This is an interesting point.
Why would the NSA infiltrate the network if they developed it and control enough exit nodes to keep extensive logs anyway?
Topic: Half of all Tor sites compromised, Freedom Hosting founder arrested. (Read 5099 times)
September 17, 2013, 01:18:23 AM
September 17, 2013, 01:15:02 AM
Well isn't that something! I just assumed most exit nodes were honeypots and never bothered snooping around .onion sites.
September 16, 2013, 03:50:21 PM
Tor was not compromised. Only the servers hosting half of the hidden service and users browser if JS was not disabled.
For those only skimming this thread, this is the correct answer. (doesn't mean it isn't pretty bad, but an important distinction to be made nonetheless)
Thanks
September 16, 2013, 12:19:57 PM
August 08, 2013, 09:26:16 AM
Wow, thats super legit. Somebody should build a chrome-os type thing off of that for clients. Its made for that type of thing. Problem is youd likely get very bad load times, am I right? Still, I'm sure some people would have a use for it.
Wow, with Whonix & Bitcoin, its possible to practically use the entirity of the internet, payments & all, without any privacy concerns whatsoever. Its good to the point of being disconcerting.
Wow, with Whonix & Bitcoin, its possible to practically use the entirity of the internet, payments & all, without any privacy concerns whatsoever. Its good to the point of being disconcerting.
No. Technology can not alleviate all privacy concerns. You still need to engage your brain. Even sentence structure and word choice habits can be used to pinpoint your identity.
Quote
In any case, wouldn't it be possible to build it right into the browser? I mean, everything in the browser, all plug-ins, etc... would either not work, or would have to go through tor. Thatd be much more convenient than having to completely re-boot into an entirely different OS just to use tor.
Again, no. If you do it all in the browser, you expose yourself to browser exploits. Browsers have pretty much the largest attack surface of any major piece of software. Even with an OS based solution, you are vulnerable to kernel exploits. However, kernels receive much better auditing and have a much smaller attack surface.
August 05, 2013, 03:07:18 PM
1. Disable JS
2. Enable NS
3. Use VPN for backup connection, NOT directly from your ISP.
4. be smart
2. Enable NS
3. Use VPN for backup connection, NOT directly from your ISP.
4. be smart
August 05, 2013, 11:28:29 AM
Kids, the way to use Tor is to have your firewall to intercept ALL your outgoing connections and route em via Tor proxy. Flash or no flash.
How does one go about doing this?
August 05, 2013, 07:56:25 AM
Quote
In any case, wouldn't it be possible to build it right into the browser? I mean, everything in the browser, all plug-ins, etc... would either not work, or would have to go through tor. Thatd be much more convenient than having to completely re-boot into an entirely different OS just to use tor.
Or something like this: http://learn.adafruit.com/onion-pi/overview
August 05, 2013, 07:50:12 AM
Quote
In any case, wouldn't it be possible to build it right into the browser? I mean, everything in the browser, all plug-ins, etc... would either not work, or would have to go through tor. Thatd be much more convenient than having to completely re-boot into an entirely different OS just to use tor.
Or something like this: http://learn.adafruit.com/onion-pi/overview
August 05, 2013, 07:46:46 AM
Quote
In any case, wouldn't it be possible to build it right into the browser? I mean, everything in the browser, all plug-ins, etc... would either not work, or would have to go through tor. Thatd be much more convenient than having to completely re-boot into an entirely different OS just to use tor.
August 05, 2013, 06:39:10 AM
Tor was not compromised. Only the servers hosting half of the hidden service and users browser if JS was not disabled.
For those only skimming this thread, this is the correct answer. (doesn't mean it isn't pretty bad, but an important distinction to be made nonetheless)
August 05, 2013, 05:59:22 AM
Kids, the way to use Tor is to have your firewall to intercept ALL your outgoing connections and route em via Tor proxy. Flash or no flash.
Agreed. Correct settings and no problem.
August 05, 2013, 12:09:04 AM
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.
Wow, I thought tor protected you from this kind of hack in some way. Isn't there some way of stopping all non-tor connections automatically? I mean, like doing some way of catching all traffic that isn't through tor, and blocking it all. Clearly it would get in the way sometimes, but going without JS sorta makes the majority of websites useless.
I was under the impression there was some 0-day firefox exploit that allowed the hacker to download some .exe (or equiv) file to the client computer and execute it, and get the IP in that way.
In a perfect world, there would be an https-style warning "this site is attempting to display some content to you outside of the tor network, do you want to allow" or the like.
Quote
Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[5], Debian GNU/Linux[6] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP.
Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.
https://whonix.org/wiki/Main_PageWhonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.
Wow, thats super legit. Somebody should build a chrome-os type thing off of that for clients. Its made for that type of thing. Problem is youd likely get very bad load times, am I right? Still, I'm sure some people would have a use for it.
Wow, with Whonix & Bitcoin, its possible to practically use the entirity of the internet, payments & all, without any privacy concerns whatsoever. Its good to the point of being disconcerting.
In any case, wouldn't it be possible to build it right into the browser? I mean, everything in the browser, all plug-ins, etc... would either not work, or would have to go through tor. Thatd be much more convenient than having to completely re-boot into an entirely different OS just to use tor.
August 04, 2013, 10:10:29 PM
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.
Wow, I thought tor protected you from this kind of hack in some way. Isn't there some way of stopping all non-tor connections automatically? I mean, like doing some way of catching all traffic that isn't through tor, and blocking it all. Clearly it would get in the way sometimes, but going without JS sorta makes the majority of websites useless.
I was under the impression there was some 0-day firefox exploit that allowed the hacker to download some .exe (or equiv) file to the client computer and execute it, and get the IP in that way.
In a perfect world, there would be an https-style warning "this site is attempting to display some content to you outside of the tor network, do you want to allow" or the like.
Quote
Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network[5], Debian GNU/Linux[6] and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP.
Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.
https://whonix.org/wiki/Main_Page Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.
August 04, 2013, 10:09:32 PM
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.
Wow, I thought tor protected you from this kind of hack in some way. Isn't there some way of stopping all non-tor connections automatically? I mean, like doing some way of catching all traffic that isn't through tor, and blocking it all. Clearly it would get in the way sometimes, but going without JS sorta makes the majority of websites useless.
I was under the impression there was some 0-day firefox exploit that allowed the hacker to download some .exe (or equiv) file to the client computer and execute it, and get the IP in that way.
In a perfect world, there would be an https-style warning "this site is attempting to display some content to you outside of the tor network, do you want to allow" or the like.
August 04, 2013, 10:03:14 PM
fucktards are gonna be fucktards, all there is to it.
August 04, 2013, 09:59:45 PM
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
It's a script so it can do quite a number of things. One thing it can do is launch different protocol handlers, ie. Flash, which when launched won't know to connect through the Tor client and will connect through your regular connection - because that's what it does by default. So you'd load the site on Tor and some component thereof on your regular connection, which needless to say, compromises your identity.
August 04, 2013, 09:54:29 PM
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
TOR is a networking tunnel system. Your computer is still connected to the internet with an IP address. Not sure how many people turned on javascript or failed to turn it off. The javascript could also create cookies which could be queried elsewhere. I am not sure of specifics but cookies and javascript would be the downfall.
Again - research browser packages. Trying to set all the stuff up yourself is asking to have these exploits left open. (but might possibly save you from nefarious third-parties if the tor browser package has been compromised.)
August 04, 2013, 09:53:44 PM
Forgive me if I'm being naiive, but this doesn't quite make sense to me?
So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?
EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?
So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?
EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?
Basically you can do that with Flash, Javascript, and a few other web languages.
Usually NoScript stops all these things in the browser bundle, but they don't have it enabled by default because it breaks a lot of sites and they are trying to capture more, less savvy users.
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
From what I understand it basically drops a little bomb that ticks off a ping when you use the browser outside of TOR, or something to that extent. I could be completely mistaken.
August 04, 2013, 09:49:22 PM
Forgive me if I'm being naiive, but this doesn't quite make sense to me?
So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?
EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?
So somehow freedom hosting was hacked, and the hacker put some malicious JS on each of freedom hosting's hosted websites, and used that hack to put software on freedom hosting's machine to ascertain its location. That part seems reasonable & believable. But, apparently the JS somehow got at the viewer's IP? That seems like, sorta a major bug in the Tor software? Couldn't any admin anywhere use that code to get at the viewer's IP, in theory? Unless I'm understanding something wrong?
EDIT: so the tor browser had some sort of a glitch that allowed malware to be downloaded to the computers, and then apparently ping one of the attacker's computers outside of tor to get the IP of the viewer?
Basically you can do that with Flash, Javascript, and a few other web languages.
Usually NoScript stops all these things in the browser bundle, but they don't have it enabled by default because it breaks a lot of sites and they are trying to capture more, less savvy users.
What? Then whats the entire point of tor? Wtf?
I still don't see how JS is getting my IP, though. I'm using TOR, the browser is the TOR browser. I assume (i'm not an expert) that all connections through that browser have to hop through tor, right? So how is the JS opening the connection outside of TOR, in order to get the IP?
Jump to: