Feeds

Wikileaks denies Tor hacker eavesdropping gave site its start

Perish the thought

Top 5 reasons to deploy VMware with Tegile

Updated WikiLeaks has denied that eavesdropping on Chinese hackers played a key part in the early days of the whistle-blowing site.

Wired reports that early WikiLeaks documents were siphoned off from Chinese hackers' activities via a node on the Tor anonymiser network, as an extensive interview with WikiLeaks' founder Julian Paul Assange by the New Yorker explains in greater depth.

One of the WikiLeaks activists owned a server that was being used as a node for the Tor network. Millions of secret transmissions passed through it. The activist noticed that hackers from China were using the network to gather foreign governments’ information, and began to record this traffic. Only a small fraction has ever been posted on WikiLeaks, but the initial tranche served as the site’s foundation, and Assange was able to say, “We have received over one million documents from thirteen countries.”

Only a very small number of the documents obtained were ever published. However, the first publication on WikiLeaks back in December 2006 was culled from just this Tor-harvested traffic, Wired reports. This tranche of documents referred to a “secret decision,” supposedly made by Somali rebel leader Sheikh Hassan Dahir Aweys, to hire criminals as hit men in the assassination of government officials.

The documents were published in an attempt to verify their authenticity, alongside a commentary by Assange noting they might just as easily be a clever smear as the edicts of an Islamic militant with possible links to Al-Queda.

All this smoke and dagger intrigue received short shrift from WikiLeaks in an anonymous and sketchy denial, posted on the site's official Twitter feed late on Tuesday.

Wired has a beatup on WL&Tor,with no new info,spinning "our" 2006 investigation into Chinese spying. Don't be fooled

The Register has asked WikiLeaks to explain what role, if any, Tor traffic snooping might have played in the foundation of the site.

Assange responded to our inquiries by saying the New Yorker and Wired had each presented a misleading picture, without shedding much light on WikiLeaks use of Tor exit node interception.

The imputation is incorrect. The facts concern a 2006 investigation into Chinese espionage one of our contacts were involved in. Somewhere between none and handful of those documents were ever released on WikiLeaks. Non-government targets of the Chinese espionage, such as Tibetan associations were informed (by us).

Smoke and mirrors

Traffic passing through the Tor (The Onion Router) anonymizing network is encrypted until it reaches the point when it leaves the network, where it is decrypted and forwarded to its final destination. Traffic leaving at a particular exit node can always be monitored, a point which Tor has always emphasised. This monitoring may be a criminal offence, depending on where it takes place, and is certainly ethically questionable.

Anyone using Tor should use SSH, SSL, or a VPN connection to encrypt traffic because Tor is only good for anonymity - certainly not end-to-end encryption. Users have no control over which exit nodes will be used, still less on the path traffic takes through the network, which is random by design.

The potential to extract sensitive data by eavesdropping on traffic flowing out of a Tor exit node is well known in security circles.

For example, in September 2007, Swedish security consultant Dan Egerstad ran a packet sniffer on five Tor exit nodes under his control, recovering the login credentials of about 1,000 email addresses, including at least 100 accounts belonging to foreign embassies in the process. One likely theory is that Egerstad had stumbled onto the surveillance of hacked accounts by unknown intelligence agencies, who were using Tor to disguise their identity. Egerstad was hauled in for questioning by the Swedish authorities over this exercise but never charged.

Egerstad was part of a team that also found TOR exit-nodes that only forwarded traffic association with ports used for unencrypted email protocols and IM traffic. ®

Additional reporting by Chris Williams.

Beginner's guide to SSL certificates

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.