ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Tor Project suffers hack attack

By | January 22, 2010, 12:36pm PST

Summary: Hackers broke into two of Tor Project servers and used the CPU and bandwidth to launch additional attacks.

The Tor Project, a service that provides privacy and anonymity to Web users, said hackers broke into two of its servers and used the CPU and bandwidth to launch additional attacks.

Tor project lead Roger Dingledine confirmed the hack in an e-mail that urged users to immediately upgrade to get fresh identity keys for the two compromised directory authorities.

Dingledine writes:

We took the services offline as soon as we learned of the breach. It appears the attackers didn’t realize what they broke into — just that they had found some servers with lots of bandwidth. The attackers set up some ssh keys and proceeded to use the three servers for launching other attacks. We’ve done some preliminary comparisons, and it looks like git and svn were not touched in any way.

We’ve been very lucky the past few years regarding security. It still seems this breach is unrelated to Tor itself. To be clear, it doesn’t seem that anyone specifically attacked our servers to get at Tor. It seems we were attacked for the CPU capacity and bandwidth of the servers, and the servers just happened to also carry out functions for Tor.

The attackers did not meddle with the Tor source code, he said.  “We made fresh identity keys for the two directory authorities, which is why you need to upgrade,” Dingledine added.

Users are strongly encouraged to upgrade to Tor 0.2.1.22 or 0.2.2.7-alpha.

ALSO SEE:

    Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

    More from “Zero Day”

    Topics

    Bandwidth, Attacker, Attack, Dingledine, Security, Servers, Hardware, Ryan Naraine

    Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

    Disclosure

    Ryan Naraine

    The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

    Biography

    Ryan Naraine

    Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

    Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

    Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

    54
    Comments
    Add Your Opinion

    Join the conversation!

    Just In

    RE: Tor Project suffers hack attack
    FAULKNE 13th Oct
    Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.
    View in thread
    0 Votes
    + -
    Why is Tor Project running on Windows?
    NonZealot 22nd Jan 2010
    We all know that only Windows can be hacked so if
    Tor was hacked, it must be running on Windows.
    Please Tor Project, immediately host your services
    on Linux machines. Thanks.
    0 Votes
    + -
    good point
    Linux Geek 22nd Jan 2010
    the got what they deserved
    0 Votes
    + -
    Well, LG
    John Zern Updated - 22nd Jan 2010
    it looks like they are running in on Linux.

    So did they still get what they deserved?
    0 Votes
    + -
    Well, Johnny ...
    n0neXn0ne Updated - 22nd Jan 2010
    ... are you still surprise a Linux shop uses IE 6?


    ^o^

    0 Votes
    + -
    Huh? Since when does IE6 run on Linux?
    de-void-21165590650301806002836337787023 22nd Jan 2010
    Or am I missing something?
    0 Votes
    + -
    Since IEs4Linux?
    AzuMao 22nd Jan 2010
    0 Votes
    + -
    More Excuses? Well, what can we expect from you
    John Zern 23rd Jan 2010
    Nothing but excuses for Linux.

    Again.

    v0v
    0 Votes
    + -
    You know LG is an undercover MS shill, don't you?
    AzuMao 22nd Jan 2010
    0 Votes
    + -
    I doubt even MS
    John Zern 23rd Jan 2010
    would pay Linux Geek for his posts. happy
    0 Votes
    + -
    Nice straw man as usual.
    AzuMao 22nd Jan 2010
    Nobody ever said using a Linux based OS automatically prevents you from ever doing anything to get your computer compromised.

    Heck, the article doesn't even say how it happened. For all anyone knows it was some vulnerability in a script for their website.



    Also, isn't it nice how they fixed this right away instead of waiting 7 months, as opposed to a certain company you love?
    0 Votes
    + -
    Linux 'fixes' have a history of breaking programs
    Lerianis10 23rd Jan 2010
    So what is your point? I would rather have the 7-month thing where it has been COMPLETELY TESTED to make sure that it won't interfere with most programs, rather than a 'quick and dirty' fix that breaks a lot of stuff, as is the history with Linux.
    0 Votes
    + -
    Completely tested..
    AzuMao 23rd Jan 2010
    ..you mean like Vista? That didn't break anything at all, right? Because they spent so many years testing it before releasing it, it didn't interfere with your programs?

    And again, nowhere in the article does it say anything about a vulnerability in Linux. Stop assuming things randomly
    0 Votes
    + -
    It's Windows "fixes" that break things for users
    Renifer 26th Jan 2010
    @Lerianis10
    You have that backwards when you say that Linux "fixes break a lot of stuff". You meant Windows. For instance, I learned this week that certain webcams are having problems with Windows 7 now, after a recent update. It's not a surprise to me. I have come to expect nothing from the folks at Redmond.
    MS patches break things due to the fact that some updates require reboot, which opens up the system to the possibility of being rooted. Linux updates come much more frequently, not waiting months or weeks as was typical in the past, and usually do not require reboot unless it's a kernel update, and even then, reboot is not required. While it's true that Linux has vulns, as all systems do, as a developer, I have experienced nasty viruses being shipped by the good folks at Redmond through their Developer Network media. The truth is that while the folks at MS do test, they don't test nearly as well as they should, and when they do find something, often they wait for it to be discovered before announcing that they are working on a fix. MS also has a history of blaming the user, which I find deplorable. The default settings for Windows are *not* secure, and I won't use it for that reason. I have not had an intrusion or data lost since switching to Redhat/Fedora Linux in 1999, and I don't intend to. Windows users should demand better testing, more prompt updates that don't break stability, and a more secure system by default. For the record, I support the Tor Project for porting their code to the Windows platform and I wish them success. Maybe they became complacent what with Tor's abilities.
    0 Votes
    + -
    That's the same thing that can happen with windows, too.
    HypnoToad72 1st Feb 2010
    Windows' malaise is called "DLL Hell". Linux has its own comparable problems.

    Linux is open source and anybody can stick their hands into the process.

    What's microsoft's excuse for their sloppiness?
    0 Votes
    + -
    Windows is always insecure
    no_barry_2012 22nd Jan 2010
    Hence the name 'Windows' get it glass...

    happy
    0 Votes
    + -
    Wrong, Windows is no more secure or insecure than OSX or Linux
    Lerianis10 23rd Jan 2010
    PWN2OWN.... need I keep on saying it before you idiots get the message?
    0 Votes
    + -
    Keep spinning that, maybe someday someone will believe you
    The Mentalist 23rd Jan 2010
    OSs are not all born equal.
    0 Votes
    + -
    I agree
    John Zern 23rd Jan 2010
    Now, you keep with that spin machine of yours, and maybe somebody will believe that the Tor Project's Linux box really wasn't hacked.
    0 Votes
    + -
    Your remark was completely non sequitur..
    AzuMao Updated - 26th Jan 2010
    ..unless you're saying that there are two mutually exclusive and collectively exhaustive polar opposites (as insecure as Windows, and 100% perfectly secure in every way even
    against user error), in which case you simply have no grasp on reality.
    0 Votes
    + -
    Windows default setting are the least secure of any OS
    Renifer 26th Jan 2010
    @Lerianis10,
    Come on now. Repeating something doesn't make it true.
    Windows OS is not secure by default. That's no secret.
    Even Linux has to be hardened somewhat to withstand a production web server environment.
    Windows is the least secure OS, by default, that I have worked with.
    0 Votes
    + -
    Amd the vector used in the atack was...
    The Mentalist 23rd Jan 2010
    Details please.

    P.S. Tor is a distributed system, almost surely this has got nothing to do with the Operating Systems running Tor.
    0 Votes
    + -
    "Almost surely". Yeah, right.
    honeymonster 23rd Jan 2010
    Do we know how they broke in?

    As I understand it, we have a 450G disk image
    from one of the machines
    sitting somewhere in Canada, but not anywhere
    near any of the Tor people.

    The attacker(s) were sloppy, so we know some
    things like the name of the
    local-to-root exploit they used (which by its
    name works on a surprisingly
    wide spread of kernel versions... security is
    hard). I still don't know
    how they got in to moria originally, though.
    Too much was going on on
    that machine.

    Keep spinning that "surely this has got nothing
    to do with the Operating Systems". Maybe one
    day someone will believe you. But not this one.
    Their machine fell to something they don't even
    know. What they *do* know is that a *known*
    (and named) local-to-root exploit was used.

    http://archives.seul.org/or/talk/Jan-
    2010/msg00167.html

    Tight OS there. Beautiful. Secure and all.
    0 Votes
    + -
    Local exploit
    magcomment 23rd Jan 2010
    Thanks for the link to the Tor developers discussion about this break in, it's refreshing to have it all so open.

    It shows a couple of problems with their environment.

    First, it was a local-to-root exploit, in other words someone logged in as a non-privileged user and became root. Maybe a really bad password, maybe an inside job, but the initial attack vector was that someone logged in to a valid account.

    Second, they had an unpatched system running (assuming that it was a known exploit) which allowed a normal account to become root.

    They whacked 3 servers the same way, suggesting a common account on each with the same level of system software (and thus the same unpatched code).

    The thread said they didn't know how the attacker(s) got in, but that they were sloppy. I find that hard to believe, if they were sloppy you should be able to see where they came in very easily, and what commands they ran to exploit the flaw. Someone there is fishy, maybe they are trying to protect someone ? It would be very poor form for a security oriented company to be hacked because of a weak password ! Kind of destroys their credibility somewhat.

    It's an interesting field of study, and whilst it's a shame that "the good guys" get slapped about by "the bad guys" it can be a lot of fun to play the detective to see what happened. We have set up honeypots to see what comes sniffing around, some of the attackers make no attempt to hide their tracks and end up providing a fascinating insight into their world.
    0 Votes
    + -
    Fixed link
    Agnostic_OS 24th Jan 2010
    http://archives.seul.org/or/talk/Jan-2010/msg00167.html
    0 Votes
    + -
    Now who is spinning...nt
    ItsTheBottomLine 25th Jan 2010
    nt
    0 Votes
    + -
    A pro-privacy service on Windows? Why not go the extra mile and
    HypnoToad72 1st Feb 2010
    make an account on Facebook, telling everyone else the technical specs down to the smallest detail...
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    tank33 11th Sep
    That is good.Thank you so much. replicawatchesuk
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    lovedong 12th Sep
    Really like your blog and all!I am a Fan! chanel bags
    0 Votes
    + -
    How CAN IT BE POSSIBLE, it's LINUX
    Aussie_Troll 23rd Jan 2010
    Yes, thats right the impregnable, super secure, never before broken, virus, malware free. Linux, yet again, broken into, and why because the hackers wanted CPU cycles, and bandwidth.

    If there is a desire to brake into a system, regardless of the OS, browser, or if it proprietary or open makes no difference.

    Again, if you run linux, and you think you're safe, THINK AGAIN..
    0 Votes
    + -
    Nice straw man.
    AzuMao 23rd Jan 2010
    Just because something isn't as bad as Windows
    doesn't make it 100% impervious to everything
    (such as user error). Things are never that black
    and white.
    0 Votes
    + -
    The fact remains that
    markbn 24th Jan 2010
    a software running on Linux was hacked. Since you
    are expert in straw man arguments, you can
    recognize this is not: one counterexample is
    enough to prove that the fact that a program runs
    on Linux does not imply it's secure.
    0 Votes
    + -
    It is a straw man.
    AzuMao 24th Jan 2010
    Nobody claimed that anything made to run on Linux
    magically becomes perfectly secure from everything
    including user error.

    Had such a claim been made, it wouldn't be a straw
    man, but it hasn't been made.
    0 Votes
    + -
    LOL - do you actually read the posts for the more colorful
    ItsTheBottomLine 25th Jan 2010
    linux knuckleheads? Mental, LG, DonnieChild I can go on ...
    0 Votes
    + -
    No, I read the posts for myself.
    AzuMao 25th Jan 2010
    Why would I read posts for other people?
    0 Votes
    + -
    Yes the facts does remain ...
    antonfh Updated - 25th Jan 2010
    yes Linux should be 100% secure ... one incident
    and its worse than all versions of MS .... to put
    it in context. I would expect buying an expensive
    luxury car with all its re-enforced protection
    bars to be better than my cheapo-model-car ... if
    the Expensive car should explode if I ride down a
    mountain .. yes certainly I would be HIGHLY
    disappointed at how crap the luxury car really is
    then.....
    0 Votes
    + -
    Umm, Linux is not the "expensive luxury car".
    mrgoose 25th Jan 2010
    Linux is free. Windows is expensive.

    Therefore one would expect Windows not merely to be as secure as Linux, it should be much more secure. Indeed, with such a huge price differential, one would expect Windows to be better in every respect than Linux.

    But it isn't!
    0 Votes
    + -
    yes thats true
    antonfh 25th Jan 2010
    and as you explained it makes it even worse for MS
    case ... I was however sarcastic as to the "no-
    gray-area" Linux is judged as the locked down
    fortress system and anything beside that makes it
    an utter failure mentality.... its down to
    administration also ... the highest security
    prison is useless if someone leaves all the gates
    open and forget to activate the alarms and take
    and extended tea brake ....
    0 Votes
    + -
    Indeed.
    mrgoose Updated - 25th Jan 2010
    I don't think that people who actually use GNU/Linux generally consider it to be a "fortress" or perfectly secure. Certainly I don't. It is just more secure than Windows and has the capability to be made even more secure, if needed:-
    http://en.wikipedia.org/wiki/Security-Enhanced_Linux

    Moreover, Linux isn't just one entity. There are many different varieties offering a variety of levels of security, depending on its intended purpose. You could even create your own Linux if you wished, seriously:-
    http://www.linuxfromscratch.org

    Such is the power & beauty of open source software. lol happy

    WRT the security breach in question, you might find this is interesting reading:-
    http://archives.seul.org/or/talk/Jan-2010/msg00161.html

    Best wishes, G.
    0 Votes
    + -
    And DOMAIN NAME tools say...
    Agnostic_OS 24th Jan 2010
    Domain Name: torproject.org

    Registrar: CSL Computer Service Langenbach GmbH d/b/a joker.com a German GmbH (R25-LROR)
    Status: CLIENT TRANSFER PROHIBITED

    Name Servers:
    asteria.debian.or.at
    csail.seul.org

    SITE INFORMATION

    IP: 86.59.21.36
    IP Location: Vienna, Austria
    Website Status: active
    Server Type: Apache/2.2.9 (Debian) DAV/2 SVN/1.5.1 mod_ssl/2.2.9 OpenSSL/0.9.8g
    0 Votes
    + -
    There are only few, albeit blind, individuals that
    ItsTheBottomLine 25th Jan 2010
    actually believe that - I think and one is right above...typing a way. And the list is surprisingly small today - NOW THAT is funny.
    0 Votes
    + -
    The Large Hadron Collider was broken into as well. Incidentally,
    HypnoToad72 1st Feb 2010
    the word is "break", not "brake". happy

    Otherwise you are right, no platform is immune. It's also true that Microsoft tends to welcome hackers with open arms by comparison to the other vendors...
    0 Votes
    + -
    So here we go again
    crazydanr@... 24th Jan 2010
    Linux is hacked - possibly by bad administrative policies, not patching, a zero day patch, or inside job.

    I guess that goes to show you - regardless of OS - that human error is the problem. Even Linux, which is more secure inherently, is easily made vulnerable by bad admins / users.
    0 Votes
    + -
    Isn't this like the 10th time Tor has being (allegedly) hacked??
    wackoae 24th Jan 2010
    Seriously, by now it has become very obvious that the developers and maintainers don't really care about security. In fact, I would not be surprised if they are the ones behind it. Then when somebody figures out that what the code is doing, they can claim a hack and wait for a while to introduce something new (or even the same).

    What better way to distribute viruses, steal info and install botnets than by hiding the code inside of software that is supposed to hide your identity? Since most of the users are mostly interested in hiding their illegal actions, they can just squeeze in and take advantage of the paranoia.

    For example, do you really think that a pedophile whos credit card (or paypal account) was stolen while purchasing (or selling) child pornography would notify the police about it? After all, they have to explain about how it was stolen while using Tor to be a psyco.
    0 Votes
    + -
    What actually happened...
    mrgoose Updated - 25th Jan 2010
    The Tor project has a blog, in which it openly discusses its various issues, including this security breach. Readers may wish to study this particular blog entry, which details this attack, including what was affected and equally importantly, what was not affected:-
    http://archives.seul.org/or/talk/Jan-2010/msg00161.html
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    efsane Updated - 8th Apr 2011
    Well done! Thank you very much for professional templates and community edition
    sesli sohbet sesli chat
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    MACKENZI 11th Sep
    I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate! nccma cooler
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    PEARLINEI 12th Sep
    I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post. this thread is amazing i like your work and i appreciate you that you have share a useful stuff thanks for sharing the i shop abatwa
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    RHIANNONA 13th Sep
    I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post.Bookmarking now thanks please consider a follow up post. power sa shop
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    SATURNINA 14th Sep
    I think the representation of this article is actually superb one. This is my first visit to your site. Thanks a lot and keep sharing the information. Keep updating the information for all of us. Thanks ZDNet Government was launched as the brand's first industry vertical, with a mission to cater to IT professionals in the public secto I agree with your post. However, do you have any sources I can cite for my paper wheel car com bury
    0 Votes
    + -
    RE: Tor Project suffers hack attack
    FAULKNE 13th Oct
    Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.

    Join the conversation!

    Formatting +
    BB Codes - Note: HTML is not supported in forums
    • [b] Bold [/b]
    • [i] Italic [/i]
    • [u] Underline [/u]
    • [s] Strikethrough [/s]
    • [q] "Quote" [/q]
    • [ol][*] 1. Ordered List [/ol]
    • [ul][*] · Unordered List [/ul]
    • [pre] Preformat [/pre]
    • [quote] "Blockquote" [/quote]
    ie8 fix
    Click Here
    ie8 fix

    The best of ZDNet, delivered

    ZDNet Newsletters

    Get the best of ZDNet delivered straight to your inbox

    Facebook Activity

    Blog Roll

    Blog Archive

    White Papers, Webcasts, & Resources
    ie8 fix
    ie8 fix