Feeds

Wikileaks denies Tor hacker eavesdropping gave site its start

Perish the thought

High performance access to file storage

Updated WikiLeaks has denied that eavesdropping on Chinese hackers played a key part in the early days of the whistle-blowing site.

Wired reports that early WikiLeaks documents were siphoned off from Chinese hackers' activities via a node on the Tor anonymiser network, as an extensive interview with WikiLeaks' founder Julian Paul Assange by the New Yorker explains in greater depth.

One of the WikiLeaks activists owned a server that was being used as a node for the Tor network. Millions of secret transmissions passed through it. The activist noticed that hackers from China were using the network to gather foreign governments’ information, and began to record this traffic. Only a small fraction has ever been posted on WikiLeaks, but the initial tranche served as the site’s foundation, and Assange was able to say, “We have received over one million documents from thirteen countries.”

Only a very small number of the documents obtained were ever published. However, the first publication on WikiLeaks back in December 2006 was culled from just this Tor-harvested traffic, Wired reports. This tranche of documents referred to a “secret decision,” supposedly made by Somali rebel leader Sheikh Hassan Dahir Aweys, to hire criminals as hit men in the assassination of government officials.

The documents were published in an attempt to verify their authenticity, alongside a commentary by Assange noting they might just as easily be a clever smear as the edicts of an Islamic militant with possible links to Al-Queda.

All this smoke and dagger intrigue received short shrift from WikiLeaks in an anonymous and sketchy denial, posted on the site's official Twitter feed late on Tuesday.

Wired has a beatup on WL&Tor,with no new info,spinning "our" 2006 investigation into Chinese spying. Don't be fooled

The Register has asked WikiLeaks to explain what role, if any, Tor traffic snooping might have played in the foundation of the site.

Assange responded to our inquiries by saying the New Yorker and Wired had each presented a misleading picture, without shedding much light on WikiLeaks use of Tor exit node interception.

The imputation is incorrect. The facts concern a 2006 investigation into Chinese espionage one of our contacts were involved in. Somewhere between none and handful of those documents were ever released on WikiLeaks. Non-government targets of the Chinese espionage, such as Tibetan associations were informed (by us).

Smoke and mirrors

Traffic passing through the Tor (The Onion Router) anonymizing network is encrypted until it reaches the point when it leaves the network, where it is decrypted and forwarded to its final destination. Traffic leaving at a particular exit node can always be monitored, a point which Tor has always emphasised. This monitoring may be a criminal offence, depending on where it takes place, and is certainly ethically questionable.

Anyone using Tor should use SSH, SSL, or a VPN connection to encrypt traffic because Tor is only good for anonymity - certainly not end-to-end encryption. Users have no control over which exit nodes will be used, still less on the path traffic takes through the network, which is random by design.

The potential to extract sensitive data by eavesdropping on traffic flowing out of a Tor exit node is well known in security circles.

For example, in September 2007, Swedish security consultant Dan Egerstad ran a packet sniffer on five Tor exit nodes under his control, recovering the login credentials of about 1,000 email addresses, including at least 100 accounts belonging to foreign embassies in the process. One likely theory is that Egerstad had stumbled onto the surveillance of hacked accounts by unknown intelligence agencies, who were using Tor to disguise their identity. Egerstad was hauled in for questioning by the Swedish authorities over this exercise but never charged.

Egerstad was part of a team that also found TOR exit-nodes that only forwarded traffic association with ports used for unencrypted email protocols and IM traffic. ®

Additional reporting by Chris Williams.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.