<map version="1.0.1">
    <node CREATED="1203806914875" ID="Freemind_Link_1499076781" MODIFIED="1203807109625" TEXT="Anonymity on the Edge">
        <node CREATED="1213786150989" ID="Freemind_Link_858068095" MODIFIED="1213786154629" POSITION="right" TEXT="author">
            <node CREATED="1213786158644" ID="Freemind_Link_894658161" LINK="http://lukenotricks.blogspot.com/" MODIFIED="1213786191860" TEXT="Luke O&apos;Connor"/>
        </node>
        <node CREATED="1203807210406" ID="Freemind_Link_474203765" MODIFIED="1203807217562" POSITION="left" TEXT="Embassy incident">
            <node CREATED="1203807764218" FOLDED="true" ID="Freemind_Link_1263348404" MODIFIED="1203807766296" TEXT="who">
                <node CREATED="1203807756875" ID="Freemind_Link_242191883" MODIFIED="1203807758281" TEXT="Dan Egerstad, the Swedish computer security"/>
                <node CREATED="1203810232281" ID="Freemind_Link_720929382" MODIFIED="1203810233390" TEXT="21-year-old "/>
            </node>
            <node CREATED="1203807770718" FOLDED="true" ID="Freemind_Link_1982200632" MODIFIED="1203807772406" TEXT="what">
                <node CREATED="1203807799843" ID="Freemind_Link_1786192306" MODIFIED="1203807802359" TEXT="obtained log-in and password information for 1,000 e-mail accounts belonging to foreign embassies, corporations and human rights organizations"/>
                <node CREATED="1203807966140" ID="Freemind_Link_258634955" MODIFIED="1203807967859" TEXT="when he posted on his web site the log-in information and passwords for 100 of the 1,000 e-mail accounts for which he obtained log-ins and passwords. (His site is no longer online). He posted the information, he said, because he felt it would be the most effective way to make the account owners aware that their communication had been compromised.">
                    <node CREATED="1203808692312" ID="Freemind_Link_783703672" MODIFIED="1203808693734" TEXT="including one corporation that does more than $10bn in annual revenue."/>
                    <node CREATED="1203809356890" ID="Freemind_Link_1648785444" MODIFIED="1203809358437" TEXT="request of American law enforcement agencies"/>
                </node>
                <node CREATED="1203807995781" ID="Freemind_Link_927456224" MODIFIED="1203807997765" TEXT="Initially, Egerstad refused to disclose how he obtained the log-ins and passwords. But then in September he revealed that he&apos;d intercepted the information through five exit nodes that he&apos;d set up on the Tor network in Asia, the US and Europe"/>
                <node CREATED="1203808059906" ID="Freemind_Link_642215802" MODIFIED="1203808061093" TEXT="Tor is used by people who want to maintain privacy and don&apos;t want anyone to know where they go on the web or with whom they communicate. Tor traffic is encrypted while it&apos;s enroute, but is decrypted as it leaves the exit node and goes to its final destination. Egerstad simply sniffed the plaintext traffic that passed through his five exit nodes to obtain the user names and passwords of e-mail accounts.">
                    <node CREATED="1203809439953" ID="Freemind_Link_1211756003" MODIFIED="1203809441281" TEXT="#1 Five ToR exit nodes, at different locations in the world, equipped with our own packet-sniffer focused entirely on POP3 and IMAP traffic using a keyword-filter looking for words like &#x201c;gov, government, embassy, military, war, terrorism, passport, visa&#x201d; as well as domains belonging to governments. This was all set up after a small experiment looking into how many users encrypt their mail where one mail caught my eye and got me started thinking doing a large scale test. Each user is not only giving away his/her passwords but also every mail they read or download together with all other traffic such as web and instant messaging."/>
                </node>
                <node CREATED="1203808130203" ID="Freemind_Link_378589600" MODIFIED="1203808132296" TEXT="Egerstad didn&apos;t hack any systems to obtain the data and therefore says he didn&apos;t break any laws, but once he posted the log-in details for the accounts online he provided others with all the information they needed to breach the accounts and read sensitive correspondence stored in them."/>
                <node CREATED="1203809833968" ID="Freemind_Link_701607448" MODIFIED="1203809838140" TEXT="what he could read">
                    <node CREATED="1203809826093" ID="Freemind_Link_1653141327" MODIFIED="1203809827390" TEXT="Victims of Egerstad&apos;s research project included embassies belonging to Australia, Japan, Iran, India and Russia. Egerstad also found accounts belonging to the foreign ministry of Iran, the United Kingdom&apos;s visa office in Nepal and the Defence Research and Development Organization in India&apos;s Ministry of Defence."/>
                    <node CREATED="1203809811218" ID="Freemind_Link_293271973" MODIFIED="1203809812171" TEXT="In addition, Egerstad was able to read correspondence belonging to the Indian ambassador to China, various politicians in Hong Kong, workers in the Dalai Lama&apos;s liaison office and several human-rights groups in Hong Kong."/>
                </node>
            </node>
            <node CREATED="1203808514000" FOLDED="true" ID="Freemind_Link_1054930706" MODIFIED="1203808516421" TEXT="when">
                <node CREATED="1203808517875" ID="Freemind_Link_355764311" MODIFIED="1203808528062" TEXT="August - Sept 2007"/>
            </node>
            <node CREATED="1203812325906" FOLDED="true" ID="Freemind_Link_1467573808" MODIFIED="1203812329968" TEXT="why?">
                <node CREATED="1203808766031" ID="Freemind_Link_126964183" MODIFIED="1203808767078" TEXT="But Egerstad remains convinced he did the right thing, saying it was the only way to call attention to problem that Tor officials have already warned about previously."/>
                <node CREATED="1203810502468" ID="Freemind_Link_38126740" MODIFIED="1203810503796" TEXT="withheld details on how he came into possession of the passwords, instead writing that &quot;there is no exploit to publish, no vendor to contact&quot;."/>
            </node>
            <node CREATED="1203807812937" FOLDED="true" ID="Freemind_Link_1493808593" MODIFIED="1648048527105" TEXT="response">
                <node CREATED="1203807849328" ID="Freemind_Link_1639195319" MODIFIED="1203807850500" TEXT="house raided on Monday by Swedish officials, who took him in for questioning"/>
                <node CREATED="1203807893390" ID="Freemind_Link_1911990641" MODIFIED="1203807894437" TEXT="While three of them took him to the local police headquarters for questioning, the other two agents ransacked his house and hauled away three computers, external hard drives, CDs, notebooks and various papers"/>
                <node CREATED="1203807930515" ID="Freemind_Link_1645583680" MODIFIED="1203807931812" TEXT="Egerstad hasn&apos;t been charged with anything but is under suspicion for breaking into computers, which he says he never did. Egerstad said the agents told him they were investigating him because he had &quot;pissed off some foreign countries.&quot;"/>
                <node CREATED="1203808725843" ID="Freemind_Link_671508443" MODIFIED="1203808726937" TEXT="The posting of 100 official embassy passwords has made Egerstad a pariah in many circles. Publishing information that allows any old criminal to infiltrate sensitive government networks is a touchy thing, and many, including several Reg readers, have denounced it."/>
            </node>
            <node CREATED="1203808135843" ID="Freemind_Link_1006842787" MODIFIED="1203808139531" TEXT="analysis">
                <node CREATED="1203808160015" ID="Freemind_Link_914839159" MODIFIED="1203808161359" TEXT="As Egerstad and I discussed the problem in August, we both came to the conclusion that the embassy employees were likely not using Tor nor even knew what Tor was. Instead, we suspected that the traffic he sniffed belonged to someone who had hacked the accounts and was eavesdropping on them via the Tor network. As the hacked data passed through Egerstad&apos;s Tor exit nodes, he was able to read it as well."/>
                <node CREATED="1203809494953" ID="Freemind_Link_387297264" MODIFIED="1203809496406" TEXT="it&apos;s NOT a problem within Tor. Tor is meant for privacy, not confidentiality!!!! I&apos;m a bit amazed governments and companies are using this as a security measure."/>
                <node CREATED="1203809649156" ID="Freemind_Link_1627594721" MODIFIED="1203809650250" TEXT="It&apos;s not a written law but it is a guideline in having a responsible disclosure. I think he did a responsible disclosure. Was it legal? He did intercept traffic that was not destined for him. So probably &quot;no&quot; depending on Swedish law. Is our society a safer place after the disclosure. Yes, I think it is. Instead of arresting him, the government should have offered him a job."/>
                <node CREATED="1203809668937" ID="Freemind_Link_522775828" MODIFIED="1203809670156" TEXT="And what did we learn today? Don&apos;t report a security hole, sell it to Russia. Just kidding, but do check legal council before doing a disclosure."/>
            </node>
            <node CREATED="1213783019474" ID="_10" MODIFIED="1213783277520" TEXT="articles on the incident">
                <node CREATED="1213783207192" ID="Freemind_Link_1706281223" LINK="http://blog.wired.com/27bstroke6/2007/11/swedish-researc.html" MODIFIED="1213783224349" TEXT="Wired article">
                    <node CREATED="1213783417833" ID="Freemind_Link_1305481313" LINK="http://www.wired.com/politics/security/news/2007/09/embassy_hacks" MODIFIED="1213783426161" TEXT="again"/>
                </node>
                <node CREATED="1213783250786" ID="Freemind_Link_1977246852" LINK="http://www.theregister.co.uk/2007/09/10/misuse_of_tor_led_to_embassy_password_breach/" MODIFIED="1213783262005" TEXT="Register article"/>
                <node CREATED="1213783287333" ID="Freemind_Link_775180190" LINK="http://security4all.blogspot.com/2007/09/how-embassy-passwords-got-leaked.html" MODIFIED="1213783331099" TEXT="Security For all blog">
                    <node CREATED="1213783347864" ID="Freemind_Link_342308366" LINK="http://security4all.blogspot.com/2007/11/tor-embassy-hacker-gets-arrested.html" MODIFIED="1213783353802" TEXT="again"/>
                </node>
                <node CREATED="1213783456880" ID="Freemind_Link_1016307796" LINK="http://www.pcworld.com/article/id,137004-page,1/article.html" MODIFIED="1213783463739" TEXT="PC World"/>
                <node CREATED="1213783485349" ID="Freemind_Link_7323900" LINK="http://blog.passwordresearch.com/2007/09/embassy-password-hacker-reveals-his.html" MODIFIED="1213783496411" TEXT="PasswordResearch blog"/>
                <node CREATED="1203810967984" FOLDED="true" ID="Freemind_Link_1265229876" LINK="http://www.theregister.co.uk/2007/09/10/misuse_of_tor_led_to_embassy_password_breach/comments/" MODIFIED="1203811086953" TEXT="Shava Nerad&#xa;Development Director, The Tor Project">
                    <node CREATED="1203811013125" ID="Freemind_Link_428154943" MODIFIED="1203811014375" TEXT="A connection through Tor can be encrypted end-to-end -- but only if one is communicating with a secure protocol -- https: or encrypted chat both would be examples of this."/>
                    <node CREATED="1203811091265" ID="Freemind_Link_613513779" MODIFIED="1203811098437" TEXT="more sensible comments">
                        <node CREATED="1203811146953" ID="Freemind_Link_785632554" MODIFIED="1203811152953" TEXT="be sensible"/>
                        <node CREATED="1203811154875" ID="Freemind_Link_933048896" MODIFIED="1203811159890" TEXT="use encryption"/>
                    </node>
                </node>
            </node>
            <node CREATED="1203809749906" FOLDED="true" ID="Freemind_Link_620851645" MODIFIED="1203809753359" TEXT="threat">
                <node CREATED="1203809756078" ID="Freemind_Link_1865367107" MODIFIED="1203809757906" TEXT="But Egerstad says that many who use Tor mistakenly believe it is an end-to-end encryption tool. As a result, they aren&apos;t taking the precautions they need to take to protect their web activity."/>
                <node CREATED="1203809788234" ID="Freemind_Link_793585356" MODIFIED="1203809789218" TEXT="&quot;I am absolutely positive that I am not the only one to figure this out,&quot; Egerstad says. &quot;I&apos;m pretty sure there are governments doing the exact same thing. There&apos;s probably a reason why people are volunteering to set up a node.&quot;">
                    <node CREATED="1203810387437" ID="Freemind_Link_1624606525" MODIFIED="1203810400406" TEXT="For example, several Tor nodes in the Washington, D.C., area can handle up to 10T bytes of data a month, a flow of data that would cost at least US$5,000 a month to run, and is likely way out the range of volunteers who run a node on their own money, Egerstad said.  &#xa;&#xa;&quot;Who would pay for that?&quot; Egerstad said"/>
                </node>
                <node CREATED="1203810283937" ID="Freemind_Link_322430860" MODIFIED="1203810285125" TEXT="To his surprise, he found that more than 99 percent of the traffic -- including requests for Web sites, instant messaging traffic and e-mails -- were transmitted unencrypted.">
                    <node CREATED="1203810289078" ID="Freemind_Link_1190504719" MODIFIED="1203810298031" TEXT="but it can&apos;t encrypted"/>
                    <node CREATED="1203810307046" ID="Freemind_Link_878085542" MODIFIED="1203810318187" TEXT="unless you have some UDP SSL thing"/>
                </node>
                <node CREATED="1203810355093" ID="Freemind_Link_252326982" MODIFIED="1213737184109" TEXT="Egerstad said the process of snooping on the traffic is trivial. The problem is not with Tor, which still works as intended, but with users&apos; expectations: the Tor system is designed to merely anonymize Internet traffic and does not perform end-to-end encryption.">
                    <edge WIDTH="thin"/>
                </node>
                <node CREATED="1203811387921" ID="Freemind_Link_1987137112" MODIFIED="1203811392609" TEXT="know where to sniff">
                    <node CREATED="1203811371734" ID="Freemind_Link_57456761" MODIFIED="1203811373171" TEXT="Yes of course end-to-end encryption would have fixed this, but without it Onion routing actually exacerbates the risk of packet sniffing."/>
                    <node CREATED="1203811395500" ID="Freemind_Link_1030401667" MODIFIED="1203811398437" TEXT="The fact Onion routing was used is the only way this &quot;researcher&quot; (that leaves a bad taste) could get access to those packets in the first place - with regular routing he&apos;d need to have access to the embassy&apos;s ISP&apos;s network, or their upstream networks, to sniff those packets."/>
                </node>
            </node>
        </node>
        <node CREATED="1203808068890" ID="Freemind_Link_323634907" MODIFIED="1203808078937" POSITION="right" TEXT="ToR background">
            <node CREATED="1203808255734" ID="Freemind_Link_1600820841" MODIFIED="1203808257078" TEXT="a distributed system of computers that anonymizes the source of network traffic"/>
            <node CREATED="1203808651406" FOLDED="true" ID="Freemind_Link_1815601685" MODIFIED="1203808657703" TEXT="how it works">
                <node CREATED="1203811702718" ID="Freemind_Link_1921440204" LINK="http://www.torproject.org/overview.html.en" MODIFIED="1203811724078" TEXT="from the ToR site itself"/>
                <node CREATED="1203809926984" ID="Freemind_Link_801405722" MODIFIED="1203809928312" TEXT="Under Tor&apos;s architecture, administrators at the entry point can identify the user&apos;s IP address, but can&apos;t read the content of the user&apos;s correspondence or know its final destination. Each node in the network thereafter only knows the node from which it received the traffic, and it peels off a layer of encryption to reveal the next node to which it must forward the connection. (Tor stands for &quot;The Onion Router.&quot;)"/>
                <node CREATED="1203809900328" ID="Freemind_Link_207380926" MODIFIED="1203809901687" TEXT="Tor works by using servers donated by volunteers around the world to bounce traffic around en route to its destination. Traffic is encrypted through most of that route, and routed over a random path each time a person uses it."/>
                <node CREATED="1203808561843" ID="Freemind_Link_441868529" MODIFIED="1203808563718" TEXT="downloaded from the Tor website to configure several servers designed to bounce sensitive traffic around the internet before it ultimately is routed to its destination. The Tor servers try to make it harder to trace the originator of traffic in much the same way an agent under surveillance might quickly drive in and out of a parking garage to throw off pursuers."/>
                <node CREATED="1203810101187" ID="Freemind_Link_1074734152" MODIFIED="1203810106234" TEXT="1600 nodes"/>
            </node>
            <node CREATED="1203808635062" FOLDED="true" ID="Freemind_Link_1922326141" MODIFIED="1203808642515" TEXT="exit node caveat">
                <node CREATED="1203808626093" ID="Freemind_Link_1458310176" MODIFIED="1203808627281" TEXT="Tor has taken pains to warn its users that people running so-called exit nodes - which are the last Tor servers to touch a packet before sending it on its way - &quot;can read the bytes that come in and out there.&quot; They go on to say: &quot;This is why you should always use end-to-end encryption such as SSL for sensitive Internet connections.&quot;"/>
                <node CREATED="1203810068125" FOLDED="true" ID="Freemind_Link_253769006" MODIFIED="1203810069453" TEXT="Unless they&apos;re surfing to a website protected with SSL encryption, or use encryption software like PGP, all of their e-mail content, instant messages, surfing and other web activity is potentially exposed to any eavesdropper who owns a Tor server. This amounts to a lot of eavesdroppers -- the software currently lists about 1,600 nodes in the Tor network.">
                    <node CREATED="1203810075000" ID="Freemind_Link_295074878" MODIFIED="1203810091453" TEXT="but then not anonymous!"/>
                </node>
            </node>
            <node CREATED="1203808283046" FOLDED="true" ID="Freemind_Link_65883705" MODIFIED="1203808850843" TEXT="who uses it?">
                <node CREATED="1203808288109" ID="Freemind_Link_317136509" MODIFIED="1203808290046" TEXT="has a slew of beneficial uses: Human-rights workers, the military and journalists all use the system. However, the anonymity of Tor has also attracted seedier elements as well: digital pirates, online criminals and, quite possibly, child pornographers"/>
                <node CREATED="1203808833953" ID="Freemind_Link_735767612" MODIFIED="1203808835843" TEXT="TOR (The Onion Router) is a network of proxy nodes set up to provide some privacy and anonymity to its users. Originally backed by the US Naval Research Laboratory, TOR became an Electronic Frontier Foundation (EFF) project three years ago. The system provides a way for whistleblowers and human rights workers to exchange information with journalists, among other things. The system also provides plenty of scope for mischief."/>
                <node CREATED="1203809880515" ID="Freemind_Link_1333668798" MODIFIED="1203809881703" TEXT="Tor has hundreds of thousands of users around the world, according to its developers. The largest numbers of users are in the United States, the European Union and China."/>
                <node CREATED="1203811288640" ID="Freemind_Link_900915922" MODIFIED="1203811289921" TEXT="The first is the use by embassies of the Tor product to obfusticate their communications. This is a reasonable response to the assumed traffic monitoring by the host country."/>
            </node>
            <node CREATED="1203809059015" FOLDED="true" ID="Freemind_Link_1072807557" MODIFIED="1203809194218" TEXT="manipulations">
                <node CREATED="1203809079078" ID="Freemind_Link_587439201" LINK="http://www.teamfurry.com/wordpress/2007/11/19/on-tor/#more-177" MODIFIED="1213783583630" TEXT="data from exit node eavesdropping"/>
                <node CREATED="1203809128640" ID="Freemind_Link_677882397" LINK="http://www.teamfurry.com/wordpress/2007/11/20/tor-exit-node-doing-mitm-attacks/" MODIFIED="1213783620833" TEXT="exit node man-in-the-middle attacks">
                    <node CREATED="1203809173781" ID="Freemind_Link_1135359854" LINK="http://www.f-secure.com/weblog/archives/00001321.html" MODIFIED="1213783641427" TEXT="response"/>
                </node>
                <node CREATED="1203810593156" ID="Freemind_Link_1315461423" LINK="http://www.lightbluetouchpaper.org/2007/09/07/analysis-of-the-storm-javascript-exploits/" MODIFIED="1213783679302" TEXT="SPAM impersonation of Tor by Storm"/>
            </node>
        </node>
    </node>
</map>
