Total Members: 14197
Posted by: Samker
« on: 11. October 2013., 18:37:10 »
An NSA presentation released by Edward Snowden contains mixed news for Tor users. The anonymizing service itself appears to have foxed US and UK government snoops, but instead they are using a zero-day flaw in the Firefox browser bundled with Tor to track users.
"These documents give Tor a huge pat on the back," security guru Bruce Schneier told The Register. "If I was a Tor developer, I'd be really smiling after reading this stuff."
The PowerPoint slide deck, prepared in June last year and entitled "Tor stinks", details how the NSA and the UK's Government Communications Headquarters (GCHQ) have been stymied by trying to track Tor users, thanks to the strength of the open source system: http://www.theguardian.com/world/interactive/2013/oct/04/tor-stinks-nsa-presentation-document
"We will never be able to de-anonymize all Tor users all the time," the presentation states. "With manual analysis we can de-anonymize a very small fraction of Tor users, however, no success de-anonymizing a user."
The presentation says that both the NSA and GCHQ run Tor nodes themselves (the Brits use Amazon Web Services for this under a project entitled Newton's Cradle), but these are only a very small number in comparison to the whole system. This makes tracking users using traditional signals-intelligence methods impossible.
There's also a case of diminishing returns as Tor becomes more popular. With each user acting as a transport node, the sheer scale of the system means it becomes steadily more difficult for the intelligence community to run enough nodes to be useful for tracking.
The agencies have also tried to use "quantum" cookies to track targets who are using Tor. Some cookies appear to persist after Tor sessions, the presentation notes, and the agencies are investigating if this can be developed into a working tracking system.
A separate leaked document from GCHQ, published in the Washington Post, gives an indication of how this could be done: http://apps.washingtonpost.com/g/page/world/gchq-report-on-mullenize-program-to-stain-anonymous-electronic-traffic/502/
Operation Mullenize is a technique for "staining" individual user's computers with trackable code, and is now being rolled out after a year of development. Over 200 stains were injected onto systems in two months last year, the report notes.
There are also indications that the NSA had been trying to influence the design of Tor to make it more crackable, a somewhat Kafkaesque approach given that Tor is primarily funded by the US government itself to provide anonymity to internet users operating under repressive governments.
The NSA has been accused of this before, having been said to be deliberately weakening NIST encryption standards. But Schneier said in the case of Tor, the agency appears to have had little luck.
"It's harder than you think to sneak stuff in," Schneier said. "If you show up and say 'Here, I've got some Tor code!' I don't think you're going to get it in. As far as we know, they've had no success doing that."
But documents shown the The Guardian by Snowden indicate that the intelligence organizations have also been trying sneakier methods in a delightfully named attack dubbed EgotisticalGiraffe: http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption
This targets the software that is bundled with Tor, specifically version 17 of the Firefox browser which was vulnerable to a zero-day attack.
It's an attack vector that was adopted by the hacking community after operating system vendors started getting smarter about security, and which spawned a rash of attacks against third-party software such as Java and Adobe Reader. Now the NSA is using the same methods to track and crack Tor users.
"It should hardly be surprising that our intelligence agencies seek ways to counteract targets' use of technologies to hide their communications," the NSA told the paper in a statement.
"Throughout history, nations have used various methods to protect their secrets, and today terrorists, cybercriminals, human traffickers and others use technology to hide their activities. Our intelligence community would not be doing its job if we did not try to counter that."
Mozilla has now fixed the Firefox flaw used in EgotisticalGiraffe, but it seems likely that a fair few Tor users won't have updated their software as often as they should and may still be vulnerable. But Cindy Cohn, legal director of the Electronic Frontier Foundation, told The Register that the methods used by the NSA and GCHQ were immensely worrying.
"They are using the kind of techniques that federal prosecutors send people to jail for decades for using," she said. "These are tools that are criminal, and I'm still wondering what's the authority? What kind of authority are they claiming that they can do this?"
Cohn said the courts need to know how data is being collected before warrants are issued. She pointed out that the NSA has already been fingered for passing information to the Drug Enforcement Agency and the Internal Revenue Service, which then covered up where they got their data from.
"You really have to question if there is a rule of law anymore?" Cohn said.
"If the government gets to essentially burn down your house because it thinks you're engaging in illegal activity and then hide the fact by pretending there was an arsonist around at some point, it's not a lawful situation," she said. "There's a fundamental thing that's being lost here for an allegedly self-governing country."
(ElReg)