Deanonymizing Tor Circuits

Re:Deanonymizing Tor Circuits by mirimir on Sunday February 02, 2020 @08:39AM (#22216848)

The issue isn't that the CMU people exploited the "relay early" bug. It's that the FBI subpoenaed all their data, tracked down onion services, and served malware.

This is just the outcome from busting one site, PlayPen:

    At least 350 U.S.-based individuals arrested
    25 producers of child pornography prosecuted
    51 hands-on abusers prosecuted
    55 American children successfully identified or rescued
    548 international arrests, with 296 sexually abused children identified or rescued

https://www.fbi.gov/news/stories/playpen-creator-sentenced-t...

[ Parent | on HN ]

Re:Deanonymizing Tor Circuits by belorn on Sunday February 02, 2020 @10:21AM (#22217282)

While that linked article does not directly talk about relay early, this article does: https://blog.torproject.org/did-fbi-pay-university-attack-to...

The article says that they likely did not have a warrant and simply just went and hired the researcher directly.

But fair enough, the claim that hundreds did get tracked down and arrested, due to a bug found by a security researcher after getting hired by the FBI, is true.

People selling zero days vulnerabilities is a major problem to security. Sadly it is something which new threat models need to take into consideration. The Tor Project did change how the Tor browser bundle updates, and I suspect this event did also caused some ripples in the project in how much they can trust researchers.

[ Parent | on HN ]