Feeds

Infosec analysts back away from 'Feds attacked Tor' theory

Those IP addresses we said belong to the NSA? We were probably wrong

Internet Security Threat Report 2014

When Tor admitted early this week that some nodes on the network had suddenly and inexplicably gone dark, thanks in part to a malware attack, theories abounded as to just what was going on and why.

That the FBI arrested a man suspected of using Tor to host child pornography distribution services further fuelled speculation that perhaps US authorities had launched an attack on Tor.

Some infosec specialists quickly analysed the malware and suggested it was controlled by an entity using IP addresses associated with defence contractor Science Applications International Corporation (SAIC) and/or the NSA. One and one were promptly put together to suggest three elements explaining the Tor takedown:

  • The arrest of porn suspect Eric Eoin Marques was but one action in a wider attack on Tor
  • The US government, probably the NSA, created weaponised malware to take down Tor
  • SAIC and/or the NSA were the source and/or controller of that malware

A couple of days down the track, that theory is looking rocky, as two of the organisations that helped the malware theory to spread have issued a joint post saying their initial analysis of the malware was wrong.

Cryptocloud and Baneki Privacy Labs write that their initial analysis of the IP addresses used by the “torsploit” probably don't have anything to do with SAIC. Cryptocloud's also less-than-certain it's earlier assertion that NSA IP addresses were involved is right.

The post we've linked to above is long, rambling and suggests that even if it is not possible to find an IP address tied directly to the NSA in the Torsploit code, the incident looks an awful lot like the kind of thing the NSA is known to be capable of and interested in.

Edward Snowden's recent revelations make it plain that the NSA is peering into a great many dark places. Tor's status as a likely gateway to much of the “dark web” means attempts to gain more intelligence on just what lies within the onion router seem well within the bounds of possibility.

For now, however, the dots aren't joined. Nor, for what it is worth, is a decent explanation of where Torsploit came from or just how much damage it has done. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.