Tor is an interesting example. A number of attacks are made possible by monitoring Tor exit node traffic, especially at the scale nation states can bring to the table.

https://en.m.wikipedia.org/wiki/Tor_(network)#Exit_node_eave...

Sure-- but that structural shortcoming has been a thing for a long time-- I wouldn't consider it a secret vulnerability that Tor was facilitating for US intelligence, as was initially implicated. I'm not in the field, but it seems like it would be way more useful for law enforcement working against criminals naive enough to think tor would be a one-stop op-sec solution (e.g. ANOM) than for nation-state-level counterintelligence.

  I'm not in the field, but it seems like it would be way more useful for law enforcement working against criminals naive enough to think tor would be a one-stop op-sec solution (e.g. ANOM) than for nation-state-level counterintelligence.

you must have noise to hide a signal

I think that's the most solid example.

Methods provide the highest leverage if you “own” the common element used across the most system components ie the lowest common denominator.

Saying it another way, don’t attack platforms, tools and channels, attack protocols since they are used across platforms, tools and channels

To this end, some examples:

Attack on

1) encryption - RSA backdoor

https://blog.cloudflare.com/how-the-nsa-may-have-put-a-backd...

2) hardware - Processor Backdoor

https://forums.whonix.org/t/expert-claims-nsa-has-backdoors-...

(this link is specifically great for this subject as it lists more than 10 different attack / compromise programs that are being run - with quite a few of them being protocol attacks - in the comments section )

3) networking - network gear firmware backdoor

https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

Uk gov selling or giving enigma away knowing they had broken it

UK government selling a German product / war gadget? That doesn't make sense.

If I remember correctly, Tor has been broken due to 'threat actors' owning enough exit nodes to successfully de-anonymize traffic given enough time and information.

pretty sure this is hearsay from a message board, but I can't for the life of me recall where or when I heard this.

Carnegie Mellon has worked on this https://www.theverge.com/2015/11/11/9719098/fbi-reportedly-p...