News for hackers. Stuff that matters.
Re:Feds found Silk Road 2 servers after a six-month attack o... by moe on Wednesday January 21, 2015 @04:14PM (#8925823)
Tor is specifically designed to withstand attacks from resourceful adversaries who do not respect your fourth amendment rights.

The FBI putting it to the test provides us with valuable information both about the FBI and about Tor.

Re:Feds found Silk Road 2 servers after a six-month attack o... by hellbanner on Wednesday January 21, 2015 @04:42PM (#8925964)
"Tor does not defend against a global passive adversary" -- TOR developers.
Re:Feds found Silk Road 2 servers after a six-month attack o... by moe on Wednesday January 21, 2015 @04:50PM (#8926007)
global passive adversary

Knowing that "global passive" might include the FBI is still valuable.

Re:Feds found Silk Road 2 servers after a six-month attack o... by s_q_b on Wednesday January 21, 2015 @06:35PM (#8926524)
This was an attack by a partial active adversary.

Global = can view all network traffic. Partial = can view some portion of network traffic, but not all.

Active = willing/able to modify data as it transits the network. Passive = unable/unwilling to modify data as it transits the network.

The gold standard here would be breaking a specific user's anonymity without modifying the data, i.e. a passive attack by a partial adversary. The smaller the percentage of overall traffic that the system needs to observe, the better.

Re:Feds found Silk Road 2 servers after a six-month attack o... by tedunangst on Wednesday January 21, 2015 @05:50PM (#8926343)
I feel like "global passive adversary" is kind of like a True Scotsman. There doesn't seem to be a fixed definition; rather we work backwards from random attacks and determine whether we think they were global adversary worthy or not, and if so then that makes the perpetrator a global adversary.

Could Lizard Squad have executed this attack? (I assume anybody with a botnet could start new Tor relays, so yes.) Is Lizard Squad a global adversary?

Re:Feds found Silk Road 2 servers after a six-month attack o... by derefr on Wednesday January 21, 2015 @06:21PM (#8926479)
A global passive adversary is anyone who can execute a Sybil attack, basically. So the required size scales with the size of the network. A global passive adversary for a network with only ten nodes would only have to have five nodes itself.

The "global" adjective is just used, I think, because cryptographers presume a production deployment of the cryptosystems they discuss would be something like the Web: large enough (millions of nodes) to require globe-spanning resources (millions of other nodes owned by a single group) to execute the attack successfully.

Seen under that lens, neither Tor nor Bitcoin nor any other modern cryptosystem needs a "global" passive adversary to break it. Just a regular "passive adversary."

Re:Feds found Silk Road 2 servers after a six-month attack o... by jsmeaton on Thursday January 22, 2015 @12:46AM (#8927758)
That's really interesting. So if there were multiple "global passive adversaries" then the network would become stronger and stronger? At least until one gives up and removes all their nodes at once.
Re:Feds found Silk Road 2 servers after a six-month attack o... by derefr on Thursday January 22, 2015 @01:10AM (#8927819)
Pretty much.

Imagine if China (used for population reasons) managed to send 300 million spies to the US to socially-engineer their way into all US citizens' personal lives. Now imagine India (again, for population reasons) simultaneously trying the same thing: now, one half of the time, the Chinese are just spying on "American citizens" who are really Indian spies, the Indians are just spying on Chinese spies, and one half of Americans go unmonitored.

It's sort of the same game-theoretic advantage you get from participating in a battle royale competition over participating in a 1v1 competition: for each new adversary you face, that adversary is also dragged down by all the other adversaries and becomes that much easier to deal with.

This really only applies specifically to Sybil attacks, though.

Re:Feds found Silk Road 2 servers after a six-month attack o... by Zikes on Wednesday January 21, 2015 @04:20PM (#8925848)
It didn't teach us anything we didn't already know about the FBI, but it also does not excuse their actions any more than if we were to attack any of their networks.
Re:Feds found Silk Road 2 servers after a six-month attack o... by tptacek on Wednesday January 21, 2015 @04:50PM (#8926009)
This doesn't make sense either. LEOs routinely force entry into buildings to execute search warrants. It is not hypocrisy that you'd be prosecuted for doing the same thing without the legal authority.
Re:Feds found Silk Road 2 servers after a six-month attack o... by Zikes on Wednesday January 21, 2015 @05:11PM (#8926140)
I contest the FBI's legal authority in this case due to the indiscriminate and damaging nature of their actions.

Warrants and wiretaps are narrow and selective, but this Tor intrusion potentially damaged the anonymity of everyone on the network.

Re:Feds found Silk Road 2 servers after a six-month attack o... by tptacek on Wednesday January 21, 2015 @05:23PM (#8926205)
You still haven't managed to make a coherent case for how this attack was any more indiscriminate than a wiretap.
Re:Feds found Silk Road 2 servers after a six-month attack o... by mirimir on Wednesday January 21, 2015 @10:50PM (#8927443)
As I understand this, the CMU team allegedly deanonymized SR2 in the course of their research, and then shared the information with the FBI. Once they had done that, they were allegedly forced to withdraw their Black Hat presentation. There's also the issue that the CMU team had NSA funding. I haven't seen any claims that the CMU team was initially focusing on SR2 and other "illegal" sites. But I wouldn't be surprised by that.

If that's what happened, it wasn't a wiretap. It was a tip.

Re:Feds found Silk Road 2 servers after a six-month attack o... by tptacek on Thursday January 22, 2015 @12:13AM (#8927652)
CMU has had "NSA funding" for something like 20 years; it's the nation's software security "center of excellence", going back to CMU CERT, AKA CERT.

This is an especially silly bit of innuendo given that Tor is itself DoD funded.

Re:Feds found Silk Road 2 servers after a six-month attack o... by mirimir on Thursday January 22, 2015 @01:09AM (#8927816)
The association of SR2 deanonymization with CMU's withdrawn Black Hat presentation is indeed speculative. But there's arguably more to it than innuendo. Time will tell.

It's well known that the DoD has funded Tor from the start. But it's at least decent of them to independently fund CMU to compromise it ;)

Re:Feds found Silk Road 2 servers after a six-month attack o... by moe on Wednesday January 21, 2015 @04:27PM (#8925887)
It didn't teach us anything we didn't already know about the FBI

Well, it taught us that the FBI is capable of carrying out a successful attack against Tor.

Maybe you knew that already - I didn't.

Re:Feds found Silk Road 2 servers after a six-month attack o... by mirimir on Wednesday January 21, 2015 @10:58PM (#8927456)
It's common knowledge that the FBI, DEA, etc have typically relied on the NSA for such exploits.
Re:Feds found Silk Road 2 servers after a six-month attack o... by tptacek on Thursday January 22, 2015 @12:14AM (#8927655)
It is? Cite a credible source?
Re:Feds found Silk Road 2 servers after a six-month attack o... by mirimir on Thursday January 22, 2015 @01:18AM (#8927838)
I'm thinking mainly of EFF, Bamford's books, and the Snowden releases. Are you claiming that parallel construction isn't SOP? Reaching way back, why do you think that the Weathermen got a pass in Chicago?
Re:Feds found Silk Road 2 servers after a six-month attack o... by tedunangst on Thursday January 22, 2015 @01:35AM (#8927873)
There are at least three levels of claim that can be made here.

1. The NSA passes along tips to FBI.

2. The NSA regularly passes along tips.

3. The FBI relies on NSA tips to do its job.