The Tor Social Contract

RFC3514, of course.

Again, the undisclosed TP authored source code we are talking about appears to refer to something like scripts running on special purpose nonpublic servers which attempt to catch out malicious relays, which will obviously help improve the security of the Tor network and thus of endangered Tor users.

I think the key point has already been mentioned: the TP response to the problem is less than ideal, but it appears that no one can suggest anything which is truly better.

> This is the definition of security through obscurity. It would not be difficult for someone to obtain the source of that software. I would not be surprised if it is already in the hands of our adversaries.

You raise a very topical point. No less a figure than Edward Snowden believes that the likely source of the leaked Equation Group (NSA) source code, which contains hundreds of zero-days used to attack Cisco and other brand name top of the line routers, is a cyberespionage C&C server or data-exfiltration node (see tweets below).

Some Tor users have suggested that TP set up carefully constructed honeypot onion services on geographically distributed servers, and share with CitizenLabs, to try to get a sense of who is attacking onion services and more importantly, how they are doing that. We pointed out that this is not without risk because such servers are likely not under 24/7 TP physical control, which poses a risk. We pointed out that NSA faces the same problem with its geographically distributed data-exfiltration cyberespionage servers, which are often not under 24/7 USG physical control.

And some Tor users have urged TP to ally with EFF, ACLU, etc., and to reach out to US politicians and the better-informed tech reporters to counter the many false claims from bad actors such as FBI about the dangers of mandatory backdoors. USIC allies always claim NOBUS (nobody but US) knows about the zero-day exploits which NSA intends to never divulge, but this claim has been *decisively* debunked by the leak of Equation Group source code, which shows that non-NSA actors have have Equation Group source code since Jun 2013, if not before:

https://www.washingtonpost.com
Powerful NSA hacking tools have been revealed online
Ellen Nakashima
16 Aug 2016

> Some of the most powerful espionage tools created by the National Security Agency’s elite group of hackers have been revealed in recent days, a development that could pose severe consequences for the spy agency’s operations and the security of government and corporate computers. A cache of hacking tools with code names such as Epicbanana, Buzzdirection and Egregiousblunder appeared mysteriously online over the weekend, setting the security world abuzz with speculation over whether the material was legitimate.
>
> The file appeared to be real, according to former NSA personnel who worked in the agency’s hacking division, known as Tailored Access Operations (TAO). “Without a doubt, they’re the keys to the kingdom,” said one former TAO employee, who spoke on the condition of anonymity to discuss sensitive internal operations. “The stuff you’re talking about would undermine the security of a lot of major government and corporate networks both here and abroad.” Said a second former TAO hacker who saw the file: “From what I saw, there was no doubt in my mind that it was legitimate.”
>
> The file contained 300 megabytes of information, including several “exploits,” or tools for taking control of firewalls in order to control a network, and a number of implants that might, for instance, exfiltrate or modify information.
> ...
> Several of the exploits were pieces of computer code that took advantage of “zero-day” or previously unknown flaws or vulnerabilities in firewalls, which appear to be unfixed to this day, said one of the former hackers. The disclosure of the file means that at least one other party — possibly another country’s spy agency — has had access to the same hacking tools used by the NSA and could deploy them against organizations that are using vulnerable routers and firewalls. It might also see what the NSA is targeting and spying on. And now that the tools are public, as long as the flaws remain unpatched, other hackers can take advantage of them, too.
> ...
> Critics of the NSA have suspected that the agency, when it discovers a software vulnerability, frequently does not disclose it, thereby putting at risk the cybersecurity of anyone using that product. The file disclosure shows why it’s important to tell software-makers when flaws are detected, rather than keeping them secret, one of the former agency employees said, because now the information is public, available for anyone to employ to hack widely used Internet infrastructure.

https://www.techdirt.com
Ed Snowden Explains Why Hackers Published NSA's Hacking Tools
Mike Masnick
16 Aug 2016

> Yesterday, the news broke that a "mysterious" hacking group had gotten its hands on some NSA hacking tools and was releasing some of the tools as proof (it was also demanding lots of Bitcoin to reveal more). The leak came with a neat little message that feels like it was written by a Hollywood script writer trying to sound Russian.... The files that were leaked [so far] were mostly installation scripts, but also exploits designed for specific routers and firewalls. And, it's noted, that some of the tools named line up with previously leaked NSA codenames.

http://arstechnica.com/security/2016/08/code-dumped-online-came-from-om… hacking tool leak came from “omnipotent” NSA-tied group
Rare crypto implementation in ShadowBrokers dump connects it to Equation Group.
Dan Goodin
16 Aug 2016

> The connection linking more than 300 computer files in the ShadowBrokers archive to Equation Group is found in a common implementation of the RC5 and RC6 encryption algorithms. Among other things, the leaked ShadowBroker files use the negative constant -0x61C88647 instead of the more standard 0x61C88647 to speed up subtraction operations. Kaspersky researchers scoured 20 different compiled versions of RC5/6 code in Equation Group malware and found functionally identical code, leaving little doubt that there was a clear connection between the two.

http://thehill.com/policy/cybersecurity/291470-hackers-claim-auction-of…
Hackers claim to auction NSA source code
Joe Uchill
15 Aug 2016

> Hackers calling themselves Shadow Brokers are auctioning off what they claim is the source code to a vaunted, likely state-sponsored hacking group many believe is affiliated with the National Security Agency. There is no definitive proof the auction is genuine, but files released to prove authenticity appear valid enough to have piqued the interest of many in the security community.
>
> The cybersecurity firm Kaspersky Labs raised eyebrows last year with a report on a hacking operation it was calling the Equation Group, which had managed to operate without being noticed for 14 years. That is an uncommonly long time for a state group to stay under the radar given the resources they are normally up against. Kaspersky noted similarities from Equation to attack methods discussed in leaked NSA documents and other suspected U.S. intelligence malware. The computer code used jargon common to the NSA and time codes in the Equation Group’s wares appeared to match a North or South American workday.
> ...
> “The code in the dump seems legitimate, especially the Cisco exploits (Most of the dump contains Firewall exploits), and those exploits were not public before,” said Matt Suiche, via electronic chat. Suiche is the founder of United Arab Emirates-based cybersecurity start-up Comae Technologies and has been actively analyzing the source code portions released as proof. Particularly interesting, said Suiche, are references to code names listed in the NSA Advanced Network Technology Catalogue, a listing of the agencies cyber warfare capabilities.

http://thehill.com/policy/cybersecurity/291565-wikileaks-too-claims-to-…
WikiLeaks, too, claims to have NSA code
Joe Uchill
16 Aug 2016

> After a day of speculation over whether the previously unknown “Shadow Brokers” could really be auctioning off an authentic stolen copy of the vaunted espionage group’s source code, WikiLeaks announced it would be releasing a free, “pristine” copy.

http://thehill.com/policy/cybersecurity/291588-snowden-suggests-russia-…
Snowden suggests Russia behind NSA code hack
Joe Uchill
16 Aug 2016

> National Security Agency (NSA) leaker Edward Snowden is backing a theory that Russia — not money-seeking hackers — is behind the release of possible NSA source code.

Snowden tweeted the following in a multi-tweet statement:

> The hack of an NSA malware staging server is not unprecedented, but the publication of the take is. Here's what you need to know:
> 1) NSA traces and targets malware C2 servers in a practice called Counter Computer Network Exploitation, or CCNE. So do our rivals.
> 2) NSA is often lurking undetected for years on the C2 and ORBs (proxy hops) of state hackers. This is how we follow their operations.
> 3) This is how we steal their rivals' hacking tools and reverse-engineer them to create "fingerprints" to help us detect them in the future.
> 4) Here's where it gets interesting: the NSA is not made of magic. Our rivals do the same thing to us -- and occasionally succeed.
> 5) Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy.
> 6) What's new? NSA malware staging servers getting hacked by a rival is not new. A rival publicly demonstrating they have done so is.
> 7) Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack.
> 8) Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant:
> 9) This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server.
> 10) That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies.
> 11) Particularly if any of those operations targeted elections.
> 12) Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.
> 13) TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.
> Bonus: When I came forward, NSA would have migrated offensive operations to new servers as a precaution - it's cheap and easy. So? So...
> The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak.

(I think his point is that after Snowden's first leaks in Jun 2013, NSA did a huge internal audit which may have caught the intrusion, or scared off the intruders.)

I don't think anyone here ever doubted that NSA is the author of most of the Equation Group exploits, which were previously linked to the ANT catalog, but immediately after the source code was leaked, nsa.gov went offline for about 18 hours, suggesting the agency is conducting an emergency audit similar to what happened just after the first Snowden leaks.

There is really no doubt that the leaks include many zero-day exploits which NSA long claimed nobody but them would ever know about. We said that was absurd, and these leaks prove that we are right.

I urge Shari give top priority in next few months to the political fight to persuade US Congress to act in time to block the change to Rule 41 which will authorize FBI to "legally" (under US law) attack any computer anywhere in the world, anytime, for any reason, under a PRISM style blanket warrant (or maybe, none at all, because no-one will be checking to see that FBI agents follow the broadly written but unenforced rules).