Bitcoin Forum

http://www.hackersnewsbulletin.com/2014/08/warrant-allows-fbi-hack-install-malware-tor-users.html

Wow that article is very badly written.


Looks like the author didn't even bother to read the blogpost that the Tor Project put up: https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack

In short: they are COMPLETELY different attacks. The attack in the OP's article is the one that was used against Freedom Hosting back in August 2013, where they hacked the freedom hosting server and served up malicious javascript to anyone visiting the kiddy porn sites they were hosting.

This issue has been patched (it was a 0-day exploit in Firefox) and similar exploits can be prevent by DISABLING JAVASCRIPT like you are supposed to do when using Tor as javascript can do all sorts of evil things such as this.

The attack detected by the Tor Project recently is MUCH more serious. It involves running hundreds of malicious Tor nodes and using traffic analysis techniques to determine the users IP. It was also used to determine the IP's of the hidden services they were visiting. This kind of attack was already well known in theory, it is just the first time someone has successfully pulled it off, especially in a large scale and for such a long time (5 months).

Additionally it shows a huge failure on the part of the Tor Project as they had actually detected these malicious nodes hours after they originally came online in January but they thought that it wasn't enough nodes to pull off the attack.

Please note that this attack was ONLY executed against people visiting Tor hidden services. If you used Tor for general internet browsing you are unaffected. In addition it has been found out that the attack was executed by security researchers and it appears they are going to destroy all the information they collected (users IP's) so we dodged a bullet this time.

The writing in this article is atrocious and the points made are mostly inaccurate
The WIRED article it links to near the start is astronomically better than the one thrown together by this crappy hackernews ripoff.
http://www.wired.com/2014/08/operation_torpedo/

Yes thats a much better article.

So which one of those articles tells the truth? I find it highly interesting that the US are trying to undermine the TOR network and use it (want to use it?) to spy on people and on the other hand donate millions to that program in order to improve people's privacy???

Thats because different government agencies have different goals. The US military need Tor to protect their communications hence why they donate to it. Tor hinders FBI investigations hence why they attack it.

The CIA have admitted to spying on the senate and distributing drugs overseas. The NSA have placed backdoors in crypto which was used by other government agencies. Each agency does what it needs to do to fulfill its goals, even if it conflicts with the goals other agencies.

http://www.theguardian.com/world/2014/jul/31/cia-admits-spying-senate-staffers
http://en.wikipedia.org/wiki/Allegations_of_CIA_drug_trafficking#CIA_and_Kuomintang_opium_smuggling_operations

Americans always trying to control the internet... and they always fail.
not to worry the quicker exploits pop up the quicker people find a way to stop it. as spoke says "the needs of the many out way the needs of the one" you let them find weakness then you brick it up make them do all the hard work its what there paid for  ;D

"We’re All Criminals and Outlaws in the Eyes of the American Police State" (http://ronpaulinstitute.org/archives/featured-articles/2014/august/04/we%E2%80%99re-all-criminals-and-outlaws-in-the-eyes-of-the-american-police-state.aspx)

good job i dont behave on the internet then (insert evil smile)

P.S for anyone's information if you dont like whats on the internet then turn it off by smashing your computer with a hammer. the internet isnt evil aslong as you dont look for evil on it

FBI NSA CIA can do whatever they want whether court ordered or not in my opinion if you are in their cross hairs beware

So, lots of users will go to jail soon for doing doggy thing?

They already did. This attack was executed back in August 2013:
http://bitcoinmagazine.com/6113/freedom-hosting-taken-down-founder-arrestes-users-fed-javascript-exploits/
http://www.wired.com/2013/09/freedom-hosting-fbi/

Germany much?

nope British... wish i was Germany or Russian though  ;D

i don't even use tor anymore now that i have my coins in cold storage.. and if i did still use it, i'd use it on tails.

They will probably go after tails next. Think there is an exploit being done on tails two weeks ago.

I only went on tor a couple times using tails live cd, what are the chances to get in trouble like that (and you live outside US).
Well even if i am outside us they have done what they wanted, put fear into people so im not using tor again. its not like i found much interesting stuff anyway tho.

what's the difference?

If you use Tor for browsing the internet, such as browsing bitcointalk.org or any "clearnet" website, you would not be affected by this attack.

If you visited a hidden service like silkroadssdadgs.onion or any other .onion website you could've been de-anonymized, but the issue has been fixed so not anymore but similar kinds of attacks are still possible.

they should be sued for this

malware in a user from the Netherlands buying weed on Silk Road

he's not doing anything illegal and the FBI doesn't have jurisdiction there

You are right, but sadly this is entirely legal for them to do.

One of the websites they placed the javascript malware on was Tormail, a free webmail service that did not host anything illegal but was just hosted on the same server as kiddy porn sites. I had an email account there and was targetted by the malware yet I had done nothing wrong.

Luckily I was unaffected by the malware though as I of course disable javascript when using Tor, but no doubt the FBI have read all of my unencrypted email there.

After they were done with the malware they shut Tormail down. I had used the email address as a sign-up email address for lots of websites and it was a real pain to change them all. I didn't have the password for some of the accounts and had to abandon them and make new ones because I could no longer receive emails to my Tormail account. One of the accounts was a Bitcoin gambling website and I lost my balance there, it was small at the time but is probably worth a lot now.

haha operation torpedo yeah.... right... :-\

the interwebz should gather a great LOIC army to fire at first fbi.gov and then other US goverment websites as vendetta for this act

Denial of Service attacks against an informational websites are the wrong way to solve this. That will achieve nothing, their shitty website will go down for a brief amount of time and that'll be it.

We should instead build software/tools to defend our privacy and fight back by making such kind of attacks impossible. Hopefully next time there won't be any email servers for them to hack because we'll have something better - something much more resilient to these kind and other kinds of attacks.

why not? :)

we will show we're "more trouble then gain" aka. we won't be worth to take down, there will be more to lose then to gain

Because somebody else will try the same thing. The FBI don't care if you DOS their site, it's just a website people go to to get information on the FBI, what they do etc. Why would they care? it doesn't inconvenience them in anyway - it's a waste of time, most people working in the FBI wouldn't even notice it was down or even care if they did notice. People have DOS'ed it before many times, nobody cared. Fight back by beating them at their own game.

I think it will be very interesting to see the outcome of Russ Ulbrichts latest motion. The government wont say how they got to him. I see his case going to the supreme court one day if its not in his favor.

 ;D

Glad to hear that normal users remain unaffected.

I read the title, and I instantly think "Ah sh1t."

Then I read it only applied to those who went to the darknet/deepnet, and I didn't think that any more.

The lesson here kids is this: Go to the darknet, and you'll get malware. Don't go to the darknet and you'll probably be fine.

him and kim dotcom should team up with julian assange and edward snowden and own the US government and make them there bitches. if those 4 got together that really would make the US shit its pants. now thats a fight id love to see.

I would not be surprised if the case went to the supreme court. It appears that the government did some shady things in trying to Dox DPR (n/k/a Ross Ulbright)