1. Embassy incident
1.1. When
1.1.1. August - Sept 2007
1.2. Who
1.2.1. Dan Egerstad, the Swedish computer security
1.2.2. 21-year-old
1.3. What
1.3.1. obtained log-in and password information for 1,000 e-mail accounts belonging to foreign embassies, corporations and human rights organizations
1.3.2. when he posted on his web site the log-in information and passwords for 100 of the 1,000 e-mail accounts for which he obtained log-ins and passwords. (His site is no longer online). He posted the information, he said, because he felt it would be the most effective way to make the account owners aware that their communication had been compromised.
1.3.2.1. including one corporation that does more than $10bn in annual revenue.
1.3.2.2. request of American law enforcement agencies
1.3.3. Initially, Egerstad refused to disclose how he obtained the log-ins and passwords. But then in September he revealed that he'd intercepted the information through five exit nodes that he'd set up on the Tor network in Asia, the US and Europe
1.3.4. Tor is used by people who want to maintain privacy and don't want anyone to know where they go on the web or with whom they communicate. Tor traffic is encrypted while it's enroute, but is decrypted as it leaves the exit node and goes to its final destination. Egerstad simply sniffed the plaintext traffic that passed through his five exit nodes to obtain the user names and passwords of e-mail accounts.
1.3.4.1. #1 Five ToR exit nodes, at different locations in the world, equipped with our own packet-sniffer focused entirely on POP3 and IMAP traffic using a keyword-filter looking for words like “gov, government, embassy, military, war, terrorism, passport, visa” as well as domains belonging to governments. This was all set up after a small experiment looking into how many users encrypt their mail where one mail caught my eye and got me started thinking doing a large scale test. Each user is not only giving away his/her passwords but also every mail they read or download together with all other traffic such as web and instant messaging.
1.3.5. Egerstad didn't hack any systems to obtain the data and therefore says he didn't break any laws, but once he posted the log-in details for the accounts online he provided others with all the information they needed to breach the accounts and read sensitive correspondence stored in them.
1.3.6. what he could read
1.3.6.1. Victims of Egerstad's research project included embassies belonging to Australia, Japan, Iran, India and Russia. Egerstad also found accounts belonging to the foreign ministry of Iran, the United Kingdom's visa office in Nepal and the Defence Research and Development Organization in India's Ministry of Defence.
1.3.6.2. In addition, Egerstad was able to read correspondence belonging to the Indian ambassador to China, various politicians in Hong Kong, workers in the Dalai Lama's liaison office and several human-rights groups in Hong Kong.
1.4. Why?
1.4.1. But Egerstad remains convinced he did the right thing, saying it was the only way to call attention to problem that Tor officials have already warned about previously.
1.4.2. withheld details on how he came into possession of the passwords, instead writing that "there is no exploit to publish, no vendor to contact".
1.5. Threat
1.5.1. But Egerstad says that many who use Tor mistakenly believe it is an end-to-end encryption tool. As a result, they aren't taking the precautions they need to take to protect their web activity.
1.5.2. "I am absolutely positive that I am not the only one to figure this out," Egerstad says. "I'm pretty sure there are governments doing the exact same thing. There's probably a reason why people are volunteering to set up a node."
1.5.2.1. For example, several Tor nodes in the Washington, D.C., area can handle up to 10T bytes of data a month, a flow of data that would cost at least US$5,000 a month to run, and is likely way out the range of volunteers who run a node on their own money, Egerstad said. "Who would pay for that?" Egerstad said
1.5.3. To his surprise, he found that more than 99 percent of the traffic -- including requests for Web sites, instant messaging traffic and e-mails -- were transmitted unencrypted.
1.5.3.1. but it can't encrypted
1.5.3.2. unless you have some UDP SSL thing
1.5.4. Egerstad said the process of snooping on the traffic is trivial. The problem is not with Tor, which still works as intended, but with users' expectations: the Tor system is designed to merely anonymize Internet traffic and does not perform end-to-end encryption.
1.5.5. know where to sniff
1.5.5.1. Yes of course end-to-end encryption would have fixed this, but without it Onion routing actually exacerbates the risk of packet sniffing.
1.5.5.2. The fact Onion routing was used is the only way this "researcher" (that leaves a bad taste) could get access to those packets in the first place - with regular routing he'd need to have access to the embassy's ISP's network, or their upstream networks, to sniff those packets.
1.6. Response
1.6.1. house raided on Monday by Swedish officials, who took him in for questioning
1.6.2. While three of them took him to the local police headquarters for questioning, the other two agents ransacked his house and hauled away three computers, external hard drives, CDs, notebooks and various papers
1.6.3. Egerstad hasn't been charged with anything but is under suspicion for breaking into computers, which he says he never did. Egerstad said the agents told him they were investigating him because he had "pissed off some foreign countries."
1.6.4. The posting of 100 official embassy passwords has made Egerstad a pariah in many circles. Publishing information that allows any old criminal to infiltrate sensitive government networks is a touchy thing, and many, including several Reg readers, have denounced it.
1.7. Analysis
1.7.1. As Egerstad and I discussed the problem in August, we both came to the conclusion that the embassy employees were likely not using Tor nor even knew what Tor was. Instead, we suspected that the traffic he sniffed belonged to someone who had hacked the accounts and was eavesdropping on them via the Tor network. As the hacked data passed through Egerstad's Tor exit nodes, he was able to read it as well.
1.7.2. it's NOT a problem within Tor. Tor is meant for privacy, not confidentiality!!!! I'm a bit amazed governments and companies are using this as a security measure.
1.7.3. It's not a written law but it is a guideline in having a responsible disclosure. I think he did a responsible disclosure. Was it legal? He did intercept traffic that was not destined for him. So probably "no" depending on Swedish law. Is our society a safer place after the disclosure. Yes, I think it is. Instead of arresting him, the government should have offered him a job.
1.7.4. And what did we learn today? Don't report a security hole, sell it to Russia. Just kidding, but do check legal council before doing a disclosure.
1.8. Other articles
1.8.1. Wired article
1.8.1.1. again
1.8.2. Register article
1.8.3. Security For all blog
1.8.3.1. again
1.8.4. PC World
1.8.5. PasswordResearch blog
1.8.6. Shava Nerad Development Director, The Tor Project
1.8.6.1. A connection through Tor can be encrypted end-to-end -- but only if one is communicating with a secure protocol -- https: or encrypted chat both would be examples of this.
1.8.6.2. more sensible comments
1.8.6.2.1. be sensible
1.8.6.2.2. use encryption
2. Quick Summary
2.1. Data disclosure using the ToR Anonymity Network from 2007
2.2. Corresponding blog article
3. ToR background
3.1. a distributed system of computers that anonymizes the source of network traffic
3.2. how it works
3.2.1. from the ToR site itself
3.2.2. Under Tor's architecture, administrators at the entry point can identify the user's IP address, but can't read the content of the user's correspondence or know its final destination. Each node in the network thereafter only knows the node from which it received the traffic, and it peels off a layer of encryption to reveal the next node to which it must forward the connection. (Tor stands for "The Onion Router.")
3.2.3. Tor works by using servers donated by volunteers around the world to bounce traffic around en route to its destination. Traffic is encrypted through most of that route, and routed over a random path each time a person uses it.
3.2.4. downloaded from the Tor website to configure several servers designed to bounce sensitive traffic around the internet before it ultimately is routed to its destination. The Tor servers try to make it harder to trace the originator of traffic in much the same way an agent under surveillance might quickly drive in and out of a parking garage to throw off pursuers.
3.2.5. 1600 nodes
3.3. exit node caveat
3.3.1. Tor has taken pains to warn its users that people running so-called exit nodes - which are the last Tor servers to touch a packet before sending it on its way - "can read the bytes that come in and out there." They go on to say: "This is why you should always use end-to-end encryption such as SSL for sensitive Internet connections."
3.3.2. Unless they're surfing to a website protected with SSL encryption, or use encryption software like PGP, all of their e-mail content, instant messages, surfing and other web activity is potentially exposed to any eavesdropper who owns a Tor server. This amounts to a lot of eavesdroppers -- the software currently lists about 1,600 nodes in the Tor network.
3.3.2.1. but then not anonymous!
3.4. who uses it?
3.4.1. has a slew of beneficial uses: Human-rights workers, the military and journalists all use the system. However, the anonymity of Tor has also attracted seedier elements as well: digital pirates, online criminals and, quite possibly, child pornographers
3.4.2. TOR (The Onion Router) is a network of proxy nodes set up to provide some privacy and anonymity to its users. Originally backed by the US Naval Research Laboratory, TOR became an Electronic Frontier Foundation (EFF) project three years ago. The system provides a way for whistleblowers and human rights workers to exchange information with journalists, among other things. The system also provides plenty of scope for mischief.
3.4.3. Tor has hundreds of thousands of users around the world, according to its developers. The largest numbers of users are in the United States, the European Union and China.
3.4.4. The first is the use by embassies of the Tor product to obfusticate their communications. This is a reasonable response to the assumed traffic monitoring by the host country.
3.5. manipulations
3.5.1. data from exit node eavesdropping
3.5.2. exit node man-in-the-middle attacks
3.5.2.1. response
3.5.3. SPAM impersonation of Tor by Storm