Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Privacy Security Communications Crime Government Network Networking Software News

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services (schneier.com) 56

An anonymous reader writes from a report via Schneier on Security: Two researchers have discovered over 100 Tor nodes that are spying on hidden services. Cory Doctorow from Boing Boing reports: "These nodes -- ordinary nodes, not exit nodes -- sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over. The researchers used 'honeypot' .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions' existence. They didn't advertise the honions' existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits. No one knows who is running the spying nodes: they could be run by criminals, governments, private suppliers of 'infowar' weapons to governments, independent researchers, or other scholars (though scholarly research would not normally include attempts to hack the servers once they were discovered)." The Tor project is aware of the attack and is working to redesign its system to try and block it. Security firm Bitdefender has issued an alert about a malicious app called EasyDoc that hands over control of Macs to criminals via Tor.
This discussion has been archived. No new comments can be posted.

Researchers Discover Over 100 Tor Nodes Designed To Spy On Hidden Services

Comments Filter:
  • by shmlco ( 594907 ) on Friday July 08, 2016 @05:35PM (#52474543) Homepage

    Anyone who thinks they can hide in the darknet is an idiot.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Anyone who thinks they can hide in the darknet is an idiot.

      You are the idiot here. You haven't even understood what you read. Nothing in the article implies that Tor doesn't work, and no "vulnerability" was found out. It actually says that it is used also for illegal purposes, such as hacking and running giant botnets, which is no news at all and makes me think that Tor works pretty well, otherwise black-hats wouldn't use it.

  • I thought everyone knew...
  • When an encryption method ia broken, normally there is a newer stronger and more secure method recommended. The flaws in Tor are hardly news now but still there is no viable and usable alternative.
    Any attempts to be anonymous or simply not be tracked and recorded in the databases of multinationals and so on is a lot of hard work these days of turning off and opting out and disabling things.

    Is there nothing better on the way? Is a dubious and untrustworthy Tor connection the last refuge of online anonymity?

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      In a panopticon privacy is, by definition, impossible. Tor or other systems like it will probably be one of the last options remaining before the surveillance states become complete. However, despite the scare stories it still does just the job pretty well for now.

      • This is why the Supreme Court needs to keep repeating again and again the right to speak, encrypted, is part of the First Amendment. Whatever the FBI or CIA or NSA wants to do, let's assume they are angels for the moment and won't abuse it politically, it is clear shitheads like Putin and China's rulers have an interest in using it to maintain power by spying on their political opponents, and arresting them.

    • by Anonymous Coward

      The fundamental weakness of tor is that it is wide open to any adversary that can see and record every connection to every computer at once, whether through a global metadata collection system like PRISM or seeding the network with hundreds of recording nodes and hoping that your nodes get used to establish a connection.

      There are no practical responses to this yet. The obvious ones are to either consume massive amounts of bandwidth on transmitting random chaff packets to make it difficult to determine the

  • In this day and age, it seems anyone who either uses Tor or operates an exit node is opening themselves to crazy risks. Especially the exit node operators. With the kind of traffic going through some of them you have to be a moron to run one...

    • by PCM2 ( 4486 )

      This story doesn't appear to have anything to do with exit nodes, so maybe there's your answer.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      "[I]t seems anyone who ... uses Tor ... is opening themselves to crazy risks"

      [citation needed]

      Tor is no less secure than a typical Internet connection. On the Open Internet your traffic passes through the networking equipment of tens of operators. With the exception of your ISP, you typically have no formal agreement with any of those operators. Any of those operators can capture and/or modify your traffic at will. It is widely known that operators have been and continue to do both of these things.

      Using Tor

    • by bill_mcgonigle ( 4333 ) * on Friday July 08, 2016 @07:54PM (#52475271) Homepage Journal

      anyone who either uses Tor or operates an exit node is opening themselves to crazy risks.

      Using Tor and operating an exit node are completely separate risk profiles.

      Especially the exit node operators.

      Not if they're libraries. [libraryfre...roject.org] Encourage your local librarians to support freedom of inquiry by joining the Library Freedom Project. [libraryfre...roject.org]

      I've been to a few of their symposia and each time the room was completely packed with librarians who had often traveled a great distance to be there.

  • by Anonymous Coward

    For no reason and not remotely connected to the topic.

    Typical Slashcrap behavior.

  • When in doubt, time to go old school. War driving for wifi, do your hacking then drive off.
    • by subk ( 551165 )
      Maybe Mr. Robot had it right... Build your lair in an abandoned arcade, or hollowed out volcano... Whatever suits your fancy. As long as you're not there when they find it, who cares?
  • I'll bet at least some of these are NSA and other governments (China etc)

    • by Anonymous Coward

      I'll bet at least some of these are NSA and other governments (China etc)

      Why not this:
      Two security researchers setup 100 honeypot tor nodes to catch... two security researchers using 100 tor nodes to spy on traffic.

      I guess I don't understand the difference in level of effort between these two activities and why one must be a government run hacking expedition while the other is two dudes in a lab.

      • by JustNiz ( 692889 )

        Do you REALLY believe that the NSA, the CIA, the FBI all have zero interest in finding out who's using TOR and for what?

  • by Anonymous Coward

    The "honions' ".

  • Easydoc? (Score:2, Insightful)

    by Anonymous Coward

    What the everloving hell does Easydoc have to do with spying Tor nodes?

    Every time Apple's in the news, BeauHD adds an irrelevant crosspost to the most recent Apple news. Same with virtually any other topic. This isn't editorializing, this adds literally nothing of value to the story.

    Please stop the crossposting irrelevancies. Haven't you heard the old saying? If you've got nothing useful to add, add nothing!

  • I wonder if it would be possible to set up a series of these honeypots in order to detect potentially-malicious activity and craft a database of nodes "promoting" malicious activity. Using that data, shape Tor traffic to avoid malicious nodes in the network. Adopting the traffic-shaping would be voluntary, ascentral control over routing is dangerous, and the body operating the "checkpoints" could act transparently.

    Not sure if the Tor protocol allows for it; this is just back-of-the-napkin thinking, but

%DCL-MEM-BAD, bad memory VMS-F-PDGERS, pudding between the ears