Heartbleed and TOR in practice(digitalassurance.com)

14 pointsby bdpukvor 12 Jahren7 comments

http://digitalassurance.com/blog/heartbleed-and-tor-practice

7 comments

ufmacevor 12 Jahren

Combined with rumors that the NSA knew about Heartbleed, this makes me wonder if they actually were involved in outing Silk Road. As far as I know, we still haven't seen any indication on how the FBI managed to find and image the Silk Road server.

antocvvor 12 Jahren

I dont think heartbleed was necessary to crack Silk Road server - after all its just another php server, those arent really known for being air-tight.

Especially the programmer who basically copypasted stuff from stackoverflow.

Bugevor 12 Jahren

I saw a study showing it is possible to deanonymize a hidden service by doing traffic analysis for several months.

mpynevor 12 Jahren

I would be shocked if they weren't involved in outing Silk Road, in some sort of multiagency effort. It's not clear NSA couldn't de-anonymize specific TOR services if they wanted to even before we knew about Heartbleed though.

m00dyvor 12 Jahren

i was going to say the same thing :)

DatBearvor 12 Jahren

After all the NSA leaks and then Heartbleed, being anonymous anywhere really seems like a pipe dream to me.

dmixvor 12 Jahren

Large-scale traffic analysis (dragnet surveillance) + hacking into exit nodes already made compromising TOR users technically feasible before the heartbleed exploit.

The whole cypherpunk/online anonymity movement which spawned TOR was largely predicated on nation states acting legally. But when they can secretly hack into every router, fiber cable, and gateway endpoint without any question of legality then anonymity and privacy online is no longer an option for anyone, even the most technically-proficient.