top | item 6154246

Tor Freedom Host compromised, JS injected into multiple sites

129 points| coolnow | 12 years ago |pastebin.com

42 comments

order
[+] PhasmaFelis|12 years ago|reply
I realize this marks me a failure as a hacker and a human being, but JavaScript is not my native tongue and Google Translate doesn't seem to have an option for it. Could someone please post some actual news about...whatever is happening?
[+] stdgy|12 years ago|reply
Here's my current understanding:

- Freedom Host's founder arrested in Ireland for potential extradition on American child pornography distribution charges.

- Odd Javascript snippets found on sites hosted by Freedom Host. Initial investigations seem to point towards a possible 0-day targeting Firefox.

If the delivered Javascript is a browser-breaker, this strongly suggests someone is collecting the actual identities of the Tor users.

[+] syncerr|12 years ago|reply
Another one: http://pastebin.com/K61QZpzb

Shows an iframe URL of: http://nl7qbezu7pqsuone.onion?requestID=203f1a01-6bc7-4c8b-b...

Which is live now[1], and shows:

<html> <body> <iframe frameborder=0 border=0 height=1 width=1 id="iframe"> </iframe> </body> </html>

<script></script>

[1] http://nl7qbezu7pqsuone.onion.to/?requestID=203f1a01-6bc7-4c...

[+] runeks|12 years ago|reply
The Tor Project should offer a bundle with 1) a VirtualBox image with Tor installed configured to work with 2) a Tor daemon installed on the host system. This should add another level of security.
[+] mixmax|12 years ago|reply
It seems that the JS is checking for firefox and then opening an iframe, which presumably holds some more JS.

Anyone know what that might be, and who has compromised freedom host?

[+] coolnow|12 years ago|reply
The IP that's hosting the iframe is a Verizon Business one. The JS also looks to be setting a cookie, probably for identification purposes (reading the cookie from another site to confirm the user?). I'm not sure that's the case because once the Tor Bundle is closed, cookies are automatically deleted.
[+] vitaltao|12 years ago|reply
I wonder who could've done it..
[+] jevinskie|12 years ago|reply
Are you implying it is the NSA? If so, please state so and why you believe that. Otherwise this comment adds nothing to the discussion.
[+] _b8r0|12 years ago|reply
Complete conjecture, but it's not that far a hop skip and jump to consider the possibility that Sabu's team in the FBI built and planted the JS.
[+] mtgx|12 years ago|reply
This seems to be happening at the same time with the founder's arrest. Coordinated action?
[+] Argentum01|12 years ago|reply
Or perhaps it's been going on for awhile and the arrest brought the necessary scrutiny
[+] tmbeihl|12 years ago|reply
The ip address with the iframe seems to be down now? Anyone get a copy of the iframe JS?
[+] tmbeihl|12 years ago|reply
They seem to possibly targeting the tor browser bundle
[+] FedRegister|12 years ago|reply
Who is actually running Javascript from Tor though?
[+] unimpressive|12 years ago|reply
The Tor Browser Bundle enables Javascript by default.
[+] betterunix|12 years ago|reply
People who need or want to use something like GMail over Tor?
[+] ToothlessJake|12 years ago|reply
I've referenced Endgame Systems before[1], exploiting end users for-profit via for figures like the NSA is their type of game.

"There are even target packs for democratic countries in Europe and other U.S. allies. Maui (product names tend toward alluring warm-weather locales) is a package of 25 zero-day exploits that runs clients $2.5 million a year.[2]"

Endgame's product list was not marked classified, a product meant for distribution only to the likes of the NSA but peddled amongst fellow for-profit "whitehat" in arms. Yet another company with immunity to laws others are hunted and imprisoned for.

[1] https://news.ycombinator.com/item?id=6115881

[2] http://wiki.echelon2.org/wiki/Endgame_Systems

[+] cne_productizer|12 years ago|reply
Speaking as someone in the field (I know people from Endgame, and work in a similar place with much more discretion), this is a load of shit. The FBI wouldn't be deploying Endgame product like this.