Feeds

NSA using Firefox flaw to snoop on Tor users

Good news/bad news in latest Snowden leak

Next gen security for virtualised datacentres

An NSA presentation released by Edward Snowden contains mixed news for Tor users. The anonymizing service itself appears to have foxed US and UK government snoops, but instead they are using a zero-day flaw in the Firefox browser bundled with Tor to track users.

"These documents give Tor a huge pat on the back," security guru Bruce Schneier told The Register. "If I was a Tor developer, I'd be really smiling after reading this stuff."

The PowerPoint slide deck, prepared in June last year and entitled "Tor stinks", details how the NSA and the UK's Government Communications Headquarters (GCHQ) have been stymied by trying to track Tor users, thanks to the strength of the open source system.

"We will never be able to de-anonymize all Tor users all the time," the presentation states. "With manual analysis we can de-anonymize a very small fraction of Tor users, however, no success de-anonymizing a user."

The presentation says that both the NSA and GCHQ run Tor nodes themselves (the Brits use Amazon Web Services for this under a project entitled Newton's Cradle), but these are only a very small number in comparison to the whole system. This makes tracking users using traditional signals-intelligence methods impossible.

There's also a case of diminishing returns as Tor becomes more popular. With each user acting as a transport node, the sheer scale of the system means it becomes steadily more difficult for the intelligence community to run enough nodes to be useful for tracking.

The agencies have also tried to use "quantum" cookies to track targets who are using Tor. Some cookies appear to persist after Tor sessions, the presentation notes, and the agencies are investigating if this can be developed into a working tracking system.

A separate leaked document from GCHQ, published in the Washington Post, gives an indication of how this could be done. Operation Mullenize is a technique for "staining" individual user's computers with trackable code, and is now being rolled out after a year of development. Over 200 stains were injected onto systems in two months last year, the report notes.

There are also indications that the NSA had been trying to influence the design of Tor to make it more crackable, a somewhat Kafkaesque approach given that Tor is primarily funded by the US government itself to provide anonymity to internet users operating under repressive governments.

The NSA has been accused of this before, having been said to be deliberately weakening NIST encryption standards. But Schneier said in the case of Tor, the agency appears to have had little luck.

"It's harder than you think to sneak stuff in," Schneier said. "If you show up and say 'Here, I've got some Tor code!' I don't think you're going to get it in. As far as we know, they've had no success doing that."

But documents shown the The Guardian by Snowden indicate that the intelligence organizations have also been trying sneakier methods in a delightfully named attack dubbed EgotisticalGiraffe. This targets the software that is bundled with Tor, specifically version 17 of the Firefox browser which was vulnerable to a zero-day attack.

It's an attack vector that was adopted by the hacking community after operating system vendors started getting smarter about security, and which spawned a rash of attacks against third-party software such as Java and Adobe Reader. Now the NSA is using the same methods to track and crack Tor users.

"It should hardly be surprising that our intelligence agencies seek ways to counteract targets' use of technologies to hide their communications," the NSA told the paper in a statement.

"Throughout history, nations have used various methods to protect their secrets, and today terrorists, cybercriminals, human traffickers and others use technology to hide their activities. Our intelligence community would not be doing its job if we did not try to counter that."

Mozilla has now fixed the Firefox flaw used in EgotisticalGiraffe, but it seems likely that a fair few Tor users won't have updated their software as often as they should and may still be vulnerable. But Cindy Cohn, legal director of the Electronic Frontier Foundation, told The Register that the methods used by the NSA and GCHQ were immensely worrying.

"They are using the kind of techniques that federal prosecutors send people to jail for decades for using," she said. "These are tools that are criminal, and I'm still wondering what's the authority? What kind of authority are they claiming that they can do this?"

Cohn said the courts need to know how data is being collected before warrants are issued. She pointed out that the NSA has already been fingered for passing information to the Drug Enforcement Agency and the Internal Revenue Service, which then covered up where they got their data from.

"You really have to question if there is a rule of law anymore?" Cohn said.

"If the government gets to essentially burn down your house because it thinks you're engaging in illegal activity and then hide the fact by pretending there was an arsonist around at some point, it's not a lawful situation," she said. "There's a fundamental thing that's being lost here for an allegedly self-governing country." ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?