- Top-secret documents detail repeated efforts to crack Tor
- US-funded tool relied upon by dissidents and activists
- Core security of network remains intact but NSA has some success attacking users’ computers
- Bruce Schneier: the NSA’s attacks must be made public
- Attacking Tor: the technical details
- ‘Peeling back the layers with Egotistical Giraffe’ – document
- ‘Tor Stinks’ presentation – full document
- Tor: ‘The king of high-secure, low-latency anonymity’
By James Ball, Bruce Schneier and Glenn Greenwald
theguardian.com, Friday 4 October 2013
The National Security Agency has made repeated attempts to develop attacks against people using Tor, a popular tool designed to protect online anonymity, despite the fact the software is primarily funded and promoted by the US government itself.
Top-secret NSA documents, disclosed by whistle blower Edward Snowden, reveal that the agency’s current successes against Tor rely on identifying users and then attacking vulnerable software on their computers. One technique developed by the agency targeted the Firefox web browser used with Tor, giving the agency full control over targets’ computers, including access to files, all keystrokes and all online activity.
But the documents suggest that the fundamental security of the Tor service remains intact. One top-secret presentation, titled ‘Tor Stinks’, states: “We will never be able to de-anonymize all Tor users all the time.” It continues: “With manual analysis we can de-anonymize a very small fraction of Tor users,” and says the agency has had “no success de-anonymizing a user in response” to a specific request.
Another top-secret presentation calls Tor “the king of high-secure, low-latency internet anonymity”.
Tor – which stands for The Onion Router – is an open-source public project that bounces its users’ internet traffic through several other computers, which it calls “relays” or “nodes”, to keep it anonymous and avoid online censorship tools.
It is relied upon by journalists, activists and campaigners in the US and Europe as well as in China, Iran and Syria, to maintain the privacy of their communications and avoid reprisals from government. To this end, it receives around 60% of its funding from the US government, primarily the State Department and the Department of Defense – which houses the NSA.
Despite Tor’s importance to dissidents and human rights organizations, however, the NSA and its UK counterpart GCHQ have devoted considerable efforts to attacking the service, which law enforcement agencies say is also used by people engaged in terrorism, the trade of child abuse images, and online drug dealing.
Privacy and human rights groups have been concerned about the security of Tor following revelations in the Guardian, New York Times and ProPublica about widespread NSA efforts to undermine privacy and security software. A report by Brazilian newspaper Globo also contained hints that the agencies had capabilities against the network.
While it seems that the NSA has not compromised the core security of the Tor software or network, the documents detail proof-of-concept attacks, including several relying on the large-scale online surveillance systems maintained by the NSA and GCHQ through internet cable taps.
One such technique is based on trying to spot patterns in the signals entering and leaving the Tor network, to try to de-anonymise its users. The effort was based on a long-discussed theoretical weakness of the network: that if one agency controlled a large number of the “exits” from the Tor network, they could identify a large amount of the traffic passing through it.