Microsoft: NSA and GCHQ are capable of monitoring 'secure' browsing using Tor

Microsoft has publicly warned that they do not believe the Tor browsing service, famed for allowing totally secure access to the most hidden areas of the internet and frequented by cyber-criminals, can withstand attempted break-ins from law-enforcement bodies such as the NSA and Britain's GCHQ for much longer.

Amidst claims that usage of Tor has increased by almost 50% since Edward Snowden's revelations last year as to the extent of NSA internet snooping, Andy Malone of Microsoft Enterprise Security said

"There is no such thing as really being anonymous on the internet. If hackers and government agencies want you, they will get you."

He added that although the Tor network itself had not yet been cracked, hackers employed by the state were able to access data sent and received by the program through hijacking insecure add-ons for the browser installed by users. These included Adobe Flash and Java - two of the most well-known and most in-secure browser plugins around.

Tor enables users to browse the web with absolute security by scrambling data and then sending it through thousands of different relays worldwide so that the identity of the original sender of the data is completely masked. It also allows for the creation of 'invisible' sites that can only be viewed with the Tor browser - other browsers such as Internet Explorer, Google Chrome or Mozilla Firefox simply will not be able to find them. These have the .onion extension and some, such as the infamous Silk Road, are regularly frequented by criminals looking to engage in illegal activities such as the trade of drugs and narcotics online without risk of being traced.

Increasingly, the service is being frequented by ordinary law-abiding citizens who use it simply to mask their identity online; this has led to the service seeing on average 80,000 users of the network per day.

Microsoft described how law-enforcement bodies including the NSA and Britain's equivalent, GCHQ, were actively monitoring and attempting to break into the Tor network through add-ons used with the client. He said that increasingly the 'secure', hidden .onion sites are being hijacked by law-enforcement agencies and being converted into 'watering-holes' - as people visit the site, their details are recorded and returned to the NSA. This, of course, is not particularly useful until the rest of the Tor network has been broken down so that the true identity of the visitor can be established.

This is yet another turn in the revelations of governmental snooping on the usage of the internet. It appears that governments in the US and Britain are more determined than ever to access our data and are now trying to break down the barriers surrounding the most hidden parts of the internet. In the past, Tor has always been able to adapt to attempted break-ins like this but is time running out for what is currently the most secure access path to the Internet?

Source: The Inquirer

Report a problem with article
Previous Story

Lumia 630 launches in Brazil with integrated digital TV

Next Story

Microsoft's annual CEO summit is even more private for 2014

33 Comments

Commenting is disabled on this article.

If you don't install 3rd party addons and turn off javascript you're practically impenetrable, just don't log into facebook or some other site that reveals your info then go do illegal stuff. Also the new identity button in the tor button makes their job a damn sight harder, I use Tor as my goto browser now that youtube sorted html5 videos and if I want to hide my browsing history from facebooks ####ing like button cookies then I just press new identity and everything from previous session is erased. I like it.

Eff Tor... I route all my internet traffic, legal or not, through a country that refuses to provide data to the US.... Can the NSA still snoop on me? Sure.... But you can't prosecute someone based on illegally obtained evidence. And what I do isn't illegal enough for the NSA to bother with anyway.

Reverend Spam said,
But you can't prosecute someone based on illegally obtained evidence. And what I do isn't illegal enough for the NSA to bother with anyway.

Since when? Seriously...

Congratulations on another false and misleading title. No, it's not possible to monitor SECURE browsing using Tor, it's possible to monitor browsing using Tor that is NOT SECURE, which means with third-party add-ons like Java and Flash add-ons that make anything, not just Tor browsing, NOT secure.

You're truly ridiculous, and the people who spew BS like "it's open-source so anyone can modify the code" are idiots who don't realize that security through obscurity is fail (which is why open-source systems like BSD/Unix/Linux are inherently more secure) and that the Tor browser bundle or other Tor-released binaries are not made from "modified" source code in the first place and hence can't be "manipulated", "exploited", "penetrated" by anyone.

In short, like your idiotic article mentions, "Tor network itself had not yet been cracked", end of story, thanks for stating the ####ing obvious that using Java, Flash or other crap in a Tor browsing session is not secure. Awesome news.

One of the biggest supporter for the TOR project is DoD USA (Department of Defence) who works with NSA. So that tells already that they have somekind of connection.

IMO everyday people who are concerned about privacy are better served with a decent proxy service than Tor. There are proxies that don't log, and while they might not protect anonymity as well as Tor, they're a step in the right direction, and a lot simpler for non-techies to use effectively.

lets not forget the tor project is in fact something that came out of the us goverment and the US government uses it to attack others. which is why it is unlikely they will try to take it down. however attacking the add-ons is smart since it doesn't really compromise the network, but it does compromise users.

ultimately the tor network remains secure, and if you disable javascript, run the tails linux version, and don't access any personal accounts while using it, it will be quite hard for them to unmask you. At the very least, you become a target not worth going after. Basically they are going after the people who run tor and flash side by side...they kind of deserve getting hacked!

Scabrat said,
My guess. They already have broken into the Tor network somehow and this is old news...

I agree. If you want something private, meet in person in a secure location (if you can find one).

Scabrat said,
My guess. They already have broken into the Tor network somehow and this is old news...

They have, it's how they got the source location and details of SR. Not actually very hard, the source of tor is freely available, tor relies on users hosting exit nodes, so what would an agency have to do? 1) download source, 2) edit source to log, 3) start running modified version as a bunch of different exits nodes all over the world, 4) oh look, data...

"I agree. If you want something private, meet in person in a secure location (if you can find one)."
---
Indeed. Oh and you'll need to walk there (with a mask on), or maybe use a bike, because chances are you'll both be recorded at some point driving there either via cam or ALPS.

If you're in London perhaps.
My city has a few store and ATM security camera's. But for now no government camera's.
Store and ATM camera's only record the 2-4 meters in front of it. Avoid that and you'll go about your business unrecorded.

And never you mind that NSA (and GCHQ) are a heck of a lot more HONEST about their snoopery than agencies of other governments (such as Russia or the PRC) - these organs of other governments (especially FIS/FSB) will just come back and blackmail you into doing their dirty work. (FIS/FSB are the two now-separated parts of the old KGB that used to employ an officer by the name of Putin; FIS is the Russian Federal Investigative Service and reports to the Interior Ministry, while FSB is the Federal Security Bureau and handles external spying and counterintelligence.) Also, what is preventing NSA or GCHQ from simply downloading the Tor browser bundle and using it? That would be, in fact, the easiest way to investigate the entirety of the Tor network, and is in no way a violation of law. (The same, naturally, applies to any other agency of any government.)

PGHammer said,
And never you mind that NSA (and GCHQ) are a heck of a lot more HONEST about their snoopery than agencies of other governments (such as Russia or the PRC) - these organs of other governments (especially FIS/FSB) will just come back and blackmail you into doing their dirty work. (FIS/FSB are the two now-separated parts of the old KGB that used to employ an officer by the name of Putin; FIS is the Russian Federal Investigative Service and reports to the Interior Ministry, while FSB is the Federal Security Bureau and handles external spying and counterintelligence.) Also, what is preventing NSA or GCHQ from simply downloading the Tor browser bundle and using it? That would be, in fact, the easiest way to investigate the entirety of the Tor network, and is in no way a violation of law. (The same, naturally, applies to any other agency of any government.)

The fact that everybody spies is obvious.. to say the least. I disagree though that FBI, NSA etc. are more honest about it. Same goes for blackmailing or, to B politically correct, pressuring people to cooperate.

I understand full well that there are many states/governments far more nefarious & malevolent than the NSA & GCHQ. But do not delude yourself into thinking that there is anything even remotely "honest" about either of these British & American agencies.

I have no doubt that both entities are staffed by many persons of admirable ethical character, sincere commitment to the well being of their home country, & are acting in service of both liberty & peaceful coexistence. Among the architects & senior staff of these agencies, there is a tragic absence of ethics, honesty & integrity.

Though many, & perhaps even most, may have begun their trajectories with a firm sense of morality & an honest intent, their obsessions mutated, morphing into twisted convictions & criminal acts that demonstrate a thoroughly utter contempt of both law & constitutional principles. These individuals act with total conviction that they themselves are above all rule of law.

These senior officials have undermined the structural framework of an aspirational humanity striving to attain an even greater enlightenment & egalitarianism. These senior officials have devalued, disregarded, & dismantled shared liberties, personal freedoms & public self governance far more effectively than any terrorist ever could. It is both tragedy & irony of epic proportions.

I could easily agree with your comments, I certainly feel like something of that nature has perhaps now made a spectacle of me. As I've always said the ultimate tragedy in removing privacy throughout the world would have to be the loss of creative geniuses and perhaps even some unforeseen events. What's next?, clothing!

"He added that although the Tor network itself had not yet been cracked, hackers employed by the state were able to access data sent and received by the program through hijacking insecure add-ons for the browser installed by users."

So if the user is really stupid they can be be hacked, what else is new. Sounds like a non-story.

/don't use addons with TOR

Bonfire said,
"He added that although the Tor network itself had not yet been cracked, hackers employed by the state were able to access data sent and received by the program through hijacking insecure add-ons for the browser installed by users."

So if the user is really stupid they can be be hacked, what else is new. Sounds like a non-story.

/don't use addons with TOR

Here's your story genius.

"He said that increasingly the 'secure', hidden .onion sites are being hijacked by law-enforcement agencies and being converted into 'watering-holes' - as people visit the site, their details are recorded and returned to the NSA."

Precisely...

If you care about true anonymity when browsing you fun Tor in a VM using Tails or (the best approach) you boot Tails on a live CD and use Tor only without persistence.

LogicalApex said,
Precisely...

If you care about true anonymity when browsing you fun Tor in a VM using Tails or (the best approach) you boot Tails on a live CD and use Tor only without persistence.

that wouldn't help you against that kind of attack.

http://arstechnica.com/securit...ncloak-anonymous-tor-users/

if they can run code in the VM, they can communicate over your actual internet connection to contact a server so that the FBI or someone else get your actual IP and data about what you were browsing. Then it is easy to get your identity,

all this through a Firefox flaw, without any addon. Which could work on windows, Linux, osx, openBSD or whatever, since the NSA has access to a wide range of 0day flaws for most platforms.

link8506 said,

that wouldn't help you against that kind of attack.

http://arstechnica.com/securit...ncloak-anonymous-tor-users/

if they can run code in the VM, they can communicate over your actual internet connection to contact a server so that the FBI or someone else get your actual IP and data about what you were browsing. Then it is easy to get your identity,

all this through a Firefox flaw, without any addon. Which could work on windows, Linux, osx, openBSD or whatever, since the NSA has access to a wide range of 0day flaws for most platforms.

This would not affect Tails running in a VM. Tails pumps all network traffic through Tor. The Tor Browser Bundle pushes Firefox traffic through Tor via a proxy. If you can jump out of the browser you'll bypass the proxy. Of course, with the VM there could be exploits to escape the hypervisor which is why running the Tails Live CD bare metal is the safest option.

xbbdc said,

Here's your story genius.

Well you don't have to be an ass about it. I was just saying that the way these sites are getting take over is by users being careless. The way that they are breaking into these sites in the first place is because of people using insecure addons.

"and attempting to break into the Tor network through add-ons used with the client."

Edited by Bonfire, May 15 2014, 8:41pm :

LogicalApex said,

This would not affect Tails running in a VM. Tails pumps all network traffic through Tor. The Tor Browser Bundle pushes Firefox traffic through Tor via a proxy. If you can jump out of the browser you'll bypass the proxy. Of course, with the VM there could be exploits to escape the hypervisor which is why running the Tails Live CD bare metal is the safest option.

what you say doesn't make sense.

if the NSA has a browser exploit that manages to execute code on the VM or the OS running on live CD, since the OS has initiated the Tor connection over your actual internet connection, if the OS is pwned, then the NSA attack code can communicate through the actual internet connection to expose your IP address to the FBI.

my point is that if the FBI/NSA really wants to target you because you're doing something really bad, they're likely to succeed to uncover your identity using one or more 0days.

actually that is completely false. you can have a compromised hop. even several. the network was designed with this in mind because after all, ANYBODY can be a relay. The technical way in which this is achieve is complex but rest-assured, it was designed to be compromised this way and remain ok. as long as not every node is compromised, the network stands strong.

tor needs more volunteers however. too many leachers don't relay traffic. you don't have to be an exit node either but the developers need to make it required that you do so in order to participate.

the best way to keep the nsa out, is to set up as many relays not controlled by them as possible.