, but nobody does anything. Insisting that nothing can be done is worse than saying nothing, because it inspires the attitude of inaction that has brought us to this state.

I think mtgx has got the right idea. Challenging the government in the courts, even if ultimately unsuccessful, sends a much more powerful message than the censures that have, time and time again, caused no change. Surely there are some lawyers browsing this site who can evaluate mtgx's idea.

1 more reply

Guvante12y ago

It depends on whether a search warrant was obtained. Given the article notes how similar it is to what data you can get from a search warrant, it may be the case that a court gave them a thumbs up.

jpalioto12y ago

This is not a new problem. Quis custodiet ipsos custodes?

joering212y ago

I share your feelings in re to LE; however, wouldn't any prosecution that came out of this activity be a fruit of the poisonous tree??

http://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

Can some lawyer/knowledgeable individual elaborate?

1 more reply

belorn12y ago

I would talk to EFF. If the state can be sued over Internet policy, my best guess is that the EFF lawyers know how feasible it is.

wahsd12y ago· 4 in thread

We really need to come to the internalized understanding that our government is increasingly becoming a threat to its people and a danger from within; a saboteur, a spy, a traitor to it's own people.

As Peter Swire has pointed out in a PBS Frontline interview: "General warrants was part of the reason for the American Revolution. It was that the king's agent could go in and search a house everywhere, search a whole neighborhood with one warrant. And the Boston people said: 'We don't like that. [...] We'll fight you.' We said no." (redaction to avoid erroneous similarity)

Jach12y ago

That summary is not quite in line with what the warrants were used for and ignores the context... Britain was at war with the West Indies and created new import taxes to help finance it as well as economically damage their enemy, but traders at ports such as Boston continuously traded illegally (smuggled) with the enemy, thus avoiding the needed foreign-import taxes and sustaining the enemy's well-being. Writs of assistance were authorized by the Massachusetts governor to allow customs officers to generally search ships or buildings that they suspected contained smuggled goods (and demand the assistance of local authorities), and this was pretty effective at stopping the smugglers. Naturally, the Boston merchants didn't like being deprived of their tax-free profits on the black market, so they sued: http://revolutionaryboston.wikia.com/wiki/Petition_of_Lechme... And lost, as generalized warrants, though falling out of favor, were not without precedent. (There's actually a whole book on this: http://books.google.com/books?id=pBBBwSTwdrEC&printsec=front...)

pekk12y ago

You are ready to start a revolutionary war on account of the speculation that tor is being sabotaged by USG?

chakalakasp12y ago

Is this really that bad? They used a clever exploit to reveal the identity of people attempting to be anonymous on a server that hosted a boatload of illegal content.

reflectiv12y ago

They used a clever exploit to blatantly infect and gain unauthorized access to a blanket set of machines...which may or may not have been doing something illegal.

The FBI hacked PC's technically, and with no inkling of due process...they should be held liable for it.

1 more reply

aphyr12y ago· 3 in thread

Might be worth keeping in mind that the State Department has a significant interest in TOR's continued existence, contributing roughly 60% of the TOR Foundation's annual income. Unsurprising, because TOR is a powerful tool for activists, journalists, and intelligence sources in the Middle East.

Doesn't mean the US doesn't want to weaken TOR, but it might not be that simple.

https://www.torproject.org/about/financials.html.en

khuey12y ago

The ideal outcome for the USG is that TOR provides anonymity to its users from everyone on the planet except the USG. Then people who do things they like can be protected while people who do things they don't like can be punished.

ds912y ago

Right, then if the non-US find out, they change their practices, and the surveillance may become useless. I think this is what the GP meant by saying it is complex.

mpyne12y ago

The fun part is that the NSA's mission is not at all incompatible with the State Dept.'s, taking them both at face value.

If the NSA surveils a diplomatic agent in Iran reading BBC News then, well, whatever. No harm done, for either NSA or State.

tankenmate12y ago· 3 in thread

The article is a bit light around the details of how it works; is it true that it only targets Windows machines?

barrkel12y ago

From http://tsyrklevich.net/tbb_payload.txt - yes. It uses Winsock routines and WinAPI stdcall calling conventions.

clarkm12y ago

And here's the security advisory for the vulnerability, which was fixed in Firefox 22 and Firefox ESR 17.0.7:

http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht...

SageRaven12y ago

What does the code actually deliver in the HTTP request, and what path does the request travel?

Is the exploit that the request is made outside of the TOR proxy (thus revealing the true origin IP) or that it gathers information about the host and sends that via TOR to some machine?

1 more reply

lettergram12y ago· 2 in thread

Yet another reason to use linux.

Kabacaru12y ago

It'd be trivial to change the payload to work with Linux.

pigscantfly12y ago

So logically, someone probably has.

derrida12y ago· 1 in thread

Here is Mozilla on the vulnerability: [1] https://blog.mozilla.org/security/2013/08/04/investigating-s... It would seem that Tor released Tor Browser Bundle (TBB) with 17.0.7 on the 26th of June: [2] https://blog.torproject.org/blog/new-tor-browser-bundles-and... (note: lack of an Obfsproxy bundle!) 17.0.7 is the Firefox with the patch for the JS bug that was exploited, assuming [1] is correct.

IF this was what is exploited, then it would seem that the latest non-obfsproxy Tor Broswer Bundle [2] will be ok. It seems that Tor released a new TBB the day after upstream Firefox vulnerability was patched.

Double check though.

Here's what seems to be the original security advisory [3] http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht...

Also, Tor have responded here: [4] https://blog.torproject.org/blog/hidden-services-current-eve...

derrida12y ago

Update: Tor have issued a security advisory (TL;DR: anything "Vanilla" post July 8th is ok, everybody else upgrade) https://lists.torproject.org/pipermail/tor-talk/2013-August/...

6cxs2hd612y ago· 1 in thread

> FBI special agent describing Marques as “the largest facilitator of child porn on the planet.”

Is it just me or is "facilitator" a PR weasel word?

They would have said "distributor" or "seller" if they could.

Does "facilitator" mean in the same sense that BitTorrent "facilitates" illegal MP3 downloads? Or in the sense that Verizon and Comcast do? Or in the sense that HTTP does?

i.e. Is this RIAA/MPAA style spin, or is their more substance to it?

(Not rhetorical questions. Although cynical and suspicious, I genuinely don't know.)

AsymetricCom12y ago

It's quite obvious that the child porn aspect of the case is just an excuse to take down/tap what was probably a communication hub for all sorts of fun stuff the NSA would like to hear about.

aet12y ago

Should read "suspected" -- suspects seems to mean they are being investigated for criminal activity. I'd be interested to hear what an editor as to say.

j / k navigate · click thread line to collapse

33 comments

28 comments · 8 top-level

mtgx12y ago· 6 in thread

This is illegal right? Can we use the CFAA against them? Give them a taste of their own medicine for once.

delinka12y ago

Centigonal12y ago

1 more reply

Guvante12y ago

It depends on whether a search warrant was obtained. Given the article notes how similar it is to what data you can get from a search warrant, it may be the case that a court gave them a thumbs up.

jpalioto12y ago

This is not a new problem. Quis custodiet ipsos custodes?

joering212y ago

I share your feelings in re to LE; however, wouldn't any prosecution that came out of this activity be a fruit of the poisonous tree??

http://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

Can some lawyer/knowledgeable individual elaborate?

1 more reply

belorn12y ago

I would talk to EFF. If the state can be sued over Internet policy, my best guess is that the EFF lawyers know how feasible it is.

wahsd12y ago· 4 in thread

We really need to come to the internalized understanding that our government is increasingly becoming a threat to its people and a danger from within; a saboteur, a spy, a traitor to it's own people.

Jach12y ago

pekk12y ago

You are ready to start a revolutionary war on account of the speculation that tor is being sabotaged by USG?

chakalakasp12y ago

Is this really that bad? They used a clever exploit to reveal the identity of people attempting to be anonymous on a server that hosted a boatload of illegal content.

reflectiv12y ago

They used a clever exploit to blatantly infect and gain unauthorized access to a blanket set of machines...which may or may not have been doing something illegal.

The FBI hacked PC's technically, and with no inkling of due process...they should be held liable for it.

1 more reply

aphyr12y ago· 3 in thread

Doesn't mean the US doesn't want to weaken TOR, but it might not be that simple.

https://www.torproject.org/about/financials.html.en

khuey12y ago

ds912y ago

Right, then if the non-US find out, they change their practices, and the surveillance may become useless. I think this is what the GP meant by saying it is complex.

mpyne12y ago

The fun part is that the NSA's mission is not at all incompatible with the State Dept.'s, taking them both at face value.

If the NSA surveils a diplomatic agent in Iran reading BBC News then, well, whatever. No harm done, for either NSA or State.

tankenmate12y ago· 3 in thread

The article is a bit light around the details of how it works; is it true that it only targets Windows machines?

barrkel12y ago

From http://tsyrklevich.net/tbb_payload.txt - yes. It uses Winsock routines and WinAPI stdcall calling conventions.

clarkm12y ago

And here's the security advisory for the vulnerability, which was fixed in Firefox 22 and Firefox ESR 17.0.7:

http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht...

SageRaven12y ago

What does the code actually deliver in the HTTP request, and what path does the request travel?

Is the exploit that the request is made outside of the TOR proxy (thus revealing the true origin IP) or that it gathers information about the host and sends that via TOR to some machine?

1 more reply

lettergram12y ago· 2 in thread

Yet another reason to use linux.

Kabacaru12y ago

It'd be trivial to change the payload to work with Linux.

pigscantfly12y ago

So logically, someone probably has.

derrida12y ago· 1 in thread

Double check though.

Here's what seems to be the original security advisory [3] http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht...

Also, Tor have responded here: [4] https://blog.torproject.org/blog/hidden-services-current-eve...

derrida12y ago

Update: Tor have issued a security advisory (TL;DR: anything "Vanilla" post July 8th is ok, everybody else upgrade) https://lists.torproject.org/pipermail/tor-talk/2013-August/...

6cxs2hd612y ago· 1 in thread

> FBI special agent describing Marques as “the largest facilitator of child porn on the planet.”

Is it just me or is "facilitator" a PR weasel word?

They would have said "distributor" or "seller" if they could.

Does "facilitator" mean in the same sense that BitTorrent "facilitates" illegal MP3 downloads? Or in the sense that Verizon and Comcast do? Or in the sense that HTTP does?

i.e. Is this RIAA/MPAA style spin, or is their more substance to it?

(Not rhetorical questions. Although cynical and suspicious, I genuinely don't know.)

AsymetricCom12y ago

It's quite obvious that the child porn aspect of the case is just an excuse to take down/tap what was probably a communication hub for all sorts of fun stuff the NSA would like to hear about.

aet12y ago

Should read "suspected" -- suspects seems to mean they are being investigated for criminal activity. I'd be interested to hear what an editor as to say.

j / k navigate · click thread line to collapse