Feeds

Wikileaks denies Tor hacker eavesdropping gave site its start

Perish the thought

3 Big data security analytics techniques

Updated WikiLeaks has denied that eavesdropping on Chinese hackers played a key part in the early days of the whistle-blowing site.

Wired reports that early WikiLeaks documents were siphoned off from Chinese hackers' activities via a node on the Tor anonymiser network, as an extensive interview with WikiLeaks' founder Julian Paul Assange by the New Yorker explains in greater depth.

One of the WikiLeaks activists owned a server that was being used as a node for the Tor network. Millions of secret transmissions passed through it. The activist noticed that hackers from China were using the network to gather foreign governments’ information, and began to record this traffic. Only a small fraction has ever been posted on WikiLeaks, but the initial tranche served as the site’s foundation, and Assange was able to say, “We have received over one million documents from thirteen countries.”

Only a very small number of the documents obtained were ever published. However, the first publication on WikiLeaks back in December 2006 was culled from just this Tor-harvested traffic, Wired reports. This tranche of documents referred to a “secret decision,” supposedly made by Somali rebel leader Sheikh Hassan Dahir Aweys, to hire criminals as hit men in the assassination of government officials.

The documents were published in an attempt to verify their authenticity, alongside a commentary by Assange noting they might just as easily be a clever smear as the edicts of an Islamic militant with possible links to Al-Queda.

All this smoke and dagger intrigue received short shrift from WikiLeaks in an anonymous and sketchy denial, posted on the site's official Twitter feed late on Tuesday.

Wired has a beatup on WL&Tor,with no new info,spinning "our" 2006 investigation into Chinese spying. Don't be fooled

The Register has asked WikiLeaks to explain what role, if any, Tor traffic snooping might have played in the foundation of the site.

Assange responded to our inquiries by saying the New Yorker and Wired had each presented a misleading picture, without shedding much light on WikiLeaks use of Tor exit node interception.

The imputation is incorrect. The facts concern a 2006 investigation into Chinese espionage one of our contacts were involved in. Somewhere between none and handful of those documents were ever released on WikiLeaks. Non-government targets of the Chinese espionage, such as Tibetan associations were informed (by us).

Smoke and mirrors

Traffic passing through the Tor (The Onion Router) anonymizing network is encrypted until it reaches the point when it leaves the network, where it is decrypted and forwarded to its final destination. Traffic leaving at a particular exit node can always be monitored, a point which Tor has always emphasised. This monitoring may be a criminal offence, depending on where it takes place, and is certainly ethically questionable.

Anyone using Tor should use SSH, SSL, or a VPN connection to encrypt traffic because Tor is only good for anonymity - certainly not end-to-end encryption. Users have no control over which exit nodes will be used, still less on the path traffic takes through the network, which is random by design.

The potential to extract sensitive data by eavesdropping on traffic flowing out of a Tor exit node is well known in security circles.

For example, in September 2007, Swedish security consultant Dan Egerstad ran a packet sniffer on five Tor exit nodes under his control, recovering the login credentials of about 1,000 email addresses, including at least 100 accounts belonging to foreign embassies in the process. One likely theory is that Egerstad had stumbled onto the surveillance of hacked accounts by unknown intelligence agencies, who were using Tor to disguise their identity. Egerstad was hauled in for questioning by the Swedish authorities over this exercise but never charged.

Egerstad was part of a team that also found TOR exit-nodes that only forwarded traffic association with ports used for unencrypted email protocols and IM traffic. ®

Additional reporting by Chris Williams.

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.