Feeds

Wikileaks denies Tor hacker eavesdropping gave site its start

Perish the thought

Internet Security Threat Report 2014

Updated WikiLeaks has denied that eavesdropping on Chinese hackers played a key part in the early days of the whistle-blowing site.

Wired reports that early WikiLeaks documents were siphoned off from Chinese hackers' activities via a node on the Tor anonymiser network, as an extensive interview with WikiLeaks' founder Julian Paul Assange by the New Yorker explains in greater depth.

One of the WikiLeaks activists owned a server that was being used as a node for the Tor network. Millions of secret transmissions passed through it. The activist noticed that hackers from China were using the network to gather foreign governments’ information, and began to record this traffic. Only a small fraction has ever been posted on WikiLeaks, but the initial tranche served as the site’s foundation, and Assange was able to say, “We have received over one million documents from thirteen countries.”

Only a very small number of the documents obtained were ever published. However, the first publication on WikiLeaks back in December 2006 was culled from just this Tor-harvested traffic, Wired reports. This tranche of documents referred to a “secret decision,” supposedly made by Somali rebel leader Sheikh Hassan Dahir Aweys, to hire criminals as hit men in the assassination of government officials.

The documents were published in an attempt to verify their authenticity, alongside a commentary by Assange noting they might just as easily be a clever smear as the edicts of an Islamic militant with possible links to Al-Queda.

All this smoke and dagger intrigue received short shrift from WikiLeaks in an anonymous and sketchy denial, posted on the site's official Twitter feed late on Tuesday.

Wired has a beatup on WL&Tor,with no new info,spinning "our" 2006 investigation into Chinese spying. Don't be fooled

The Register has asked WikiLeaks to explain what role, if any, Tor traffic snooping might have played in the foundation of the site.

Assange responded to our inquiries by saying the New Yorker and Wired had each presented a misleading picture, without shedding much light on WikiLeaks use of Tor exit node interception.

The imputation is incorrect. The facts concern a 2006 investigation into Chinese espionage one of our contacts were involved in. Somewhere between none and handful of those documents were ever released on WikiLeaks. Non-government targets of the Chinese espionage, such as Tibetan associations were informed (by us).

Smoke and mirrors

Traffic passing through the Tor (The Onion Router) anonymizing network is encrypted until it reaches the point when it leaves the network, where it is decrypted and forwarded to its final destination. Traffic leaving at a particular exit node can always be monitored, a point which Tor has always emphasised. This monitoring may be a criminal offence, depending on where it takes place, and is certainly ethically questionable.

Anyone using Tor should use SSH, SSL, or a VPN connection to encrypt traffic because Tor is only good for anonymity - certainly not end-to-end encryption. Users have no control over which exit nodes will be used, still less on the path traffic takes through the network, which is random by design.

The potential to extract sensitive data by eavesdropping on traffic flowing out of a Tor exit node is well known in security circles.

For example, in September 2007, Swedish security consultant Dan Egerstad ran a packet sniffer on five Tor exit nodes under his control, recovering the login credentials of about 1,000 email addresses, including at least 100 accounts belonging to foreign embassies in the process. One likely theory is that Egerstad had stumbled onto the surveillance of hacked accounts by unknown intelligence agencies, who were using Tor to disguise their identity. Egerstad was hauled in for questioning by the Swedish authorities over this exercise but never charged.

Egerstad was part of a team that also found TOR exit-nodes that only forwarded traffic association with ports used for unencrypted email protocols and IM traffic. ®

Additional reporting by Chris Williams.

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.