Half of all Tor sites compromised, Freedom Hosting founder arrested.

[fr33d0miz3r]

dencentralized domain name service .bit

you mean .adamstgBit ?

Seriuosly, domain names .onion are not affected. There are problems with hosting service.
Namecoin can't resolve problems with hostings, JS exploits, etc.

[01BTC10]

Tor was not compromised. Only the servers hosting half of the hidden service and users browser if JS was not disabled.

[ElectricMucus]

Time to come up with a more hardened alternative to tor. The problem is that on a hidden service the content is accessible in clear text at the physical location. With 3rd party hosting the cloud should run on a shared virtual machine where information is encrypted at all points. This might be possible to do even with tor, or not.
There is supposedly this thing: https://github.com/Miserlou/OnionCloud

But I get the feeling that's not enough.

[vokain]

If i remember correctly there was a type of tormail you could use that did not use javascript when accessing your email

[01BTC10]

If i remember correctly there was a type of tormail you could use that did not use javascript when accessing your email

You had the choice between http://roundcube.net and http://squirrelmail.org

I think Squirelmail don't need JS.

[vokain]

If i remember correctly there was a type of tormail you could use that did not use javascript when accessing your email

You had the choice between http://roundcube.net and http://squirrelmail.org

I think Squirelmail don't need JS.

you're right, that one didn't.

[BitCoiner2012]

I am still a bit confused, are the users that were injected/infected the ones affected, or all users of the Tormail, IE the database and all data within it? I really can't derive this from the story. Both are important, but one is a lot more potent!

[01BTC10]

I am still a bit confused, are the users that were injected/infected the ones affected, or all users of the Tormail, IE the database and all data within it? I really can't derive this from the story. Both are important, but one is a lot more potent!

According to a Sunday blog post by the Tor Project's Executive Director, Andrew Lewman, the servers of Freedom Hosting were breached before the service went offline. "From what is known so far, the breach was used to configure the server in a way that it injects some sort of JavaScript exploit in the Web pages delivered to users,"  Lewman wrote. "This exploit is used to load a malware payload to infect user's computers.

They most likely dumped all databases if they could but didn't physically seized the servers since they don't know the exact location.

The servers themselves are likely run on a "bulletproof" hosting service in Romania or Russia; Irish law enforcement authorities told the court Friday that Marques had transferred large sums of money to accounts in Romania and had been investigating obtaining a visa to enter Russia.

http://arstechnica.com/tech-policy/2013/08/alleged-tor-hidden-service-operator-busted-for-child-porn-distribution

[DogtownHero]

tor is neither anonymous, or secure. you're all a bunch of fucking idiots. its a NSA spying network, and you idiots keep taking the bait.

[Kazu]

Forgive me if I'm being naiive, but this doesn't quite make sense to me?

So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?

EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?

[humanitee]

Forgive me if I'm being naiive, but this doesn't quite make sense to me?

So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?

EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?

Basically you can do that with Flash, Javascript, and a few other web languages.

Usually NoScript stops all these things in the browser bundle, but they don't have it enabled by default because it breaks a lot of sites and they are trying to capture more, less savvy users.

[Kazu]

Forgive me if I'm being naiive, but this doesn't quite make sense to me?

So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?

EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?

Basically you can do that with Flash, Javascript, and a few other web languages.

Usually NoScript stops all these things in the browser bundle, but they don't have it enabled by default because it breaks a lot of sites and they are trying to capture more, less savvy users.

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

[BitCoiner2012]

Forgive me if I'm being naiive, but this doesn't quite make sense to me?

So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?

EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?

Basically you can do that with Flash, Javascript, and a few other web languages.

Usually NoScript stops all these things in the browser bundle, but they don't have it enabled by default because it breaks a lot of sites and they are trying to capture more, less savvy users.

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

From what I understand it basically drops a little bomb that ticks off a ping when you use the browser outside of TOR, or something to that extent. I could be completely mistaken.

[dwma]

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

Not a problem with Tor.  A problem with people using poorly configured web-browsers waiting to be exploited to reveal IP.  I think if you download a respectable TOR package then it will have javascript disabled by default.  A site really bent on security should run a javascript capability test and enforce it upon users.

TOR is a networking tunnel system.  Your computer is still connected to the internet with an IP address.  Not sure how many people turned on javascript or failed to turn it off.  The javascript could also create cookies which could be queried elsewhere.  I am not sure of specifics but cookies and javascript would be the downfall.  

Again - research browser packages.  Trying to set all the stuff up yourself is asking to have these exploits left open. (but might possibly save you from nefarious third-parties if the tor browser package has been compromised.)

[humanitee]

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.

[DogtownHero]

fucktards are gonna be fucktards, all there is to it.

[Kazu]

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.

Wow, I thought tor protected you from this kind of hack in some way. Isn't there some way of stopping all non-tor connections automatically? I mean, like doing some way of catching all traffic that isn't through tor, and blocking it all. Clearly it would get in the way sometimes, but going without JS sorta makes the majority of websites useless.

I was under the impression there was some 0-day firefox exploit that allowed the hacker to download some .exe (or equiv) file to the client computer and execute it, and get the IP in that way.

In a perfect world, there would be an https-style warning "this site is attempting to display some content to you outside of the tor network, do you want to allow" or the like.

[01BTC10]

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.

Wow, I thought tor protected you from this kind of hack in some way. Isn't there some way of stopping all non-tor connections automatically? I mean, like doing some way of catching all traffic that isn't through tor, and blocking it all. Clearly it would get in the way sometimes, but going without JS sorta makes the majority of websites useless.

I was under the impression there was some 0-day firefox exploit that allowed the hacker to download some .exe (or equiv) file to the client computer and execute it, and get the IP in that way.

In a perfect world, there would be an https-style warning "this site is attempting to display some content to you outside of the tor network, do you want to allow" or the like.

Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[5], Debian GNU/Linux[6] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP.
Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.

https://whonix.org/wiki/Main_Page

[Kazu]

What? Then whats the entire point of tor? Wtf?

I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?

It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.

Wow, I thought tor protected you from this kind of hack in some way. Isn't there some way of stopping all non-tor connections automatically? I mean, like doing some way of catching all traffic that isn't through tor, and blocking it all. Clearly it would get in the way sometimes, but going without JS sorta makes the majority of websites useless.

I was under the impression there was some 0-day firefox exploit that allowed the hacker to download some .exe (or equiv) file to the client computer and execute it, and get the IP in that way.

In a perfect world, there would be an https-style warning "this site is attempting to display some content to you outside of the tor network, do you want to allow" or the like.

Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[5], Debian GNU/Linux[6] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP.
Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.

https://whonix.org/wiki/Main_Page

Wow, thats super legit. Somebody should build a chrome-os type thing off of that for clients. Its made for that type of thing. Problem is youd likely get very bad load times, am I right? Still, I'm sure some people would have a use for it.

Wow, with Whonix & Bitcoin, its possible to practically use the entirity of the internet, payments & all, without any privacy concerns whatsoever. Its good to the point of being disconcerting.

In any case, wouldn't it be possible to build it right into the browser? I mean, everything in the browser, all plug-ins, etc... would either not work, or would have to go through tor. Thatd be much more convenient than having to completely re-boot into an entirely different OS just to use tor.

[fr33d0miz3r]

Kids, the way to use Tor is to have your firewall to intercept ALL your outgoing connections and route em via Tor proxy. Flash or no flash.

Agreed. Correct settings and no problem.