Hacker News new | ask | show | jobs
by aaron42net 4236 days ago
That depends on how you define "wide scale infrastructure sabotage". I believe that this is resulting from: https://blog.torproject.org/blog/tor-security-advisory-relay...

January 30 to July 4, 2014 someone set up 115 tor nodes on fdcservers.net (total cost maybe ~$200k?), which was 6.4% of entry guard capacity. Clients talk to 3 guard nodes for an average of 45 days each, which means they probably picked a guard ~12 times during this period. Each guard-picking attempt had a ~6.4% chance of landing one of these bad guards, or a 55% chance across all attempts.

"We know the attack looked for users who fetched hidden service descriptors... The attack probably also tried to learn who published hidden service descriptors, which would allow the attackers to learn the location of that hidden service."

1 comments

I didn't know about those attacks. Very interesting. $200k is chump change for a Tor attack from large organizations. It's interesting to compare that number to the $100k prize offered by Russia. A neat speculation is that better attacks require a few digits more to be extremely effective and that six-digit attacks are at the cost-effectiveness threshold for most national purposes.

By "wide scale infrastructure sabotage" I was trying to refer to QUANTUMINSERT, TEMPORA and other internet-scale mass read and write capabilities. It doesn't look like the FBI had to use those sorts of technologies to interrupt the .onion addresses - I'm really happy about that. First because it shows that law enforcement can fight cybercrime without those tools and second because if they were used proponents/supporters would have championed them as 'necessary' or 'inevitable'.