Paper I wrote last year: The Faithless Endpoint: How Tor puts certain users at greater risk. News this week: Tor at the Heart of Embassy Password Breach.
The Register's article title is disingenuous. Tor wasn't at the heart of this -- plaintext authentication was. The same sort of attack can be done if you own some strategically-located routers, or operate rogue wireless access points, or set up a yagi and AirSnort in the right places in Washington DC or Brussels.
Allow me to quote the last paragraph of my tech report:
It is the lack of ubiquitous cryptography in network communication protocols that enables these attacks in the first place. Providers of network services should work to ensure that whenever possible, network communications are encrypted between the server and the client, and servers can be authenticated by the client, to avoid the potential for man-in-the-middle attacks in contexts where they are a likely threat.
It's just so much fun when people rediscover password sniffing. (And don't get me started on how much of an asshat this guy was for actually doing the attack. I mean, okay, perhaps performing the attack in such a way that the actual passwords aren't logged, or are only partially logged, in the style of the Wall of Sheep at DEFCON might be justified under the pretense that no one would take him seriously otherwise -- but grabbing the full username/password combos and publishing them? WTF? I highly doubt his belief that this was not illegal in at least one of the countries that has signed the Council of Europe Cybercrime Treaty -- but even if it was legal, it was certainly unethical.)
It's just so much fun when people rediscover password sniffing. (And don't get me started on how much of an asshat this guy was for actually doing the attack. I mean, okay, perhaps performing the attack in such a way that the actual passwords aren't logged, or are only partially logged, in the style of the Wall of Sheep at DEFCON might be justified under the pretense that no one would take him seriously otherwise -- but grabbing the full username/password combos and publishing them? WTF? I highly doubt his belief that this was not illegal in at least one of the countries that has signed the Council of Europe Cybercrime Treaty -- but even if it was legal, it was certainly unethical.)
This is shameful behavior for a Tor operator. (At the same time, it's naive to think that all operators of anonymity services are going to be saints. Mr. Egerstad appears to have had good intentions, or at least nothing more sinister than publicity grubbing. There's worse foes running Tor nodes -- you can count on that.)
[Edit: Nevertheless, while a malicious Tor operator is in the position to sniff your clear-text passwords and communications if he operates the exit node, unless he also operates enough of the other nodes you're using in your circuit, he can't break your anonymity, provided you're properly using end-to-end encryption for your sensitive, identity-revealing data (as you damn-well should be.) Again, the moral of the story: don't use clear-text for sensitive data on the Internet. It's not just Tor operators who have access to this data, but any hacker who has owned a switch on the route you're using for non-Tor communication, and so on.]
But back to the issue at hand: this appears to me to be nothing more than a publicity stunt. Personally, I'd be horrified if the first two pages of Google hits on my name came up with this. This is not exciting, or interesting. It's sad. He calls himself a researcher, but really, he's a run-of-the-mill black-hat with just enough tech savvy to set up a Tor node and a sniffer that used a regex filter.
I wrote my short tech report in the first place because I knew users are, have always been, and will always be clueless about security and about their threat models, and I was concerned that Tor might actually make things worse for a significant portion of its users, by routing their unencrypted traffic through nodes operated by people like Dan Egerstad. It was supposed to make the designers of these sorts of systems think about how to solve problems such as this, not encourage people to pull publicity stunts.
Let me be clear: I do not believe Tor is to blame here. Nor do I believe that blaming the users, however culpable they may be, is productive. Administrators need to disable non-SSL-protected services like IMAP and POP3 and SMTP and instead only allow their drop-in replacements such as IMAPS, SMTP with STARTTLS, etc. In my tech report, I suggest a few things Tor might do to mitigate these risks, but ultimately, the 1990s are over, and there's no excuse for clear-text authentication credentials anymore. This goes for Vox, too.
This sort of attack is something that the anonymity research community needs to be more concerned about, since plaintext authentication isn't going to go away anytime soon.
(BTW, the password sniffing is the kids stuff. Far more interesting would be the web-browsing habits of people at those embassies, or learning who is emailing whom. Traffic analysis is where the real information comes from. As a Tor operator, even you can be an arm-chair international espionage agent!)
[Edit: No, I don't think Mr. Egerstad was influenced by my paper. I doubt he read it -- the attack he executed is an obvious one. It's even in the Tor FAQ, and has been for a while (though it wasn't when I originally wrote my paper -- I recall checking to see if it was highlighted there at the time.)
The new Mixmaster release signing key for all versions 3.x in the next three years is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQELBEaKWAgBCAC8ywFT8ka4rc7IzdtzQOEcKko4B+kd+tdkHj67nfmC5GMTohYO
Rtnq4salAu/DFtt0YwK1B/OCJyZ1Qz3N1BWS7S9Ef5M0LxpAOmVBM/XGdwkfQrcI
8ubvclPA5tyO+KhhnvgGgqsFVA5ONTUtjnfsEYOWi1PesObsVdHxKSeC6COBV6j0
eReyqP5dnhKBIXtdONFpRPB8OihcYMXIvqKpLAkCECzdpsXbsGvnNtPkZ41/ZXDM
kKILsewnIQjv/QviBN5yUasjutPiQPdyYNwDVEGjQhtKjwq8bs12VwiDk80Iuecx
Xc92/p+9mKbDeYYU+SCXUbHh/4CZZ2V2EgEHAAYptCZNaXhtYXN0ZXIgMy54IENv
ZGUgUmVsZWFzZSBTaWduaW5nIEtleYkBOQQTAQIAIwUCRopYCAIbAwUJBaOagAUL
BwMCAQMVAgMDFgIBAh4BAheAAAoJEBr1HOcpk9X5AJwIAI6Y4WGNPFAEiBxjYLcc
hcbSsm7HkOaBEqyNKu2IwRhOigS9wGosEnEF93e6dkCnd+KoCIhLJrXNYt7ba0Lm
vR1FKlR07bDpJkRAnLUg+Y5sNfbaW/p8BNPFMcJ/pJm70Btq4exMEIGTEZ1MYyeT
ivogayyVusqTzgP7ubXYo5t+lcmR67CTgnIBAF9DqreG2a7Ud64tefypVk4rRMR1
JrvES71/fMTPgZH/4VWpgFCfEmD/PuBFeT8EO1QzcU9UVqe8898anJRMjOqMENTw
vYS0g7mWEMz1fsZVj5n6CNTpKFrYRblVhA9v1+ohhFVgPzaYUgkM2ENKA6BrLLCB
MqmJAiIEEwECAAwFAkaKWiYFgwWjmGIACgkQSgqBSV3kgPwKHg/7BDkqnLIpGl6P
LrRsKQL9H36JYgtU3DNLxdM1abMPXIo6BP7E+PICfGoAWAZxOIebWeS8AgJoddjW
Mg9KF3b3F3Fs/ALX9i3dvQFgk1eO8ZWA4io8KK0eGaxbAPvmx6WS+6EHPRWTCnQx
btr6eXzoRvpZylTKGaxVB7eubgSbfb7ZxQ4LJsl969MntRlygl9euQ4UtI4iKKJL
xLIZjagVp5h5ajEyOqbMn/4aSSOBupcF0bCVrI2Ekmm0Pbf/+6Rn4t6V1nl1nL7l
yZR5ZSRpsx6nzQT2iqowVrgpA5UztPBF71aKKE4UndAxTTfyO66nyDSab4JeM/mP
K3TcLlFGsZGWFBJ/MSCImUDlseD42uVLzZI4JvMDsHW9H4RkO1qKQRpYJfSqrOBS
jVTrm9K3XBFtll6CSvBmCcnPDtggM2J9dDZiv7WRcD3m6GHkhY4cTvwBw/7ksgNr
cWNMDNnm50OIuTtmfNte7PPbnN9RvgYNdGOfnKFagXJPPh9xTugbUbCUm+dRnQk4
fe7aFTY2qudF1DqmXgw2fdLuLmihcQV9YebhCX1ZTLzyOtunh0heDZOnydmb3hut
LOdifQUmVjmMLyGgCkUAyf3tGF8/aXUjQMbVYkBeSvrfP9BOlxc4ommW1WsCeALa
/HP71IARnr1Flwy2zqQGj7fLSJywSv8=
=3r09
-----END PGP PUBLIC KEY BLOCK-----
I have been telling people for years not to give interviews to Annalee Newitz. In the best of worlds, she's a columnist, which puts her in the "yellow journalist / hack - but I'm allowed, because I get to insert my opinions" class. In reality, she's hardly even that.
I'm not here to gripe about the past times she's burnt me when interviewing me. But, it does make me rather mad when my friends get hurt in the same way.
But, honestly, the real problem is people taking Valleywag or Newitz seriously. Please, people. Valleywag is a Silicon Valley tabloid -- and I'm pretty sure they wouldn't deny it. Whether their reporter violated California privacy law by stealing the information from Kevin's phone would be an issue for the DA; I won't comment on that any further. But anything printed on that website, or carrying a Newitz by-line, should just be taken for what it is.
Tech stars have to worry about paparazzi and tabloid pieces. Welcome to Web 2.0, and let's all get over it.
