Feeds

Tor servers vanish as FBI swoops on kiddie-smut suspect

Reports say user IP addresses revealed, mail down, malware spreading

Remote control for virtualized desktops

Network anonymisation outfit TOR has posted a fascinating piece of commentary on reports that some of the anonymous servers it routes to have disappeared from its network.

“Around midnight on August 4th we were notified by a few people that a large number of hidden service addresses have disappeared from the Tor Network,” the piece starts. “There are a variety of rumors about a hosting company for hidden services: that it is suddenly offline, has been breached, or attackers have placed a javascript exploit on their web site”.

As it explores the rumours, the post goes on to name an entity called Freedom Hosting, and to vigorously dissociate TOR from the organisation.

Distancing TOR from Freedom seems a fine idea given numerous reports, such as this from The Irish Examiner, suggest its founder Eric Eoin Marques has been arrested because the FBI believes he facilitated the distribution of child pornography using TOR. The FBI wants to extradite Marques to the USA.

TOR's not sure if the arrest and the disappearance of some nodes is linked, but is saying “someone has exploited the software behind Freedom Hosting … in a way that it injects some sort of javascript exploit in the web pages delivered to users.” That payload results in malware reaching users' PCs, possibly thanks to “potential bugs in Firefox 17 ESR, on which our Tor Browser is based.”

TOR is “investigating these bugs and will fix them if we can”.

Various forums online, however, report that the malware has spread beyond sites hosted by Freedom. Some suggest TORmail, TOR's secure email service, may also have been compromised, or that the attack means TOR is no longer able to mask users' IP addresses.

TOR's post says it's not sure what's really happening and that it will update users once it learns more.

We'll do likewise. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.