Sydney - While privacy advocates have a natural issue with surveillance online, there’s another side to it which can’t be ignored. The FBI took over a system which had been providing "anonymity" services last year, and the facts are only now emerging.
This network was more of a risk than a protection, in more ways than one.WIRED explains:It wasn’t ever seriously in doubt, but the FBI yesterday acknowledged that it secretly took control of Freedom Hosting last July, days before the servers of the largest provider of ultra-anonymous hosting were found to be serving custom malware designed to identify visitors.To explain: The ultra-anonymous hosting was by definition a flag of its major recommendation for users and therefore signposted for anyone looking for information. Hardly trustworthy, even in theory, and even by the low standards of the internet.WIRED continues:Freedom Hosting was a provider of turnkey “Tor hidden service” sites — special sites, with addresses ending in .onion, that hide their geographic location behind layers of routing, and can be reached only over the Tor anonymity network. Tor hidden services are used by sites that need to evade surveillance or protect users’ privacy to an extraordinary degree – including human rights groups and journalists. But they also appeal to serious criminal elements, child-pornography traders among them.On August 4, all the sites hosted by Freedom Hosting — some with no connection to child porn — began serving an error message with hidden code embedded in the page. Security researchers dissected the code and found it exploited a security hole in Firefox to identify users of the Tor Browser Bundle, reporting back to a mysterious server in Northern Virginia. The FBI was the obvious suspect, but declined to comment on the incident. The FBI also didn’t respond to inquiries from WIRED today.
Reading is a right, not an excuse to intrude on people's privacy.
image:111297:1::0
It's naive to assume that nobody else plugged in to Tor. This network has "target" written all over it. The ability to get valuable information would be enough of an incentive for crime groups and online info entrepreneurs.There were some interesting payoffs for the nasties with the Tor system, too. A big botnet on the Tor Network was instantly compromised, as Threatpost.com explains, simply by using Tor:MEvade, the massive botnet using Tor as a communication protocol, may have moved operations to the network in order to hamper potential takedown efforts, but according to security researchers, the move just served to shine a spotlight on the botnet’s activities.Rather than hide traffic from bots to command and control servers, moving to Tor by the millions just alerted researchers and Tor’s handlers that something was amiss. The botnet went undetected—possibly for years—and then suddenly because it caused a spike in Tor usage in a matter of days, the botnet was outed.This was abuse of the whole idea of anonymity, by both network and botnet, and it blew up in their faces. The sheer scale of usage was an instant flag to security monitors. I’m not going to regurgitate the threatpost.com post in detail, but it’s an interesting study in how “anonymity” turns into “advertisement”.Big risksThis supposedly anonymous network was obviously dangerous, but it also could have easily compromised activists and journalists doing sensitive, perhaps risky work. Identity analysis can create a lot of additional risks, and identities are very monetizable commodities. The added presence of clearly criminal elements on the network made it even more vulnerable to the possibility of cybercrime and exploitation of the network’s sheer range of users. This was a “scalable atrocity” in embryo, at least.Which raises an obvious issue: How do activists and journalists ensure their own security? There’s a certain amount of work you can do safely, but at a given threshold, security matters.Real anonymity isn’t that easy to achieve. You need:Proven networks operated by credentialed people who know how to manage their own securityMultiple layers of de-identificationSoftware to detect identification attempts available to users.Clean servers, with no folksy hardware or software additions. (Servers are primary targets, the usual suspects in any security breach.)Working legal definitions?While a mere theory of law isn’t necessarily the answer to anything per se, good law can define issues very effectively. Identity theft is a serious problem globally, and it’s also a very hot business security issue, incorporating privacy and security ramifications.It doesn’t help law enforcement to be chasing bogus identities.It doesn’t help the public that “privacy” is making it a target for abuse of privacy.It doesn’t help security that anonymous networks are so easily compromised. Better to have a bona fide legal argument with a service which is actually providing anonymity, than one which might be exploiting the demand for privacy for criminal or perhaps terrorist purposes.Defining the issues does help.Clarifying the dichotomies between legitimate privacy and the legitimate work of law enforcement agencies needs to be done.Security agencies need to be able to do their jobs, with clear law to support them.The FBI did the right thing despite the large amount of theoretical fog in which it has to carry out some operations. It acted effectively, preventing major risks, without compromising the basic requirement of users for privacy and anonymity. The people using the network were evidently at more serious risk from the network itself than from law enforcement.Privacy, security, and law need to get on the same page, fast. These parasitic elements have to go. The Tor network could be seen as a prototype for a very dangerous range of dummy “private” networks. The service provided is enticing to many, and the likely client base could be huge.The inevitable result would be to create an instant feed of valuable, private information to undesirable elements.Anonymity, in fact, is an actual legal right, under some forms of privacy law. It’s pretty easy to join the dots to prove that breach of anonymity on those terms is an offense, civil and statutory. It’s in everyone’s interests to keep “anonymity” strictly in context with law, rights, and security.This issue must not even be allowed into the Too Hard Basket. It’s too important, and the risks are too great. Simple tweaking of basic privacy rules can establish “anonymity” as a working form of privacy, within statutory best practice.
This network was more of a risk than a protection, in more ways than one.WIRED explains:It wasn’t ever seriously in doubt, but the FBI yesterday acknowledged that it secretly took control of Freedom Hosting last July, days before the servers of the largest provider of ultra-anonymous hosting were found to be serving custom malware designed to identify visitors.To explain: The ultra-anonymous hosting was by definition a flag of its major recommendation for users and therefore signposted for anyone looking for information. Hardly trustworthy, even in theory, and even by the low standards of the internet.WIRED continues:Freedom Hosting was a provider of turnkey “Tor hidden service” sites — special sites, with addresses ending in .onion, that hide their geographic location behind layers of routing, and can be reached only over the Tor anonymity network. Tor hidden services are used by sites that need to evade surveillance or protect users’ privacy to an extraordinary degree – including human rights groups and journalists. But they also appeal to serious criminal elements, child-pornography traders among them.On August 4, all the sites hosted by Freedom Hosting — some with no connection to child porn — began serving an error message with hidden code embedded in the page. Security researchers dissected the code and found it exploited a security hole in Firefox to identify users of the Tor Browser Bundle, reporting back to a mysterious server in Northern Virginia. The FBI was the obvious suspect, but declined to comment on the incident. The FBI also didn’t respond to inquiries from WIRED today.
Reading is a right, not an excuse to intrude on people's privacy.image:111297:1::0
It's naive to assume that nobody else plugged in to Tor. This network has "target" written all over it. The ability to get valuable information would be enough of an incentive for crime groups and online info entrepreneurs.There were some interesting payoffs for the nasties with the Tor system, too. A big botnet on the Tor Network was instantly compromised, as Threatpost.com explains, simply by using Tor:MEvade, the massive botnet using Tor as a communication protocol, may have moved operations to the network in order to hamper potential takedown efforts, but according to security researchers, the move just served to shine a spotlight on the botnet’s activities.Rather than hide traffic from bots to command and control servers, moving to Tor by the millions just alerted researchers and Tor’s handlers that something was amiss. The botnet went undetected—possibly for years—and then suddenly because it caused a spike in Tor usage in a matter of days, the botnet was outed.This was abuse of the whole idea of anonymity, by both network and botnet, and it blew up in their faces. The sheer scale of usage was an instant flag to security monitors. I’m not going to regurgitate the threatpost.com post in detail, but it’s an interesting study in how “anonymity” turns into “advertisement”.Big risksThis supposedly anonymous network was obviously dangerous, but it also could have easily compromised activists and journalists doing sensitive, perhaps risky work. Identity analysis can create a lot of additional risks, and identities are very monetizable commodities. The added presence of clearly criminal elements on the network made it even more vulnerable to the possibility of cybercrime and exploitation of the network’s sheer range of users. This was a “scalable atrocity” in embryo, at least.Which raises an obvious issue: How do activists and journalists ensure their own security? There’s a certain amount of work you can do safely, but at a given threshold, security matters.Real anonymity isn’t that easy to achieve. You need:Proven networks operated by credentialed people who know how to manage their own securityMultiple layers of de-identificationSoftware to detect identification attempts available to users.Clean servers, with no folksy hardware or software additions. (Servers are primary targets, the usual suspects in any security breach.)Working legal definitions?While a mere theory of law isn’t necessarily the answer to anything per se, good law can define issues very effectively. Identity theft is a serious problem globally, and it’s also a very hot business security issue, incorporating privacy and security ramifications.It doesn’t help law enforcement to be chasing bogus identities.It doesn’t help the public that “privacy” is making it a target for abuse of privacy.It doesn’t help security that anonymous networks are so easily compromised. Better to have a bona fide legal argument with a service which is actually providing anonymity, than one which might be exploiting the demand for privacy for criminal or perhaps terrorist purposes.Defining the issues does help.Clarifying the dichotomies between legitimate privacy and the legitimate work of law enforcement agencies needs to be done.Security agencies need to be able to do their jobs, with clear law to support them.The FBI did the right thing despite the large amount of theoretical fog in which it has to carry out some operations. It acted effectively, preventing major risks, without compromising the basic requirement of users for privacy and anonymity. The people using the network were evidently at more serious risk from the network itself than from law enforcement.Privacy, security, and law need to get on the same page, fast. These parasitic elements have to go. The Tor network could be seen as a prototype for a very dangerous range of dummy “private” networks. The service provided is enticing to many, and the likely client base could be huge.The inevitable result would be to create an instant feed of valuable, private information to undesirable elements.Anonymity, in fact, is an actual legal right, under some forms of privacy law. It’s pretty easy to join the dots to prove that breach of anonymity on those terms is an offense, civil and statutory. It’s in everyone’s interests to keep “anonymity” strictly in context with law, rights, and security.This issue must not even be allowed into the Too Hard Basket. It’s too important, and the risks are too great. Simple tweaking of basic privacy rules can establish “anonymity” as a working form of privacy, within statutory best practice.