http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-sustained-attack-on-tor-to-decloak-crime-suspects/[0]
By:
http://arstechnica.com/author/dan-goodin/[1]
Originally published Jan 21, 2015 9:15 pm UTC
Did feds mount a sustained attack on Tor to decloak crime suspects?
Court doc suggests investigators spent six months last year exploiting anonymity bug.
Last week's arrest of a man alleged to help run the Silk Road 2.0 online drug bazaar[2] has touched off speculation he was identified using a controversial attack that for six months last year systematically worked to deanonymize users of the Tor privacy service.
In a search warrant affidavit filed earlier this month,[3] a special agent with the Department of Homeland Security said the Silk Road follow-on site was accessible only as a hidden service on Tor, a measure that typically would have made it impossible to identify the IP addresses hosting the underlying servers, as well as IPs used by end users who accessed them. Despite the use of Tor, FBI investigators were able to identify IP addresses that allegedly hosted and accessed the servers, including the Comcast-provided IP address of one Brian Farrell, who prosecutors said helped manage SR2. In the affidavit, DHS special agent Michael Larson wrote:
The timeframe of the information leak bears a striking resemblance to a deanonymization attack uncovered in July by Tor officials.[4] For six months, the people behind the campaign exploited a previously unknown vulnerability in the Tor protocol to carry out two classes of attack that together may have been enough to uncloak people using Tor Hidden Services. The decloaking effort began in late January 2014 and ran until early July when Tor officials shut it down. The Tor officials said the characteristics of the attack resembled those discussed by a team of Carnegie Mellon University researchers who a few weeks earlier canceled a security conference presentation on a low-cost way to deanonymize Tor users.[5] The Tor officials went on to warn that an intelligence agency from a global adversary also might have been able to capitalize on the vulnerability.From January 2014 to July 2014, a FBI NY Source of Information (SOI) provided reliable IP addresses for TOR and hidden services such as SR2, which included its main marketplace URL (silkroad6ownowfk.onion), its vendor URL (vx3w763ohd256iyh.onion), its forum URL (silkroad5v7dywlc.onion) and its support interface (uz434sei7arqunp6.onion). The SOI's information ultimately led to the identification of SR2 servers, which led to the identification of at least another seventeen black markets on TOR.
The SOI also identified approximately 78 IP addresses that accessed a vendor .onion address. A user cannot accidentally end up on the vendor site. The site is for vendors only, and access is only given to the site by the SR2 administrators/moderators after confirmation of a significant amount of successful transactions. If a user visits the vendor URL, he or she is asked for a user name and password. Without a user name and password, the vendor website cannot be viewed.
Nicholas Weaver,[6] a security researcher at the University of California at Berkeley and the International Computer Science Institute, said that besides the six-month window of the two attacks, they are also connected by the way they work.
"If the victim connected to one of the attacker's relays and queried a hidden service onion name that was being served by the attackers' hidden service directory, the attacker could say: 'This IP attempted to access this hidden service,'" Weaver told Ars. "The capabilities used to provide the information to the FBI match the capabilities that the attack [uncovered by Tor officials] provided."
"If the victim connected to one of the attacker's relays and queried a hidden service onion name that was being served by the attackers' hidden service directory, the attacker could say: 'This IP attempted to access this hidden service,'" Weaver told Ars. "The capabilities used to provide the information to the FBI match the capabilities that the attack [uncovered by Tor officials] provided."
Officials with the Black Hat security conference, where the Tor deanonymization attack was scheduled to be presented last August, said the talk was pulled because the results had "not yet been approved"[7] by officials from Carnegie Mellon University and the school's Software Engineering Institute, which conducted the research. The research has never been published or publicly commented on since.
Over the past 18 months, federal investigators have been shown to use several attacks to identify suspected criminals using Tor to conceal their IP addresses. Decloaking techniques have included exploiting vulnerabilities in Firefox[8] and Adobe Flash.[9] The details provided in the recently unsealed search warrant strongly suggest federal investigators have tried at least one other technique that went well beyond those previous efforts. The affidavit makes clear SR2 was only one hidden services investigators were able to decloak. It wouldn't be surprising to see other .onion addresses in the federal cross hairs soon.
- [0] --Did feds mount a sustained attack on Tor to decloak crime suspects?
http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-sustained-attack-on-tor-to-decloak-crime-suspects/ - [1] --Dan Goodin
http://arstechnica.com/author/dan-goodin/ - [2] --[Alleged “right hand man” to Silk Road 2.0 leader arrested in Seattle
http://arstechnica.com/tech-policy/2015/01/alleged-right-hand-man-to-silk-road-2-0-leader-arrested-in-seattle/ - [3] --UNITED STATES OF AMERICA v. BRIAN RICHARD FARRELL
cdn.arstechnica.net/wp-content/uploads/2015/01/5498263-0-14302.pdf - [4] --Active attack on Tor network tried to decloak users for five months
http://arstechnica.com/security/2014/07/active-attack-on-tor-network-tried-to-decloak-users-for-five-months/ - [5] --Tor developers vow to fix bug that can uncloak users
http://arstechnica.com/security/2014/07/tor-developers-vow-to-fix-bug-that-can-uncloak-users/ - [6] --Nicholas Weaver
http://www1.icsi.berkeley.edu/~nweaver/ - [7] --Black Hat | USA 2014: A Schedule Update
https://www.blackhat.com/latestintel/07212014-a-schedule-update.html - [8] --Attackers wield Firefox exploit to uncloak anonymous Tor users
http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users/ - [9] --Feds used Adobe Flash to identify Tor users visiting child porn sites
http://arstechnica.com/security/2014/12/feds-used-adobe-flash-to-identify-tor-users-visiting-child-porn-sites/
