TOR: Whose Next?

                        By Neil Harris

TOR (‘The Onion Router’) the US Government sponsored internet ‘anonymiser’ has been in the news again over the last couple of weeks. Since we exposed it as a ‘honey trap’ last year, TOR has continued to provide the evidence used to entrap those foolish enough to think that it provided them with some kind of anonymity.

Developed by the Office of Naval Intelligence and still 60 per cent funded by US Government agencies, TOR provides anonymity for US spies and US backed ‘dissidents’ around the world. In fact it also gives the American government a two way mirror into the worlds of ‘dissident’ activism, the criminal underworld and the kinds of terrorism the US doesn’t control or sponsor.

On the 8^th October, the BBC technology website reported the arrest in Manchester and Exeter of four Britons for supplying drugs, with a promise of more to follow. This was part of the publicity campaign marking launch day of The National Crime Agency (NCA), the new British version of the FBI. Those arrests resulted from information supplied by the American FBI itself and came from the unravelling of ‘The Silk Road’. This was a criminal version of E-bay, matching suppliers and purchasers of illegal items like drugs, guns and false identity documents.

Meanwhile Ross William Ulbricht, aka ‘Dread Pirate Roberts’ or ‘DPR’, the founder and operator of The Silk Road discovered to his cost that TOR wasn’t anonymous when he appeared in the District Court of Maryland on the 1^st October. The indictment is for conspiracy to supply illegal drugs and inadvertently employing an undercover FBI agent to torture and murder one of his employees. The indictment helpfully sets out the messages sent over the ‘TOR chat line’ as evidence of Ulbricht’s illegal activities.

Just like ‘The Farmer’s Market’ before it (another busted drugs marketplace) and ‘Freedom Hosting’ which provided a portal for paedophiles and others, the TOR network not only failed to hide what they were doing but gave the FBI a free view of exactly what they were up to. Until, that is, they had collected enough information to make the arrests and take the networks down.

Coincidently, on the 12^th  October, 12 American members of the hacktivist group ‘Anonymous’ were indicted in the Eastern district of Virginia for organising ‘Distributed Denial of Service Attacks’ in 2010 and 2011. These were organised attacks against the entertainment industry, banks, credit card companies and government sites in retaliation for the closure of ‘The Pirate Bay’ file sharing site. The prosecution evidence will be eagerly awaited in some quarters but TOR is likely to be the key that unlocked the door.

So who is next? A recent study by academics from the University of Luxembourg showed that ‘Freedom Hosting’ was only the 27^th most popular TOR site, while The Silk Road’s two sites were 18^th and 34^th. The bulk of TOR’s most popular sites turn out to be a variety of ‘Botnet’ sites – the origin of robot devices used by internet criminals to hijack innocent people’s computers and then use them as proxies to launch spam or viruses for their illegal activities.

Ninth most popular is the ‘Bitcoin’ mining site which creates an electronic currency long overdue for exposure as a ‘Ponzi’ or illegal pyramid confidence trick.

Eight out of the top thirty most popular ‘hidden’ sites are ‘adult’ suppliers of pornography. Given how freely available internet pornography is, those that require anonymity are likely to be very extreme indeed.

The TOR sites themselves are so far down the list at 47^th, 250^th and 547^th, that Congress should be investigating whether the American taxpayers are getting good value for their money.

Meanwhile, on the 9^th September, ‘The Electronic Privacy Information Center’ (EPIC) sued ‘The Broadcasting Board of Governors’ (BBG) over its failure to release documents under Freedom of Information legislation. BBG is the propaganda arm of the US government abroad and a major financier of TOR. According to the EPIC lawsuit, in June 2012 BBG signed an agreement with TOR to finance 125 ‘exit node’ computers which increased the capacity of the network that provides anonymity to users.

Finally, the New Worker is grateful to the Washington Post of 4/10/13, for releasing details of a November 2007 briefing given to the National Security Agency (NSA - America’s GCHQ) by Roger Dingledene, director and one of the original developers of Torproject.org.

In those days Dingledine was a regular at NSA, he had given another revealing talk on the 11^th of January that year, setting out issues and problems NSA and GCHQ needed to address in order to exploit TOR to their advantage. Both the NSA and GCHQ have been investigating whether TOR could be exploited as a way of tracking users away from the network. These secret briefings, in the form of PowerPoint frames, are freely available on the internet.

Meanwhile the 62nd most popular TOR site identified by The University of Luxembourg is ‘Black Market reloaded’, which has operated quietly as a more publicity shy version of The Silk Road. It’s probably hoping to quietly inherit its customers. What’s the betting that this site is going to be next in line for a visit from the FBI?

TOR: The Trap closes

By Neil Harris

LAST YEAR a New Worker article exposed TOR (The Onion Router) as a US Government “honey trap”, designed to support America’s friends and entrap its enemies. Our interest developed further after some excellent research by “Cryptome.org”.

On the face of it TOR appears to be a subversive hacktivist site, offering anonymity to anarchists, political dissidents, leakers, internet activists and the underground criminal world. In fact, the systems used on the site were developed by a unit of The US Office of Naval Intelligence as part of US “Public Diplomacy”. Currently TOR’s three biggest sources of funding are: The US Department of Defence, The US State Department and The Board of Broadcasting – another propaganda arm of the US Government.

While providing some assistance to US intelligence, TOR’s main role has been to encourage the destabilisation of regimes around the world that America does not approve of. It does this by providing an anonymous internet hideaway and communications hub to opposition groups it approves of. However to work properly, the site needs thousands of innocent, idealistic people who allow their computers to become part of the network (The Onion) which allows data to be “routed” between at least three home computers, to hide its origins.

Our concerns followed recent FBI arrests of activists from Lulzsec/Anonymous as well as those involved in “The Farmers Market”, a criminal site offering a market in illegal drugs. While the FBI highlighted its use of informants in securing those arrests, the evidence they used to put together the cases appeared to come from access to TOR, which both organisations had used and trusted.

Last week, the FBI was busy again, this time in Ireland where Eric Marques was picked up on a US arrest warrant for distributing and promoting child abuse material online. We certainly wouldn’t want anything to do with a rat like Marques, a major supplier of images of child abuse. His “Freedom Hosting” site also provided a home to many other anonymous sites on TOR and in addition to paedophilia these include the notorious “Silk Road” which matches customers to drug dealers as well as other sites offering illegal weapons for sale or the services of hit men.

In response to concern amongst its more legitimate users, TOR posted a detailed statement that appeared to be for the benefit its US Government sponsors: "The persons who run Freedom Hosting are in no way affiliated or connected to the Tor Project Inc, the organisation co-ordinating the development of the Tor software and research."

It went on: "Anyone can run hidden services, and many do…organisations run hidden services to protect dissidents, activists, and protect the anonymity of users trying to find help for suicide prevention, domestic violence, and abuse recovery.”

All of which may be true, but this should be a warning to those who still trust TOR and imagine that their secrets are safe there: “Whistle-blowers and journalists use hidden services to exchange information in a secure and anonymous way and publish critical information in a way that is not easily traced back to them. The New Yorker's Strongbox is one public example."

Every indication is that the “secrets” on TOR are not hidden from the US Government. Another example is Wikileaks which has made extensive use of TOR. During the recent trial of Bradley Manning, evidence produced by the US Military included emails allegedly sent between Manning and “pressassociation” who, allegedly, was Julian Assange. Once again TOR appears to have been the anonymiser Manning was encouraged to use.

Perhaps more interestingly, as a result of the operation against Marques, we now know that the TOR Browser appears to have been compromised by the insertion of JavaScript malware, and that this was analysing and sending off information identifying visitors to the sites on “Freedom Hosting”.  Not surprisingly this started a panic amongst users, one quoted on the Guardian’s website wrote: "The situation is serious," said gmerni. "They got the owner of FH and now they're going after all of us. Half the Onion sites were hosted on FH! Disable JavaScript in your Tor browser for the sake of your own safety."

But this doesn’t stop with the FBI – the information trail was followed by “Ars Technica”, a more technical site which was looking for the ultimate destination of this “secret” data:

“Initial investigations traced the address to defence contractor SAIC, which provides a wide range of information technology and C4ISR (Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance) support to the Department of Defence. The geolocation of the IP address corresponds to an SAIC facility in Arlington, Virginia. Further analysis using a DNS record tool from Robtex found that the address was actually part of several blocks of IP addresses allocated by SAIC to the NSA.”

Naturally The National Security Agency (NSA) would always be an interested client of any organisation with access to confidential information about political dissidents, journalists, terrorists or criminals around the world.

As our original article pointed out, TOR’s website even carries what appears to be a warning to users: “Law enforcement uses Tor for visiting or surveilling web sites without leaving government IP addresses in their web logs, and for security during sting operations.” This looks very much like a legal warning, putting users on notice that they are liable to arrest and is designed to avoid the use of the defence of entrapment in the US courts.

You have been warned.