DOCSLIB.ORG

Briefing Jacob Appelbaum

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Briefing Jacob Appelbaum Briefing for Jacob Appelbaum Speaker for WikiLeaks, Member of Tor, and Independent Hacker 28 October 2012 Prepared By Kristen Faulkner | Nolan Kamitaki | Chandan Lodha | Tommy Mullaney | Amy Robinson - 1 - Brief Summary of the Issue Congress is debating a bill requiring all instant messaging (through all kinds of electronic devices) and chat programs to include a mechanism whereby law enforcement authorities can monitor and record the interchange of messages passed through those programs. The bill does not specify whether such monitoring requires a court order, a warrant, or neither. Brief Reaction to the Issue In line with your previous positions, you must 1) oppose this bill; 2) advocate for the repeal of all current wiretapping laws; and 3) encourage individuals to use systems (such as Tor) that enable online anonymity. The Right Approach This bill is a blatant government infringement on individual’s privacy. Therefore, opposing it is critical. However, that is not enough. You must stop the government’s momentum of overstepping privacy rights gained by recent wiretapping laws. To do this you must oppose all current wiretapping laws, with a specific eye toward the ECPA and CALEA, and advocate for their repeal. While repealing all past laws concerning wiretapping may not be feasible, your high profile stand is of the utmost importance in curbing dangerous anti-privacy momentum. In the meantime, you must encourage individuals to use systems like Tor that enable online anonymity and empower citizens to take privacy matters into their own hands and sidestep government over-regulation. Examining the bill with respect to constitutional rights, its infeasibility, society’s best interest, and individuals’ best interests, further supports the proposed approach. Justification for the Right Approach - 2 - A. The legal history Previous rulings have extended the government’s hand in overseeing private communications. Due to the unforeseen increase in digital and electronic communications the Electronic Communications Privacy Act (ECPA) was enacted in 1986 to update the Federal Wiretap Act of 1968.1 The ECPA was an attempt to protect communications (emails, telephone conversations, and data stored electronically) from being intercepted while in transit. It also provided procedures for government officials to obtain warrants to intercept communications. In 1994, the Communication Assistance for Law Enforcement Act (CALEA) significantly amended the ECPA by enabling officials to tap content of new digital technologies. The legislation was extended once more in 2004 when the FCC extended CALEA to apply to broadband networks.2 Legislation has become more and more invasive with respect to privacy, in turn opening gateways for government abuse. The Bush administration admitted to abusing the system by performing warrantless domestic wiretapping.3 This type of abuse is a direct violation of the Fourth Amendment, which protects individuals from warrantless searches, and encroaches on the First Amendment’s freedom of speech. The implementation of the proposed bill would only make such constitutional rights easier to breach. This encroaching momentum of the government is exactly why you must advocate the repeal of all current and invasive wiretapping laws. Rather than implementing systems of scrutiny on its citizens, the government should restore basic, fundamental rights, such as the right to privacy. B. The proposed law is infeasible 1 <http://www.it.ojp.gov/default.aspx?area=privacy&page=1285> 2 CNET News McCullagh, Declan. “FBI: We Need Wiretap-ready Web Sites - Now.” . CBS Interactive, 04 May 2012. Web. 21 Oct. 2012. <http://news.cnet.com/8301-1009_3-57428067-83/fbi-we-need-wiretap-ready-web-sites-now/> 3 <http://www.washingtonpost.com/wp-dyn/content/article/2007/05/15/AR2007051500999.html> - 3 - The proposed legislation simply will not work. First, the law would be a regulatory disaster, requiring vast resources for futile attempts to prevent the unpreventable. Second, the law would in fact be self-contradicting as it would legally require the addition of large-scale vulnerabilities into instant messaging and chat software. The proposed legislation would be a regulatory disaster for three reasons: 1) it will not prevent the creation of chat sites that do not conform to the wiretapping mechanism requirement; 2) it will crowd out legitimate uses of anonymous communication so that only more nefarious options will exist; and 3) it deals with multinational cyber issues where the United States has a poor track record. First, it is practically guaranteed that the enactment of this bill will cause non-compliant chat programs to pop up all over the place. For example, when the music industry and Digital Rights Management created laws to crack down on copyright-infringing file sharing, a staggering abundance of sites were created as direct violations. The NPD Group, a North American market research company, found that “only 37 percent of music acquired by U.S. consumers in 2009 was paid for.”4 As we can see from the preponderance of illegal music downloading sites, general software piracy sites, and pornography sites, the realm of cyberspace simply cannot be regulated to the degree necessary for enforcing this legislation, and regulation may even exacerbate the situation. Moreover, trying to enforce the proposed legislation will only serve to prevent and crowd out legitimate uses of anonymous communication (like reporting human rights violations from “danger zones”5) by law-abiding citizens. Citizens less inclined to follow the law -- presumably citizens also less likely to use anonymous communication for legitimate purposes -- will be the ones who end up with the ability to communicate anonymously through the illegal services that will inevitably arise. 4 “FAQ,” Recording Industry Association of America, accessed 26 Oct. 2012. <http://www.riaa.com/faq.php> 5 “Users of Tor,” Tor Project, accessed 26 Oct. 2012. <https://www.torproject.org/about/torusers.html.en> - 4 - Finally, even if we assume that government officials can ensure that wiretapping mechanisms are installed in all chat software, the use of this wiretapping capability will be dubious given the often international nature of Internet chat traffic. The United States is historically ineffective when it comes to complying with international law and cyber “crime.” One particularly recent example is the American government’s handling of the Kim Dotcom MegaUpload illegal file-sharing case. In this case, the source of the debacle was the excessively-vague warrant used by American authorities to raid Dotcom’s New Zealand residence, a warrant subsequently found “invalid” by New Zealand High Court Judge Helen Winkelmann.6 The bottom line is that foreign laws on search and seizure may not line up one-for-one with American laws, and given the often international nature of online chat programs, it is far from clear how effectively the new wiretapping capabilities of the proposed law would be used. On top of the fact that the proposed law would not work, the law itself is contradictory: in the name of “security,” it requires the insertion of vulnerabilities into secure software, and these vulnerabilities could be exploited either by outside hackers or by the chat software developers themselves. Requiring all chat and instant messaging programs to include backdoors and vulnerabilities enabling government officials to monitor conversations is tantamount to inviting hackers to participate in the conversation. We would essentially be slapping a bright, “U.S. Government” target on every legal chat program, identifying it as inherently vulnerable to attack. And as we know from Wikileaks, the U.S. government is not particularly good at protecting its “secret” intelligence.7, 8 Moreover, consider a scenario where Company X implements the 6 Ars Technica “Mega-victory: Kim Dotcom search warrants ‘invalid,’ mansion raid ‘illegal,’” , June 28, 2012. Accessed 26 Oct. 2012. <http://arstechnica.com/tech-policy/2012/06/mega-victory-kim-dotcom-search-warrants-invalid-mansion- raid-illegal/> 7 “WikiLeaks.” <http://wikileaks.org/> 8 International Federation of Library Associates and “What is the effect of WikiLeaks for Freedom of Information?” Institutions. <http://www.ifla.org/publications/what-is-the-effect-of-wikileaks-for-freedom-of-information> - 5 - government-mandated wiretapping backdoor into its public chat software; what is to stop Company X from monitoring what or whom government officials monitor? This would undermine any covert intelligence obtained under the proposed law because unscrupulous companies and developers could monitor who the FBI, for instance, is watching. Between hackers and developers, this contradictory law -- intended to combat threats to national security -- would create software vulnerabilities that are threats to national security. C. The Right Approach with respect to individual rights Online anonymity is critical for all individuals. People from all professions rely on online anonymity today. Wiretapping laws would effectively eliminate the possibility of online anonymity and impair many individual’s Internet uses.9 Perhaps most important, everyday normal citizens use online anonymity for a variety of reasons. Individuals use anonymity to protect themselves from identity theft, protect their communications, protect their children, and research sensitive topics. People who do not want Internet Service Providers (ISPs) selling their private browsing records, who do not want their IP
Load more

Recommended publications
  • Arxiv:1907.07120V1 [Cs.CY] 16 Jul 2019 1 Introduction That China Hindered Access to I2P by Poisoning DNS Resolu- Tions of the I2P Homepage and Three Reseed Servers
    Measuring I2P Censorship at a Global Scale Nguyen Phong Hoang Sadie Doreen Michalis Polychronakis Stony Brook University The Invisible Internet Project Stony Brook University Abstract required flexibility for conducting fine-grained measurements on demand. We demonstrate these benefits by conducting an The prevalence of Internet censorship has prompted the in-depth investigation of the extent to which the I2P (invis- creation of several measurement platforms for monitoring ible Internet project) anonymity network is blocked across filtering activities. An important challenge faced by these different countries. platforms revolves around the trade-off between depth of mea- Due to the prevalence of Internet censorship and online surement and breadth of coverage. In this paper, we present surveillance in recent years [7, 34, 62], many pro-privacy and an opportunistic censorship measurement infrastructure built censorship circumvention tools, such as proxy servers, virtual on top of a network of distributed VPN servers run by vol- private networks (VPN), and anonymity networks have been unteers, which we used to measure the extent to which the developed. Among these tools, Tor [23] (based on onion rout- I2P anonymity network is blocked around the world. This ing [39,71]) and I2P [85] (based on garlic routing [24,25,33]) infrastructure provides us with not only numerous and ge- are widely used by privacy-conscious and censored users, as ographically diverse vantage points, but also the ability to they provide a higher level of privacy and anonymity [42]. conduct in-depth measurements across all levels of the net- In response, censors often hinder access to these services work stack.
    [Show full text]
  • Hacking the Web
    Hacking the Web (C) 2009-2020 Arun Viswanathan Ellis Horowitz Marco Papa 1 Table of Contents } General Introduction } Authentication Attacks } Client-Side Attacks } Injection Attacks } Recent Attacks } Privacy Tools 2 (C) 2009-2020 Arun Viswanathan Ellis Horowitz Marco Papa Why secure the Web? } The Web has evolved into an ubiquitous entity providing a rich and common platform for connecting people and doing business. } BUT, the Web also offers a cheap, effective, convenient and anonymous platform for crime. } To get an idea, the Web has been used for the following types of criminal activities (source: The Web Hacking Incidents Database (WHID) http://projects.webappsec.org/w/page/13246995/Web-Hacking-Incident-Database) } Chaos (Attack on Russian nuclear power websites amid accident rumors (5Jan09) } Deceit (SAMY XSS Worm – Nov 2005) } Extortion (David Aireys domain hijacked due to a CSRF (cross site request forgery) flaw in Gmail – 30Dec2007) } Identity Theft (XSS on Yahoo! Hot jobs – Oct 2008) } Information Warfare (Israeli Gaza War - Jan 2009 / Balkan Wars – Apr 2008 ) } Monetary Loss (eBay fraud using XSS) } Physical Pain (Hackers post on epilepsy forum causes migraines and seizures – May 2008) } Political Defacements (Hacker changes news release on Sheriffs website – Jul 2008) (Obama, Oreilly and Britneys Twitter accounts hacked and malicious comments posted – Jan 09) } Chinese Gaming sites hacked (Dec. 2011) 3 Copyright(C) 2009 (c) -20092020- 2019Arun Arun Viswanathan Viswanathan Ellis HorowitzEllis Horowitz Marco Marco Papa Papa
    [Show full text]
  • Tor and Circumvention: Lessons Learned
    Tor and circumvention: Lessons learned Nick Mathewson The Tor Project https://torproject.org/ 1 What is Tor? Online anonymity 1) open source software, 2) network, 3) protocol Community of researchers, developers, users, and relay operators Funding from US DoD, Electronic Frontier Foundation, Voice of America, Google, NLnet, Human Rights Watch, NSF, US State Dept, SIDA, ... 2 The Tor Project, Inc. 501(c)(3) non-profit organization dedicated to the research and development of tools for online anonymity and privacy Not secretly evil. 3 Estimated ~250,000? daily Tor users 4 Anonymity in what sense? “Attacker can’t learn who is talking to whom.” Bob Alice Alice Anonymity network Bob Alice Bob 5 Threat model: what can the attacker do? Alice Anonymity network Bob watch Alice! watch (or be!) Bob! Control part of the network! 6 Anonymity isn't cryptography: Cryptography just protects contents. “Hi, Bob!” “Hi, Bob!” Alice <gibberish> attacker Bob 7 Anonymity isn't just wishful thinking... “You can't prove it was me!” “Promise you won't look!” “Promise you won't remember!” “Promise you won't tell!” “I didn't write my name on it!” “Isn't the Internet already anonymous?” 8 Anonymity serves different interests for different user groups. Anonymity “It's privacy!” Private citizens 9 Anonymity serves different interests for different user groups. Anonymity Businesses “It's network security!” “It's privacy!” Private citizens 10 Anonymity serves different interests for different user groups. “It's traffic-analysis resistance!” Governments Anonymity Businesses “It's network security!” “It's privacy!” Private citizens 11 Anonymity serves different interests for different user groups.
    [Show full text]
  • Meeting the Privacy Movement
    -----BEGIN PGP MESSAGE----- Charset: utf-8 Version: GnuPG v2 hQIMA5xNM/DISSENT7ieVABAQ//YbpD8i8BFVKQfbMy I3z8R8k/ez3oexH+sGE+tPRIVACYMOVEMENTRvU+lSB MY5dvAkknydTOF7xIEnODLSq42eKbrCToDMboT7puJSlWr W Meeting the Privacy Movement d 76hzgkusgTrdDSXure5U9841B64SwBRzzkkpLra4FjR / D z e F Dissent in the Digital Age 0 M 0 0 m BIPhO84h4cCOUNTERREVOLUTION0xm17idq3cF5zS2 GXACTIVISTSXvV3GEsyU6sFmeFXNcZLP7My40pNc SOCIALMOVEMENTgQbplhvjN8i7cEpAI4tFQUPN0dtFmCu h8ZOhP9B4h5Y681c5jr8fHzGNYRDC5IZCDH5uEZtoEBD8 FHUMANRIGHTSwxZvWEJ16pgOghWYoclPDimFCuIC 7K0dxiQrN93RgXi/OEnfPpR5nRU/Qv7PROTESTaV0scT nwuDpMiAGdO/byfCx6SYiSURVEILLANCEFnE+wGGpKA0rh C9Qtag+2qEpzFKU7vGt4TtJAsRc+5VhNSAq8OMmi8 n+i4W54wyKEPtkGREENWALDk41TM9DN6ES7sHtA OfzszqKTgB9y10Bu+yUYNO2d4XY66/ETgjGX3a7OY/vbIh Ynl+MIZd3ak5PRIVACYbNQICGtZAjPOITRAS6E ID4HpDIGITALAGEBhcsAd2PWKKgHARRISON4hN4mo7 LIlcr0t/U27W7ITTIEpVKrt4ieeesji0KOxWFneFpHpnVcK t4wVxfenshwUpTlP4jWE9vaa/52y0xibz6az8M62rD9F/ XLigGR1jBBJdgKSba38zNLUq9GcP6YInk5YSfgBVsvTzb VhZQ7kUU0IRyHdEDgII4hUyD8BERLINmdo/9bO/4s El249ZOAyOWrWHISTLEBLOWINGrQDriYnDcvfIGBL 0q1hORVro0EBDqlPA6MOHchfN+ck74AY8HACKTIVISMy 8PZJLCBIjAJEdJv88UCZoljx/6BrG+nelwt3gCBx4dTg XqYzvOSNOWDENTEahLZtbpAnrot5APPELBAUMzAW Qn6tpHj1NSrAseJ/+qNC74QuXYXrPh9ClrNYN6DNJGQ +u8ma3xfeE+psaiZvYsCRYPTOGRAPHYwkZFimy R9bjwhRq35Fe1wXEU4PNhzO5muDUsiDwDIGITAL A Loes Derks van de Ven X o J 9 1 H 0 w J e E n 2 3 S i k k 3 W Z 5 s XEGHpGBXz3njK/Gq+JYRPB+8D5xV8wI7lXQoBKDGAs -----END PGP MESSAGE----- Meeting the Privacy Movement Dissent in the Digital Age by Loes Derks van de Ven A thesis presented to the
    [Show full text]
  • Tor: the Second-Generation Onion Router (2014 DRAFT V1)
    Tor: The Second-Generation Onion Router (2014 DRAFT v1) Roger Dingledine Nick Mathewson Steven Murdoch The Free Haven Project The Free Haven Project Computer Laboratory [email protected] [email protected] University of Cambridge [email protected] Paul Syverson Naval Research Lab [email protected] Abstract Perfect forward secrecy: In the original Onion Routing We present Tor, a circuit-based low-latency anonymous com- design, a single hostile node could record traffic and later munication service. This Onion Routing system addresses compromise successive nodes in the circuit and force them limitations in the earlier design by adding perfect forward se- to decrypt it. Rather than using a single multiply encrypted crecy, congestion control, directory servers, integrity check- data structure (an onion) to lay each circuit, Tor now uses an ing, configurable exit policies, anticensorship features, guard incremental or telescoping path-building design, where the nodes, application- and user-selectable stream isolation, and a initiator negotiates session keys with each successive hop in practical design for location-hidden services via rendezvous the circuit. Once these keys are deleted, subsequently com- points. Tor is deployed on the real-world Internet, requires promised nodes cannot decrypt old traffic. As a side benefit, no special privileges or kernel modifications, requires little onion replay detection is no longer necessary, and the process synchronization or coordination between nodes, and provides of building circuits is more reliable, since the initiator knows a reasonable tradeoff between anonymity, usability, and ef- when a hop fails and can then try extending to a new node.
    [Show full text]
  • Piracy Versus Privacy: an Analysis of Values Encoded in the Piratebrowser
    International Journal of Communication 9(2015), 818–838 1932–8036/20150005 Piracy Versus Privacy: An Analysis of Values Encoded in the PirateBrowser BALÁZS BODÓ University of Amsterdam, Institute for Information Law The Netherlands The PirateBrowser is a Web browser that uses Tor privacy-enhancing technology to circumvent nationally implemented Internet filters blocking access to The Pirate Bay. This article analyzes the possible consequences of a mass influx of copyright pirates into the privacy domain. The article addresses the effects of the uptake of strong privacy technologies by pirates on copyright enforcement and on free speech and privacy technology domains. Also discussed are the norms and values reflected in the specific design choices taken by the developers of the PirateBrowser. Keywords: piracy, privacy, Tor, privacy-enhancing technologies, policy Introduction Tor (The Onion Router), “endorsed by Egyptian activists, WikiLeaks, NSA, GCHQ, Chelsea Manning, Snowden” (Dingledine & Appelbaum, 2013), is a volunteer network of computers that relays Web traffic through itself to provide anonymous, unobserved, and uncensored access to the Internet. It has about 4,000 relays and about 1,000 exit nodes. Tor users connect to the network, and their Web traffic is channeled through the internal relays to reach its final destination through one of the exit nodes. This arrangement makes the identification and surveillance of Tor users difficult. Anonymity is promised by the difficulty of tracing the Web traffic that appears on the exit node back to the individual who initiated the traffic, as long as there is a sufficient number of internal hops in between. Protection from surveillance is granted by the fact that each link in the communication chain is encrypted.
    [Show full text]
  • Jacob Appelbaum, Wikileaks Activist and Tor Project Leader, Travels to Beijing to Work with Artist/Activist Ai We
    Breaking News: Jacob Appelbaum, Wikileaks activist and Tor Project leader, travels to Beijing to work with artist/activist Ai Weiwei for Rhizome's Seven on Seven conference at the New Museum. Laura Poitras documents the pair in her first film since Citizenfour, premiering excerpts at the event on May 2. On Saturday, April 19, Jacob Appelbaum—notable Wikileaks and Tor Project activist—traveled to Beijing for five days to take part in a collaboration with dissident artist Ai Weiwei, at the invitation of art- meets-tech organization Rhizome, on the occasion of the seventh Seven on Seven conference at the New Museum. Director Laura Poitras, whose portrait of Edward Snowden won the 2015 Academy Award for Documentary Feature, filmed the duo's work. Seven on Seven is an annual signature conference with a unique format that pairs artists and technologists together to make something new in 24 hours. The pair worked to create an artwork that underscores their mutual concerns with privacy, surveillance, and their state-restricted movement. Excerpts of the short film documenting this collaboration—Poitras' first since Citizenfour—will be premiered at the event, held at New Museum in New York on May 2, and the final film will be released online later in May. The Appelbaum/Ai collaboration was organized by Heather Corcoran, Executive Director of Rhizome, who said: “It was important to bring together these two courageous people who are disseminating their messages using art and technology, respectively, and facing similar levels of scrutiny and hardship as a result. It represents the best that Rhizome achieves with Seven on Seven, which brings the worlds of technology and art into closer proximity, to share strategies for thinking critically about digital culture and communicating those ideas.
    [Show full text]
  • K:\Buchanan\Mkelley\Order Opinions\Wikileaks\11-Dm-3
    Case 1:11-dm-00003-TCB Document 38 Filed 03/11/11 Page 1 of 20 IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA Alexandria Division ) ) ) ) ) In Re: §2703(d) Order; 10GJ3793 ) Miscellaneous No. 1:11dm00003 ) ) ) ) ) ) MEMORANDUM OPINION This matter came before the Court the Motion of Real Parties in Interest Jacob Appelbaum, Birgitta Jonsdottir, and Rop Gonggrijp to Vacate December 14, 2010 Order (“Motion to Vacate”, Dkt. 1) and Motion of Real Parties in Interest Jacob AppelBaum, Rop Gonggrijp, and Birgitta Jonsdottir for Unsealing of Sealed Court Records. (“Motion to Unseal”, Dkt. 3). For the following reasons, petitioners’ Motion to Vacate is DENIED, and petitioners’ Motion to Unseal is DENIED in part, GRANTED in part, and taken under further consideration in part. BACKGROUND Petitioners are Twitter users associated with account names of interest to the government. Petitioner Jacob Appelbaum (Twitter name “ioerror”) is a United States citizen and resident, described as a computer security researcher. (Pet. Motion to Unseal at 3). Rop Gonggrijp (Twitter name “rop_g”) is a Dutch citizen and computer security specialist. Id. Birgitta Case 1:11-dm-00003-TCB Document 38 Filed 03/11/11 Page 2 of 20 Jonsdottir (Twitter name “birgittaj”) is an Icelandic citizen and resident. She currently serves as a member of the Parliament of Iceland. Id. On December 14, 2010, upon the government’s ex parte motion, the Court entered a sealed Order (“Twitter Order”) pursuant to 18 U.S.C. § 2703(d) of the Stored Communications Act, which governs government access to customer records stored by a service provider.
    [Show full text]
  • The Art of Dissident Domesticity Julian Assange, King Prempeh, and Ethnographic Conceptualism in the Prison House
    The Art of Dissident Domesticity Julian Assange, King Prempeh, and Ethnographic Conceptualism in the Prison House Khadija von Zinnenburg Carroll, Michał Murawski, and Jesse Weaver Shipley What happens to domestic life when the state turns a troublesome sub- ject’s home into a prison, when an outlaw evading custody turns an extra- territorial space, such as an embassy, into a home? How is a foreign sov- ereign transformed into an imperial citizen- subject through exile, house arrest, and return? Exile and forced domesticity have long linked sover- eignty to the power to determine intimate life. Centuries- old practices of house arrest and diplomatic asylum have taken on new forms in recent decades in the wake of emerging surveillance technologies and changing relationships between information, territory, and sovereignty. This article examines two quite distinct, high- prole celebrity instances of what we call dissident domesticity. In the rst case, Prempeh I, the last sovereign king of Asante, is exiled by the British from his capital of Kumasi, in what is now Ghana, and placed under house arrest in the Seychelles to end a war of British imperial conquest. In the second case, WikiLeaks founder Julian Assange, the twenty- rst century’s iconic dissident, seeks asylum in the Ecuadorian embassy in London to avoid arrest and extradition. Prempeh’s exile on the edge of empire and Assange’s connement at its center show how the ght over the control of information, and those who circulate it, converges with the struggle for the control of territory, and those who police it, transverse it, and are trapped by it.
    [Show full text]
  • Security Analysis of Instant Messenger Torchat
    TALLINN UNIVERSITY OF TECHNOLOGY Faculty of Information Technology Department of Informatics Chair of Software Engineering Security Analysis of Instant Messenger TorChat Master's Thesis Student: Rain Viigipuu Student code: 072125 Supervisor: Alexander Norta, PhD External Supervisor: Arnis Parˇsovs, MSc TALLINN 2015 Abstract TorChat is a peer-to-peer instant messenger built on top of the Tor network that not only provides authentication and end-to-end encryption, but also allows the communication parties to stay anonymous. In addition, it prevents third parties from even learning that communication is taking place. The aim of this thesis is to document the protocol used by TorChat and to analyze the security of TorChat and its reference implementation. The work shows that although the design of TorChat is sound, its implementation has several flaws, which make TorChat users vulnerable to impersonation, communication confirmation and denial-of-service attacks. 2 Contents 1 Introduction 6 2 Tor and Hidden Services 8 2.1 Hidden Services . .9 2.1.1 Hidden service address . 11 3 TorChat 12 3.1 Managing Contacts and Conversations . 12 3.2 Configuration Options . 16 4 TorChat Protocol 17 4.1 Handshake . 17 4.2 File Transfers . 18 4.3 Protocol Messages . 19 4.3.1 not implemented . 19 4.3.2 ping . 20 4.3.3 pong . 21 4.3.4 client . 22 4.3.5 version . 22 4.3.6 status . 22 4.3.7 profile name . 23 4.3.8 profile text . 23 4.3.9 profile avatar alpha . 24 4.3.10 profile avatar . 24 4.3.11 add me.............................
    [Show full text]
  • The Potential Harms of the Tor Anonymity Network Cluster Disproportionately in Free Countries
    The potential harms of the Tor anonymity network cluster disproportionately in free countries Eric Jardinea,1,2, Andrew M. Lindnerb,1, and Gareth Owensonc,1 aDepartment of Political Science, Virginia Tech, Blacksburg, VA 24061; bDepartment of Sociology, Skidmore College, Saratoga Springs, NY 12866; and cCyber Espion Ltd, Portsmouth PO2 0TP, United Kingdom Edited by Douglas S. Massey, Princeton University, Princeton, NJ, and approved October 23, 2020 (received for review June 10, 2020) The Tor anonymity network allows users to protect their privacy However, substantial evidence has shown that the preponder- and circumvent censorship restrictions but also shields those ance of Onion/Hidden Services traffic connects to illicit sites (7). distributing child abuse content, selling or buying illicit drugs, or With this important caveat in mind, our data also show that the sharing malware online. Using data collected from Tor entry distribution of potentially harmful and beneficial uses is uneven, nodes, we provide an estimation of the proportion of Tor network clustering predominantly in politically free regimes. In particular, users that likely employ the network in putatively good or bad the average rate of likely malicious use of Tor in our data for ways. Overall, on an average country/day, ∼6.7% of Tor network countries coded by Freedom House as “not free” is just 4.8%. In users connect to Onion/Hidden Services that are disproportion- countries coded as “free,” the percentage of users visiting Onion/ ately used for illicit purposes. We also show that the likely balance Hidden Services as a proportion of total daily Tor use is nearly of beneficial and malicious use of Tor is unevenly spread globally twice as much or ∼7.8%.
    [Show full text]
  • Monitoring the Dark Web and Securing Onion Services
    City University of New York (CUNY) CUNY Academic Works Publications and Research Queensborough Community College 2017 Monitoring the Dark Web and Securing Onion Services John Schriner CUNY Queensborough Community College How does access to this work benefit ou?y Let us know! More information about this work at: https://academicworks.cuny.edu/qb_pubs/41 Discover additional works at: https://academicworks.cuny.edu This work is made publicly available by the City University of New York (CUNY). Contact: [email protected] Monitoring the Dark Web Schriner 1 John Schriner Monitoring the Dark Web Contrary to what one may expect to read with a title like Monitoring the Dark Web, this paper will focus less on how law enforcement works to monitor hidden web sites and services and focus more on how academics and researchers monitor this realm. The paper is divided into three parts: Part One discusses Tor research and how onion services work; Part Two discusses tools that researchers use to monitor the dark web; Part Three tackles the technological, ethical, and social interests at play in securing the dark web. Part One: Tor is Research-Driven Tor (an acronym for 'the onion router' now stylized simply 'Tor') is an anonymity network in which a user of the Tor Browser connects to a website via three hops: a guard node, a middle relay, and an exit node. The connection is encrypted with three layers, stripping a layer at each hop towards its destination server. No single node has the full picture of the connection along the circuit: the guard knows only your IP but not where the destination is; the middle node knows the guard and the exit node; the exit node knows only the middle node and the final destination.
    [Show full text]