Monday, August 5, 2013

Extradition of Eric Marques, Owner of Freedom Hosting, Tor Anonymity Called into Question

Question: If you owned a shopping mall and one of the stores was selling say bath salts, should you as the mall owner be responsible or should the people selling the bath salts? Well the FBI seems to think the mall owner is responsible.

Eric Marques is a 28 year old man who hasn't lived in the US since he was 5 years old and has dual citizenship with Ireland. Eric is the virtual equivalent of the mall owner, he provides web hosting, or Hidden Services as they are called on Tor. Whistleblowers and journalists use hidden services to exchange information in a secure and anonymous way and publish critical information in a way that is not easily traced back to them. The New Yorker's Strongbox is one public example.

Eric's company was named Freedom Hosting because on Tor you don't ask questions and above all you don't censor. The FBI has shut down Freedom Hosting and ordered the extradition of Eric from Ireland because one of his hosting clients was the biggest child porn site on the dark web, but it wasn't his only client. TorMail was also one of Freedom Host's clients.

Tor is what was thought to be a highly secure and confidential network, is used world wide. I say thought to be because it was breached by the FBI using a JavaScript zero-day exploit. Originally patented by the US Navy in 1998, the Onion-Router technology is designed to make online communication untraceable and perfectly anonymous. So named for its structure, it passes every transmission through a series of layers or intermediary computers between source and destination. This means that it is both very slow and theoretically secure for both server and user. The technology was initially useless to civilians since its very premise requires access to computers all over the world, but in 2002 a free, open solution appeared: the Tor Network.

Over the last year or so the people at the Tor Network decided to try and make the network more user friendly in hopes of attracting a larger user base.  The more people using the network theoretically the stronger it becomes. Originally the software was offered in distinct packages that required a level of expertise that was beyond the average web user. That all changed when they started offering an all in one bundle with a preconfigured version of Firefox. And that's where the problem, or bug comes from.

JavaScript is used by millions of websites the world over. It is a key component in what makes HTML5 the rock star it is on the mobile web. Websites from Amazon to Zillow all use it. The only problem is that it lacks the security needed for a network like Tor, and should have never been enabled by default in the Firefox bundle. People are not using Tor to watch cat videos on YouTube, they are using it for things that need to be kept hush hush.

The JavaScript zero-day exploit that the FBI Blackhats discovered creates a unique cookie. This then sends a request to a random server that fingerprints your browser in some as of yet undisclosed way. This is then correlated by FBI/NSA servers which then reported the victim's IP address back to the FBI. The Tor network is currently investigating this flaw and developing a fix. You can however fix it yourself in just seconds if you have the bundle. Go to Tools > options > content: and uncheck "Use JavaScript".

No comments:

Post a Comment

Thank you for your comment. Any comments with links in them will be deleted.

Search Democratic Progress


DemocracticProgress readers get 1 Month Free of Amazon Prime Video Streaming... Click Here