Hacker builds tracking system to nab Tor pedophiles

http://blogs.zdnet.com/security/?p=114

by andrewcooke • 17 years ago

16 22 17 years ago

blogs.zdnet.com

lonestar• 17 years ago

If the alleged pedophile is savvy enough to use Tor, won't he be running his web traffic over SSL, rendering this sort of attack useless?

showerst• 17 years ago

I'm not 100% certain of this, but I believe even SSL is vulnerable to certain man-in-the-middle attacks when routed through a single point like tor.

For example: http://www.teamfurry.com/wordpress/2007/11/20/tor-exit-node-...

A google search returns lots of results, although I'm unsure if any are 'in the wild' exploits.

wendroid• 17 years ago

http://www.securityfocus.com/news/11447?ref=rss

mahmud2• 17 years ago

Moore is headed to a massive government paycheck if he keeps it up. "Catching pedophiles" is the best business plan; the name practically funds itself.

count• 17 years ago

Moore is former USAF Intelligence. He already had the 'govt paycheck'.

mahmud2• 17 years ago

Officer pay != Contracting firm pay.

Every government on earth wants to tear Tor open; he stands to make it big, if he can lie hard enough :-)

siculars• 17 years ago

why would a tor user allow a java applet to be installed on his/her computer?

Zak2• 17 years ago

Great. He's breaking Tor.

I want to see pedophiles in jail too, but if Tor is broken for this purpose, Tor will become useless for any purpose. Governments and others will catch on and take advantage of the same techniques to detect whatever other activity they happen to be interested in.

If you're a supporter of the sort of privacy Tor provides, this is a Bad Thing.

lincolnq• 17 years ago

Well, it's only a Bad Thing if you consider releasing "exploit code" bad. (I wouldn't even classify this as exploit code, but...) After reading this, Tor users can decide whether they want Java applets (or any scripts, really) running on web pages they intend to view privately.

This only highlights something that individuals concerned about privacy should have known beforehand, namely that Tor is just a tool.

die_sekte2• 17 years ago

> I want to see pedophiles in jail too, […]

So you're essentially pro-thought-crime persecution. I will give you the benefit of the doubt and guess that you meant "I want to see child rapists in jail too, […]". A pedophile does not harm children just by being a pedophile or by being attracted to them, they only harm them when they abuse them.

I agree, however, with the rest of you post.

Zak2• 17 years ago

You have a point. I don't really like the idea of thought crimes, however, to create child pornography, real children have to be sexually exploited. Consuming such content encourages its production.

For what it's worth, I don't think things like child pornography that don't involve actual children should be illegal. Stories, cartoons and photoshop jobs don't involve any actual victims.

zdwiel• 17 years ago

I'm not sure if I should be glad that someone exposed a problem with tor and that the government could be exploiting it already, or if I should be sad that someone just showed the government how to do it.

cx01• 17 years ago

Note that this is an article from 2007.

andrewcooke• 17 years ago

ugh. so it is (sorry). so what happened?

[edit: from http://www.links.org/?p=205

"the Tor folks have known about this attack. It’s really hard to counter. It would be a lot more helpful for people to work on deeper browser integration to break the attack than to distribute attack code to demonstrate that a known, documented attack works."]

jxcole• 17 years ago

We saw the same sorts of issues when freenet came about. The problem is that if you build a purely anonymous system in an environment that is not oppressed (like the US), mostly people look at child porn, or share photos of people being totured/murdered/whatever. There is little logic to going to all the trouble to anonymize if you are doing something that is perfectly legal.

cema• 17 years ago

If something is legal but not accepted by the society, there is a good reason for going anonymous right there.

Or simply not wanting to be associated with something.

nollidge• 17 years ago

Unjust laws, identity theft, embarassing but perfectly legal activities... there's plenty of logic to going anonymous.

cousin_it• 17 years ago

In my opinion, downloading and looking at pictures of naked children shouldn't be a crime. Making child porn also shouldn't be a crime unless it falls under child abuse laws. For example, animated or CGI child porn should be legal because its production and consumption harms no one. (Currently it's illegal and people have gone to jail for it.) We stopped imprisoning and castrating homosexuals sometime ago, but apparently people can't internalize the too-abstract ideas of "victimless crime" and "private business". See that guy? He's a wacko, I tell you. He loves watching movies where people kill other people with guns! One day he'll get a gun and attack our kids, our precious little darlings.

And about that hacker from the article, I wonder if his system can be used to catch copyright infringers? People who download offensive texts? People who visit blacklisted sites, where the blacklist depends on the country? Human inventions are beautiful that way - you never know how other people will repurpose them. I hear the guy who invented dynamite didn't intend it to be used for killing, either.

ErrantX• 17 years ago

> Currently it's illegal and people have gone to jail for it

Actually it's something of a legal grey area in most places. If that's all your caught with then you could well just get a slap on the wrists - but that's rarely the case.

I see where your coming from with the arguments; but it's, sadly, not in any way a victimless crime.

orblivion• 17 years ago

Tor is being used for nefarious purposes? Who could have anticipated that?

Stuff like Tor is made for purposes that at least somebody considers nefarious. The relevance of this is that he apparently found a vulnerability.

codexon• 17 years ago

I see several problems with this method.

1. You need to run an exit node for unencrypted HTTP traffic to be able to inject html.

2. Tor warns you when you are potentially leaking DNS requests when you are using an old protocol like socks4 instead of sock4a. Anyone who is using Tor is presumably smart enough to activate this option on Firefox or whatever browser they happen to use,

3. The Java applet leaking DNS requests is a big hole which I believe is fixed by now. Even if it did work, it is entirely dependent on point 2 which is easily preventable.

Hacker builds tracking system to nab Tor pedophiles

Related Stories