Scientists detect “spoiled onions” trying to sabotage Tor privacy network

[silicon_toad2000]

http://arstechnica.com/security/2014/01/scientists-detect-spoiled-onions-trying-to-sabotage-tor-privacy-network/

Computer scientists have identified almost two dozen computers that were actively working to sabotage the Tor privacy network by carrying out attacks that can degrade encrypted connections between end users and the websites or servers they visit.

The 22 malicious servers were among about 1,000 exit nodes that were typically available on Tor at any given time over a four-month period. (The precise number of exit relays regularly changes as some go offline and others come online.) The researchers found evidence that 19 of the 22 malicious servers were operated by the same person or group of people. Each of the 19 servers presented forged certificates containing the same identifying information. The virtually identical certificate information meant the MitM attacks shared a common origin. What's more, all the servers used the highly outdated version 0.2.2.37 of Tor, and all but one of the servers were hosted in the network of a virtual private system providers located in Russia. Several of the IP addresses were also located in the same net block.

"Organizations like the NSA have read/write access to large parts of the Internet backbone," Karlstad University's Winter wrote in an e-mail. "They simply do not need to run Tor relays. We believe that the attacks we discovered are mostly done by independent individuals who want to experiment."

[GhostShip]

Nothing to do with the feds then who are suspected of operating over a thousand tor exit relays to sniff out the location of the silk road some time ago

I would myself would place no emphasis on the servers being located anywhere in the world, you simply have to ask who might want to intercept such trafic and its value to them, its a limited playing field.

[White Stripes]

one wonders why these ancient versions are still compatible.... tor should be ever-evolving

[silicon_toad2000]

there's always people in every community who want to maintain backwards compatibility in the face of very good reasons not to.