Tor cannot protect you from targeted surveillance

In the wake of all the revelations about mass Internet surveillance efforts by the US NSA, a lot of users but also many businesses and government agencies around the world have turned to using the Tor anonymity network to keep their sensitive information away from the intelligence agencies’ hands and that of anyone else who’d like to steal it.

But Andy Malone, founder of the Cybercrime Security Forum and Microsoft MVP, warns that using Tor does not guarantee the information you’re trying to keep hidden won’t be compromised.

“There is no such thing as really being anonymous on the internet. If hackers and government agencies want you, they will get you,” he said at the Microsoft TechEd North America 2014, during his talk about the “Deep Dark Web”.

“You can get people on Tor in a variety of ways. You could do a time attack, which involves catching traffic between relays. You could also do entry and exit node monitoring, which involves dropping a zero-day on the actual machine accessing Tor or hosting an exit node and monitoring what’s going in or out of it.”

Other types of attack include the intersection, replay and DDoS attacks. You can get more details about them from Malone’s presentation slides.

The biggest danger that comes from using Tor is if the user doesn’t really know what Tor can and cannot offer and/or guarantee.

The security of the Tor network itself has not yet been broken (as far as we know), but Malone says that Tor leaks can occur through third-party apps and add-ons. “If I was doing forensics on you and thought you were on Tor I wouldn’t attack the network I’d attack the weak areas around it,” says Malone.

Users should also be aware that the NSA and the GCHQ are installing hundreds of Onion Routers in order to capture and analyze traffic. If they visit the Deep Web, they should also know that among the different websites there are also honeypot ones created (or hijacked and turned into honehypots) by law enforcement agencies to catch criminals.

Malone ended his presentation with tips on how to use Tor, and a short overview on alternative solutions to keep your privacy online – whether you want to visit sites or blow a whistle on something anonymously, communicate over the Internet or send messages securely.