Hacker News Reader

Comment by tptacek | Hacker News Reader

Metacommentary:

I've taken a jaundiced view of "liberation tech" efforts in the past and this is as good an illustration as any of why. Among "amateur" libtech projects, Tor is about as good as you get --- an active community, extremely widespread use, technical people with their heads screwed on right and as much humility as you can reasonably expect of people whose projects are (candidly) intended to thwart world governments.

If Tor can't provide meaningful assurances (here, there's a subtext that Tor actually made NSA's job easier), you'd need an awfully convincing reason for how you're going to do better than they are before "liberating" the Chinese internet, especially given that it your users who assume the real risks.

View on HN

I didn't read it that way at all, in fact, it sounds like Tor is sufficiently robust that a good number of NSA employees were tasked with finding exploits. In terms of the exploits found, it looks like all were against the browser.

  Tor is a well-designed and robust anonymity tool, and 
  successfully attacking it is difficult. The NSA attacks we 
  found individually target Tor users by exploiting 
  vulnerabilities in their Firefox browsers, and not the Tor 
  application directly.

Tor enabled them to filter down Internet traffic to a subset, and then they simply violated the security premise behind real-world Tor usage (that the rest of the stack was secure) to pierce the veil completely.

I'm not indicting Tor. The opposite. But in Iran, China, or Belarus, you don't get to call a foul ball when your libtech stack breaks somewhere you weren't working on.

And again, my concern isn't Tor, but the (far more amateurish) things people come up with as new Tor alternatives to e.g. "circumvent the great firewall".

The principle I'm trying to communicate is that there's a degree of chauvinism implicit in amateur libtech --- that despite the billions of dollars any real country can leverage against Internet privacy, indie developers have a fighting chance against Iran, because after all they're just a tinpot dictatorship.

The other more general principle I try to communicate is that it doesn't matter how nice, or even how necessary, any given bit of security technology is. What matters is the engineering: will it work as deployed. Not having a better answer doesn't change the engineering fact of whether the best current solution is viable.

tptacek, I'm not sure I understand: do these new revelations really indicate indie developers don't have a fighting chance against Iran?

U.S. - absolutely, no fighting chance.

China - chances look slim.

Iran, Belarus - are you familiar with the technical achievements of their NSA equivalents, and so came to the conclusion they're likely as good as the NSA? Or maybe what the NSA did is just generally easy to do in your opinion?

Iran spends ~10bn/yr for the "on the books" part of their military. How much vulnerability research do you think $500MM buys? Answer: a lot.

Sure, still got hacked by Russian usb's though. What I'm seeing (the slides, Mr Alexander and so forth) is a huge list of incompetent dinosaurs in key positions. Sure there are skilled - very skilled - people all over the place, NSA, Iran, India, China, Australia, Cyprus (you name it). Sure the NSA employs more mathematicians than anybody else.

They have vision of hackers with AK Rifles on their back, wearing masks? Logos with a planet and a huge eye spying on it?

The flops these Agencies do, might surpass the successes by far. The thing is that you need dig in order to find out the real story. Hollywood even makes movies, advertising epic failures for wins (i.e. Argo, seriously???).

Sure, still got hacked by Russian usb's though.

It seems unlikely that similar systems in any country would have remained unpenetrated in the face of that attack.

Just because one entity in a country got hacked, it doesn't mean other entities in the same country can't hack others. At the moment attack seems much easier than defence.

We don't know if the NSA has been penetrated, but given that Google's law enforcement search system was penetrated by unknown parties originating from China it would surprise me if the NSA has remained free from breaches.

Yes, but I'm not sure that justifies the end conclusion:

1. Do we actually know Iran spends $500MM on vulnerability research? What about Belarus?

2. Suppose they do. So they have zero-day exploits, sure. IIUC, you need MITM capabilities to execute an attack on tor like the NSA did. This sounds costly, and I'm not sure it can be outsourced like buying zero-days. It also requires, ummm, "being on good terms" with telcos, backbone providers etc., which I'm not sure Iran is.

So I'm not saying it's inconceivable that Iran can attack tor users, but the opposite also sounds plausible.

Would you bet your life on the answer?

No, I certainly wouldn't. That doesn't make the answer clear, though.

If your point is that Iranian and Belarusian dissidents need to be aware of the risk, I agree.

I don't think your fears are justified by the article. The first thing you read is a pull-out quote that says:

>Tor is a well-designed and robust anonymity tool, and successfully attacking it is difficult.

Maybe you're referring to:

>The very feature that makes Tor a powerful anonymity service, and the fact that all Tor users look alike on the internet, makes it easy to differentiate Tor users from other web users.

Your kind words about the Tor project are accurate, but they have never claimed that it's possible to reliably hide Tor use.

The next sentence is:

>On the other hand, the anonymity provided by Tor makes it impossible for the NSA to know who the user is, or whether or not the user is in the US.

There is no Tor exploit or new information here. The NSA has enough resources to recognize Tor users in the USA enmasse, as well as single-out individual connections. From this point on, FoxAcid works the same whether you're using Tor or not.

>(here, there's a subtext that Tor actually made NSA's job easier)

I'm not sure how you reached that conclusion.

The slides mention that Tor is:

* Very difficult to identify on the network-level, since Tor-tls traffic is indistinguishable from Apache-tls traffic as of 2011

* Impossible to fully deanonymize

* Only exploitable via a handful of browser exploits.

Further, later in the "Tor is the King" slide deck, there's this rather glowing endorsement of the TAILS livecd:

"Tails... adds severe misery to CNE equation."

...which is what you'd expect, given that TAILS is entirely ephemeral, and so all of their callbacks and APT-style attacks are useless against it.

I had previously considered TAILS a rather "amateur" system myself, because of the glut of livecds bundling Tor. But it turns out they're actually adding severe(!) misery to the NSA's exploitation team! I'm downloading the TAILS cd now so I can switch over to using it in a VM rather than running Tor Browser Bundle on my own machine.

link: https://tails.boum.org/download/index.en.html

Will tails still only use ram and no disk within a vm? If not, you'll just have a slightly better tor browser bundle (plus other features) right? I always thought the "ram only" portion of tails was one of the biggest anonymity wins.

If the VM doesn't have a disk, then yes...

TAILS will detect it is running inside a VM and warn you not to do it.

I know quite a few folks who are sitting on escapes for popular VM products. They are not at all uncommon.

I would be absolutely shocked if the NSA's little toolkit didn't detect virtualization, pop out, and backdoor the host OS.

And if you run it on your main machine it could exploit it and mount hard drive. You need another diskless computer just for this...

Are there any small, cheap laptops with optical drives?

Another alternative is having enough 1gb usb sticks to be able to throw them away on a regular basis. Sort of like burner phones.

(Personally I'm not sure I want to go so far as to buy a separate computer for private use now, but I might as well know how to do it.)

You can get various flash types with read only switches, though whether these can actually stop writes I dont know. Optical drives are harder to get now, but old computers are widely available I suppose, and less traceable.

Not just diskless, but somehow incapable of flashing the BIOS, rewriting the CPU microcode, and loading new firmware into the NICs and other peripherals.

CPU microcode is volatile. BIOS flash used to be jumper protected on old PCs, and many NICS you could remove the flash if you didnt want them to be bootable.

Used to have some machines with zip flash sockets you could remove while the machine was running (useful for flashing linuxbios aka coreboot in the old days).

Not really your modern laptop though.

...or run with trustworthy full disk encryption.

Even TAILS worries me slightly. Why? Homogeneity. The same thing that makes a freshly booted TAILS "clean" and exactly the same as any other freshly booted TAILS also means that it's a "known quantity" to an attacker.

A lot of obscure vulnerabilities that would normally require a "perfect storm" to be used together to compromise a system are much easier to construct once you know a lot about the target system. And it would be well worth the time for an attacker to develop an exploit that would work against all TAILS users.

In the same way the Firefox heap spraying attack was specifically targeted against users of the Tor Browser Bundle. There, homogeneity was a large part of victims' downfall. TAILS is arguably many times more homogeneous.

ASLR and related technologies are a (very very basic) start but we may not have better answers to things like this until we have the likes of binary diversity as described in http://lwn.net/Articles/565113/ being usable (Even then, a final binary compilation stage would need to be taken by an application user before use).

Edit: and yes, you don't need to point out that the TBB vulnerability did heap spraying in Firefox's JIT and so binary diversity would probably have been minimally effective.

I wouldn't really consider Tor an amateur libtech product since the basics of the underlying technology (onion routing) was developed by the US Navy.

Here's the original patent from 1998:

http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=...

here, there's a subtext that Tor actually made NSA's job easier

Are you reading anything from that subtext beyond, "Tor has a high concentration of the kind of users we're interested in, so let's keep it a juicy target rather than squeezing too hard?"

As I understand it, which admittedly isn't well, it made surveillance jobs easier when its users mistook anonymity and privacy. That is, sending something through the tor network means that it's more likely that your traffic is going through a node belonging to a group that records everything than if your traffic randomly found a point to point route across the internet.

I don't see how using the Tor network could make you less anonymous, unless as you point out, it's use suggests a user's greater likelihood of sending and receiving interesting information.

It hurts the system that exit nodes have been targeted for content that other users were responsible, but from how I have read, Tor can provide people meaningful anonymity that is difficult breach.

As an aside: What is the effect of such parenthetical statements? I think they just create a vague idea of uncertainty and fear. If there is a vulnerability, there has to be a mechanism, not just a sense of omnipotent government surveillance.

Maybe that mechanism is the probabilistic likelihood of an organization controlling a large portion of the Tor nodes' ability to identify users. Maybe it's a flaw that has been surreptitiously put into the source code. I'm pretty sure more people who know would suspect the former as far more likely than the latter. It's easier to address the questions when you know what the parenthetical utterance was even referring to in the first place.

Side note: no intermediate node in the Tor network can see your traffic in clear. They just see the encrypted data. The only node that could see what are you sending is the exit node, but that can be solved easily using HTTPS.

HTTPS is not to be trusted against an NSA-level adversary, since the CA system is too weak.

I don't know that it really is subtext here, but I suspect that Tor has many people communicating electronically where they would otherwise refuse to do so at all. In other words, "Normally I would refuse to talk about this on the internet and would meet you in the back of the bar instead, but I trust Tor so let's discuss this now."

It therefore puts communications that previously would not have been available to the NSA into the realm of things that the NSA can access.

Wouldn't those people have used encrypted communications over Usenet[1] or burner cell phones? Or sometimes even anonymous remailers?

And all those are just as tricky. De-anonymizing alt.anonymous.messages (http://ritter.vg/blog-deanonymizing_amm.html)

Certainly, many would. Would as many though?

What chance does a ragtag team of people from various backgrounds working part time on a open source project have against a determined enemy with billions in funding and hordes of PHDs working full time with single goal of violating privacy of netizens.

A better chance than one would think from that phrasing, as there are a lot of highly motivated and intelligent people working on privacy tech.

It doesn't matter. Protecting privacy is too big a goal.

In the end, why does the NSA do what it does? To get specific, actionable intelligence. Everyone in the world's privacy is just collateral damage.

But, turn that around. Protecting your privacy (never mind anyone else's) is too big a goal. It's too easily breached. Instead, think of what specific information you feel you need to keep private, and how you might do that.

Of course, the goal of keeping specific, actionable information secret leads to the question of why you'd want to do that. A general desire for privacy doesn't mark you as one of the "bad guys". Having something specific to hide leads to questions of why? To what end? Should we be worried?

Thats why we all should keep as much privacy as possible, if not for the sake of feeling a need for it ourselves, but to help out those who feel so. It is easier for them to hide among the mass of encrypted traffic and privacy-aware activities rather than stand out there on their own, shining like a light bulb to the NSA and other adversaries.

Boycott surveillance, encrypt everything.

"Having something specific to hide leads to questions of why? To what end? Should we be worried?"

Why do you close the doors when you go to the bathroom? What are you hiding? Should we be worried?

Because it's polite and it limits the diffusion of bad smells. If you really want to see my dick all you have to do is go on chatroulette. No need to follow me to the toilet. Unless you're interested in more than just looking.

Point is not that you have an altruistic reason for wanting privacy for certain parts of your life (which I'm sure you do). The point is that once the very act of wanting privacy starts becoming suspicious, we've moved away from a free society towards the totalitarian end of the spectrum.

And some of us are quite happy on that side of the spectrum.

That's entirely not the point. Even with 1000x the amount of funding, TOR would still be theoretically proven to be insecure. Only physicially secure hardware (including cables and routers) stands a chance against side-channel traffic analysis.

Speaking of which, now is probably a great time to mention that the Berkman Center is doing an open call for fellowship applications:

http://cyber.law.harvard.edu/getinvolved/fellowships

And I'm sure the EFF is looking too.

Reply on news.ycombinator.com