[tor-talk] Bruce Schneier's Guardian Article about N_S_A and Tor.

Geoff Down geoffdown at fastmail.net
Sat Jun 28 23:55:51 UTC 2014



On Sat, Jun 28, 2014, at 10:38 PM, williamwinkle at openmailbox.org wrote:
> I recently read a Guardian article from last October 
> (www.theguardian.com/world/2013/oct/04/tor-attacks-cnsa-users-online-anonymity) 
> by Bruce Schneier about the N_S_A and Tor. His story was based on the 
> "Tor Stinks" and "Egotistical Giraffe" presentations.
> 
> My understanding of the article is that if individual(s) are requesting 
> http://www.target_website.com then, once the request leaves the exit 
> node, the N_S_A can use their Quantum servers on the Internet's 
> backbones to redirect the request to their FoxAcid servers in order to 
> compromise the requester.
> 
> I don't understand what Schneier means by this:
> 
> "After identifying an individual Tor user on the internet, the NSA uses 
> its network of secret internet servers to redirect those users to 
> another set of secret internet servers, with the codename FoxAcid, to 
> infect the user's computer."
> 
> Surely the whole point of Tor is that the requester of 
> http://www.target_website.com cannot be identified based on the traffic 
> which leaves the exit node. Since the N_S_A would only know the IP 
> address of the exit node and the destination 
> http://www.target_website.com, how can the client be identified even if 
> the traffic is redirected to the FoxAcid servers?

 They are identified as a person of interest by visiting
 target_website.com (where target_website.com might be an 'extremist'
 site or a webmail box that has attracted attention) and then *in real
 time* code injection and redirection can be used to attack the person's
 computer. So 'identifying an individual Tor user' means 'identifying as
 a person of interest, new or previously encountered but not yet
 traced'.
GD

-- 
http://www.fastmail.fm - Email service worth paying for. Try it for free



More information about the tor-talk mailing list