This is a split board - You can return to the Split List for other boards.

The FBI took down a bunch of tor websites and embedded malware in the sites

#1Lonestar2000Posted 8/5/2013 12:38:23 PM
http://www.wired.com/threatlevel/2013/08/freedom-hosting/

Feds Are Suspects in New Malware That Attacks Tor Anonymity

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

Court documents and FBI files released under the FOIA have described the CIPAV as software the FBI can deliver through a browser exploit to gather information from the target’s machine and send it to an FBI server in Virginia. The FBI has been using the CIPAV since 2002 against hackers, online sexual predators, extortionists, and others, primarily to identify suspects who are disguising their location using proxy servers or anonymity services, like Tor.

The code has been used sparingly in the past, which kept it from leaking out and being analyzed or added to anti-virus databases.

The broad Freedom Hosting deployment of the malware coincides with the arrest of Eric Eoin Marques in Ireland on Thursday on an U.S. extradition request. The Irish Independent reports that Marques is wanted for distributing child pornography in a federal case filed in Maryland, and quotes an FBI special agent describing Marques as “the largest facilitator of child porn on the planet.”

Freedom Hosting has long been notorious for allowing child porn to live on its servers. In 2011, the hactivist collective Anonymous singled out Freedom Hosting for denial-of-service attacks after allegedly finding the firm hosted 95 percent of the child porn hidden services on the Tor network.

Freedom Hosting is a provider of turnkey “Tor hidden service” sites — special sites, with addresses ending in .onion — that hide their geographic location behind layers of routing, and can be reached only over the Tor anonymity network.

Tor hidden services are ideal for websites that need to evade surveillance or protect users’ privacy to an extraordinary degree – which can include human rights groups and journalists. But it also naturally appeals to serious criminal elements.

Shortly after Marques’ arrest last week, all of the hidden service sites hosted by Freedom Hosting began displaying a “Down for Maintenance” message. That included websites that had nothing to do with child pornography, such as the secure email provider TorMail.

Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address located in eastern Virginia.

By midday Sunday, the code was being circulated and dissected all over the net. Mozilla confirmed the code exploits a critical memory management vulnerability in Firefox that was publicly reported on June 25, and is fixed in the latest version of the browser.

---
Rumble Roses. Someone enters the room.
Them: O_O Me: What?! I always play games without my pants on!- Inmate 922335
#2Lonestar2000(Topic Creator)Posted 8/5/2013 12:38:50 PM
Though many older revisions of Firefox are vulnerable to that bug, the malware only targets Firefox 17 ESR, the version of Firefox that forms the basis of the Tor Browser Bundle – the easiest, most user-friendly package for using the Tor anonymity network.

“The malware payload could be trying to exploit potential bugs in Firefox 17 ESR, on which our Tor Browser is based,” the non-profit Tor Project wrote in a blog post Sunday. “We’re investigating these bugs and will fix them if we can.”

The inevitable conclusion is that the malware is designed specifically to attack the Tor browser. The strongest clue that the culprit is the FBI, beyond the circumstantial timing of Marques’ arrest, is that the malware does nothing but identify the target.

The heart of the malicious Javascript is a tiny Windows executable hidden in a variable named “Magneto.” A traditional virus would use that executable to download and install a full-featured backdoor, so the hacker could come in later and steal passwords, enlist the computer in a DDoS botnet, and generally do all the other nasty things that happen to a hacked Windows box.

But the Magneto code doesn’t download anything. It looks up the victim’s MAC address — a unique hardware identifier for the computer’s network or Wi-Fi card — and the victim’s Windows hostname. Then it sends it to the Virginia server, outside of Tor, to expose the user’s real IP address, and coded as a standard HTTP web request.

“The attackers spent a reasonable amount of time writing a reliable exploit, and a fairly customized payload, and it doesn’t allow them to download a backdoor or conduct any secondary activity,” says Tsyrklevich, who reverse-engineered the Magneto code.

The malware also sends, at the same time, a serial number that likely ties the target to his or her visit to the hacked Freedom Hosting-hosted website.

In short, Magneto reads like the x86 machine code embodiment of a carefully crafted court order authorizing an agency to blindly trespass into the personal computers of a large number of people, but for the limited purpose of identifying them.

But plenty of questions remain. For one, now that there’s a sample of the code, will anti-virus companies start detecting it?

Update 8.5.13 12:50: According to Domaintools, the malware’s command-and-control IP address in Virginia is allocated to Science Applications International Corporation. SAIC is a major technology contractor for defense and intelligence agencies, including the FBI. I have a call into the firm.

13:50 Tor Browser Bundle users who installed or manually updated after June 26 are safe from the exploit, according to the Tor Project’s new security advisory on the hack.

---
Rumble Roses. Someone enters the room.
Them: O_O Me: What?! I always play games without my pants on!- Inmate 922335
#3Cool_Dude667Posted 8/5/2013 12:44:38 PM
Gotta love america :/
---
Not changing this sig until Christ returns -- Started 30 A.D
3770K @ 4.2Ghz | 16GB Corsair Vengeance | GTX 670 SLi
#4Knight2520Posted 8/5/2013 12:45:43 PM
From: Lonestar2000 | #002
will anti-virus companies start detecting it?


Nope.
---
I have very little time for the Internet now and I'm not even a millionaire yet. - Krycek18
#5Ch3wyPosted 8/5/2013 12:47:30 PM
Noscript comes bundled with the Tor browser bundle, so this shouldn't effect most people.
---
Every time you point out that something is an opinion Jesus shoots a kitten in the face.
#6Orestes417Posted 8/5/2013 12:52:20 PM(edited)
So any TOR user dumb enough to be using javascript, on a real Windows machine to browse notorious pedo hosts would get nailed by this. Strangely I'm perfectly fine with that. As for NoScript, as far as I know the TOR bundle default configuration of it wasn't set up to block javascript.

People need to learn to stop blindly trusting **** and manually configure it themselves regardless.

---
If they asked how I died tell them: Still angry.
#7sknmakPosted 8/5/2013 12:52:02 PM
More updates:

14:30: SAIC has no comment.

15:10: There are incorrect press reports circulating that the command-and-control IP address, 65.222.202.54, belongs to the NSA. Those reports are based on a misreading of domain name resolution records. The NSA’s public website, NSA.gov, is served by the same upstream Verizon network as the Tor malware command-and-control server, but that network handles tons of government agencies and contractors in the Washington DC area.


Goodness. I'm so sick of all of this spying. I guess America just won't stop until they can see everything we are doing online.
---
NEW Video Game Remakes Uploaded
http://www.youtube.com/user/sknocturnal
#8Mystical_NEETPosted 8/5/2013 1:01:11 PM
Nice, gotta make sure you find those evil miscreants who open those suspicious links with illegal pictures embedded.

Meanwhile more domestic bombers plot out actions that directly harm civilians...
#9Orestes417Posted 8/5/2013 1:07:32 PM
Clearly a multibillion dollar three letter agency can only focus on one thing at a time
---
If they asked how I died tell them: Still angry.
#10DerPancakePosted 8/5/2013 1:10:31 PM
Does this mean I can't go into the deep web anymore?
---
i7-4770k | EVGA GeForce GTX770 2GB | Asus Sabertooth Z87 | Corsair Vengeance 8GB RAM
Samsung 840 120GB SSD | CM Storm Enforcer | Corsair TX 750 Watt