0

I have stumbled upon certain articles that state that imply that Tor no longer safe.

For example, This article and this and even this post by Mozilla imply that there is some backdoor known by the governments to reveal the IP addresses of TOR users. If there is a backdoor, we cannot believe it may at this point is only known by the governments. And if this is true, I also have a question as to why it is not mentioned in the Tor official website.

I would first like to know if this case is true or false.

If this statements are true, is there any advice that can be offered to safeguard our privacy?

I am a user who loves Tor. I have meant no disrespect to the Tor project in this post.

2

No technology is 100% secure, and the FBI and Carnegie Mellon University are not 100% capable. A smart Tor user who configures and uses Tor properly can remain anonymous. The FBI and other parties are able to identify some Tor users because some Tor users leave their calling cards on the Internet for anyone to read if anyone bothers to look for the calling cards. For example: the FBI was able to identify and locate Ross William Ulbricht, a.k.a. Dread Pirate Roberts, a founder of the Silk Road web site, because Ulbricht sent unencrypted messages over the Internet that contained personal information that identified him. The FBI did not locate Ulbricht because of any weakness in Tor. Ulbricht revealed personal information about himself on different web sites. On one site, the Bitcoin Talk online forum, Ulbricht posted his personal email address rossulbricht@gmail.com. The FBI read Ulbricht's email address in the Bitcoin Talk online forum. The FBI went to Google with a search warrant. The FBI obtained Ulbricht's home address from the personal information in Ulbricht's Gmail account, which led the FBI directly to Ulbricht and his arrest.

SEALED COMPLAINT  
UNITED STATES OF AMERICA  
    - V. -  
ROSS WILLIAM ULBRICHT
Defendant  
SOUTHERN DISTRICT OF NEW YORK  
27th day of September 2013  

An FBI agent prepared the criminal complaint. The FBI agent describes in plain language in Section 39, Page 26, how he found Ulbricht's personal email mail address on the BitcoinTalk online forum.

  • As a note, the OPs reference has nothing to do with the CMU attacks and SR (allegedly Ross) wasn't taken down by CMU, SR2 (allegedly Blake) was. – cacahuatl May 16 '16 at 23:41
1

If there was a "backdoor" it would hardly be mentioned on the website, that's ridiculous.

There was (possibly) a firefox exploit, these aren't very uncommon and this is why you should run up to date software. Browsers are large, complex code bases that try to open every type of file imaginable, they have a huge attack surface. Regardless, we have yet to see any evidence that the FBI (or similar LEA) has ever deployed an exploit against what was the latest tor browser at the time.

All previous examples, except for CMU's traffic confirmation attack relied on users enabling flash or running out of date software that had known vulnerabilities in it. This means that users were either ignoring warnings about updates, using their own software or disabling things put in place to protect them from exactly the kind of thing that stung them.

The FBIs own numbers don't add up, they probably have some exploit, but given their claims of the size of the user base of the forums and the number of people they managed to exploit (a tiny fraction of that user base), it seems unlikely that there is a backdoor or even a currently useful exploit.

This doesn't mean that it's impossible to exploit firefox or tor. You should of course take reasonable precautions. These would involve steps like isolating your client application by using sandboxing (VMs, namespaces, containers, seccomp, ...) and access control mechanisms (apparmor, RBAC, ...) to limit the capabilities of tor, firefox, or any other clients you have that might present an "attack surface", this reduces the impact of any such exploit and potentially stops it dead and importantly increases the risk that the exploit will be spotted. Further more, use of the Tor Browser's Security Slider will disable large portions of the potential attack surface.

Secure operating system projects like Tails, Qubes, Subgraph (Alpha), and Whonix all attempt to provide some of these features.

The FBI are currently taking extreme measures to ensure that the do not have to reveal their NIT software and it's deployment mechanism. Their "magneto" exploit was captured, analyzed and reverse engineered. We have a good understanding of what it is and how it operated and more importantly, from the perspective of the FBI, it's limitations.

The FBI has a long history of using misdirection, lies, intimidation and assassination to discourage political dissent and I'd be careful about believing what their press statements say or journalists parrot (414 becomes 27?).

Edit: Add more politics, correct some typos, add more references.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.