Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Report: NSA has little success cracking Tor

Grant Gross | Oct. 7, 2013
The agency has attacked other software, including Firefox, in order to compromise the anonymity tool, according to documents

The documents also talk about efforts by the NSA and the U.K.'s GCHQ intelligence agency to influence the future development of Tor.

The story details efforts by the NSA to compromise Tor users through Firefox, but the NSA's documents say Mozilla fixed the vulnerability the agency was taking advantage of in Firefox 17, released in November 2012. The NSA had not been able to compromise users of Firefox 17 and later versions between late 2012 and this January, when the NSA documents were written, the Guardian story said.

Mozilla, in an August blog post, said it is investigating a vulnerability in older versions of Firefox. A spokeswoman declined further comment.

Roger Dingledine, director of the Tor project, its "good news" for the project that the NSA attacked with a browser exploit,

That means "there's no indication they can break the Tor protocol or do traffic analysis on the Tor network," he said in an email. "Infecting the laptop, phone, or desktop is still the easiest way to learn about the human behind the keyboard."

Even with the NSA attacks, Tor can still help protect anonymity, he added. "You can target individuals with browser exploits, but if you attack too many users, somebody's going to notice," he said. "So even if the NSA aims to surveil everyone, everywhere, they have to be a lot more selective about which Tor users they spy on."

But Tor won't keep users safe in all cases, he added. "Browser exploits, large-scale surveillance, and general user security are all challenging topics for the average Internet user," he said. "These attacks make it clear that we, the broader internet community, need to keep working on better security for browsers and other Internet-facing applications."

 

Previous Page  1  2 

Sign up for CIO Asia eNewsletters.