Ask any hacker about the best ways to stay anonymous online and they’re very likely to mention something called Tor. Tor (a.k.a., The Onion Router) is free software that keeps your online activity anonymous by routing your traffic through several different servers before sending it through to your computer.
Believed to be impenetrable, and thus safe from a government’s prying eyes, Tor’s official browser proved to be an easy target for a couple of researchers last year who devised ways of identifying Internet users using Tor. The security issue may have exposed millions of Tor users for up to six months in 2014 and the FBI is believed to have worked with the researchers to target various Dark Web websites hidden in the Tor net.
DON’T MISS: It’s not too late: 15 best HDTV deals still available for Cyber Week
Initially, the attack was launched by researchers affiliated with Carnegie Mellon University, who were supposed to explain it at a security event but never did.
It is believed that the CMU researchers were either motivated financially by the FBI – or compelled – to help out with existing investigations of certain online services available solely on the Dark Web that can’t be accessed without the Tor browser. The FBI confirmed that a “university-based research institute” helped out, Fusion explains.
Tor apparently saw the attack coming in February 2014 but failed to put a stop to it, only acting months later once it realized the severity of the attack.
Tor works by routing a user’s traffic through a variety of servers placed around the world before reaching the final destination, after encrypting the user’s identity. The more servers that service Tor, the better it’s supposed to be at protecting online anonymity. But when a “ton of new computers” from the same IP address joined the network, Tor noticed the change but did nothing on it, choosing to wait and see what happens next.
The problem is that, once a party controls enough relay points inside Tor, it can actually deanonymize traffic, which is how the researchers apparently made their way into Tor and started identifying potential targets for the FBI.
In November 2014, FBI seized a bunch of hidden Dark Web sites and arrested dozens of Tor users involved in drug trafficking in Operation Onymous. In July 2015, the FBI targeted Darkode, a site popular with cyber-criminals, which was hosted on Tor hidden services. Hundreds of people around the world were arrested, with the FBI’s global case being led by its field office in Pittsburgh where Carnegie Mellon is based.
The problem with the Tor hack isn’t that a law-enforcement agency managed to crack what was believed to be the safest online browser. It’s that the researchers may have endangered the identity of users who aren’t involved in any criminal activities, but who rely on Tor for protecting their privacy and identities. These non-criminal categories of Tor users include activists and human rights workers communicating in repressive countries, whistleblowers looking to protect their identity and journalists who need to protect their sources. Some two million people use Tor on a daily basis.
The full, fascinating story of how Tor was has hacked for six months last year is available at the source link.
Currently, Tor is supposed to be safe from similar attacks, as the Tor team has taken advanced steps to prevent anyone from interfering and identifying traffic inside the network.
