:::: MENU ::::
Showing posts with label TOR. Show all posts
Showing posts with label TOR. Show all posts

Friday, 1 January 2016

Tor Project to Start Bug Bounty Program — Get Paid for HACKING!

tor-project-bug-bounty













The non-profit organization behind TOR – the largest online anonymity network that allows people to hide their real identity online – will soon be launching a "Bug Bounty Program" for researchers who find loopholes in Tor apps.

The bounty program was announced during the recurring 'State of the Onion' talk by Tor Project at Chaos Communication Congress held in Hamburg, Germany.

Bug bounty programs are cash rewards gave by companies or organizations to white hat hackers and researchers who hunt for serious security vulnerabilities in their website or products and then responsibly disclose them.


Bug bounties are designed to encourage security researchers and hackers to responsibly report the vulnerabilities they discovered, rather than exploiting it.

Here's what one of the founders of the Tor Project, Nick Mathewson, said about the bug bounty program as reported by Motherboard:
"We are grateful to the people who have looked at our code over the years, but the only way to continue to improve is to get more people involved...This program will encourage people to look at our code, find flaws in it, and help us to improve it."
The bug bounty program will start in the new year.

The Tor Project is following in the footsteps of a number of major technology companies, such as Facebook, Google, Paypal, and Mozilla, which offer bug bounties in thousands of Dollars.

Recently United Airlines made headlines by becoming the first airline to launch its own bug bounty program, eventually awarding millions of frequent-flyer miles to hackers and researchers.



The bug bounty could be in the wake of last month’s incident when Tor Project accused the FBI of paying the researchers of Carnegie Mellon University (CMU) at least $1 Million to help them Unmask Tor users and reveal their IP addresses. However, the FBI denies the claims.

Tuesday, 15 December 2015

Tor hires former EFF chief as executive director

Tor is hoping to diversify its funding and move away from government sources

linux encryption


A former Electronic Frontier Foundation executive director will lead the Tor Project, the widely used anonymity tool that frequently comes up in debates over encryption and privacy.
Shari Steele was selected in part for her experience in growing non-profits and “will be especially valuable as we continue our campaign to diversify our funding sources,” wrote Roger Dingledine, Tor’s interim executive director, in a blog post.
Steele spent 20 years at the EFF, starting as a staff attorney, then legal director and eventually executive director.
shari steele tor executive directorTHE TOR PROJECT
Shari Steele, the Tor Project’s executive director

Tor is short for The Onion Router, which is a network of distributed nodes that provide greater privacy by encrypting a person’s browsing traffic and routing that traffic through random proxy servers.
The U.S. Naval Research Laboratory started Tor, although it is now maintained by the nonprofit Tor Project. It has had a variety of donors over the years, including Radio Free Asia and a U.S. State Department bureau this year.
But the Tor Project said earlier this month as it launched its first donations drive that it wanted to move away from government sources. The funding would be used to make Tor faster and more secure.
roger dingledine torTHE TOR PROJECT
The Tor Project launched its first funding drive in early December.

To use Tor, a specialized Firefox browser package must be downloaded, which allows access to “.onion” websites, the suffix for so-called hidden websites, as well as anonymized access to the regular Web.
Using Tor makes it difficult but not impossible to determine a person’s real IP address, which helps protect protect people doing sensitive web browsing. However, advanced attacks have been developed that undermine its effectiveness.
Governments have expressed concern over encryption tools such as Tor, worrying that their use obstructs terrorism and other law enforcement investigations. But Tor is also used by journalists, human rights activists and others who have an interest in masking their web browsing activity, particularly in countries that have poor human rights records.
Steele comes on board at a time when Tor has been embroiled in controversy. In November, the organization accused the FBI of paying Carnegie Mellon University $1 million for information on security issues that later facilitated arrests related to online drug markets.
Tor questioned the legal premise under which the alleged operation was conducted and whether it met ethical guidelines imposed on university-related research. 
Two researchers from Carnegie Mellon were due to give a presentation at the Black Hat conference last year on what they described as a low-budget attack that could be used to unmask Tor users. The talk was unexpectedly canceled.

Friday, 11 December 2015

France will not Ban Public Wi-Fi Or Tor Network, Prime Minister Valls Confirms

tor-network-ban-security



Despite the French Ministry of Interior's demands, France will not ban the TOR anonymity network or Free public Wi-Fi as a way to help the law enforcement fight terrorism.

French Prime Minister Manual Valls has gone on record saying that a ban on Free public Wi-Fi is "not a course of action envisaged," and he is not in favor of banning the TOR anonymity network, either.

Following the deadly terror attacks on Paris last month, an internal document obtained by Le Monde indicated that French government wanted to block communications of TOR as well as ban the use of Free Public Wi-Fi during states of emergency in an effort to fight terrorism more efficiently.

However, according to France PM, banning Encrypted Communications could affect the country's economy and security.


TOR and Free Wi-Fi Safe in France, PM Says 


"A ban of [free public] Wi-Fi is not a course of action envisaged [and never has been]," Valls said  on Wednesday. 

Neither he is in favor of banning the TOR network, which encrypts and re-routes user traffic through a network of volunteer-operated servers, masking the real identities of users.
"Internet is a Freedom, is an extraordinary means of communication between people, it is a benefit to the economy," Valls added. "It's also a means for terrorists to communicate and spread their totalitarian ideology."
Therefore, he said the police must take some measures to improve their fight against terrorism in light of recent Paris attacks, but whatever measures they take to combat terrorism "must be effective."

The whole world response to recent Paris attacks involves lawmakers in the United States and Europe calling for new laws on technology, forcing the tech companies to put "backdoors" in their products and hand over encryption keys to the government on court orders.

Tuesday, 8 December 2015

What is the Deep Web ? A small Tour to Deep Web.


What is the Deep Web
The Deep Web (or Invisible web) is the set of information resources on the World Wide Web not reported by normal search engines. You need Tor Browser to see Deep web .



According several researches the principal search engines index only a small portion of the overall web content, the remaining part is unknown to the majority of web users.

What do you think if you were told that under our feet, there is a world larger than ours and much more crowded? We will literally be shocked, and this is the reaction of those individual who can understand the existence of the Deep Web, a network of interconnected systems, are not indexed, having a size hundreds of times higher than the current web, around 500 times.

Very exhaustive is the definition provided by the founder of BrightPlanet, Mike Bergman, that compared searching on the Internet today to dragging a net across the surface of the ocean: a great deal may be caught in the net, but there is a wealth of information that is deep and therefore missed.

Ordinary search engines to find content on the web using software called "crawlers". This Deep Web technique is ineffective for finding the hidden resources of the Web that could be classified into the following categories:
  • Dynamic content: dynamic pages which are returned in response to a submitted query or accessed only through a form, especially if open-domain input elements (such as text fields) are used; such fields are hard to navigate without domain knowledge.
  • Unlinked content: pages which are not linked to by other pages, which may prevent Web crawling programs from accessing the content. This content is referred to as pages without backlinks (or inlinks).
  • Private Web: sites that require registration and login (password-protected resources).
  • Contextual Web: pages with content varying for different access contexts (e.g., ranges of client IP addresses or previous navigation sequence).
  • Limited access content: sites that limit access to their pages in a technical way (e.g., using the Robots Exclusion Standard, CAPTCHAs, or no-cache Pragma HTTP headers which prohibit search engines from browsing them and creating cached copies).
  • Scripted content: pages that are only accessible through links produced by JavaScript as well as content dynamically downloaded from Web servers via Flash or Ajax solutions.
  • Non-HTML/text content: textual content encoded in multimedia (image or video) files or specific file formats not handled by search engines.
  • Text content using the Gopher protocol and files hosted on FTP that are not indexed by most search engines. Engines such as Google do not index pages outside of HTTP or HTTPS.
A parallel web that has a much wider number of information represents an invaluable resource for private companies, governments, and especially cybercrime. In the imagination of many persons, the Deep Web term is associated with the concept of anonymity that goes with criminal intents the cannot be pursued because submerged in an inaccessible world.

As we will see this interpretation of the Deep Web is deeply wrong, we are facing with a network definitely different from the usual web but in many ways repeats the same issues in a different sense.

What is a Tor? How to preserve the anonymity?

Tor is the acronym of "The onion router", a system implemented to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers hiding user's information eluding any activities of monitoring.

As usually happen, the project was born in military sector, sponsored the US Naval Research Laboratory and from 2004 to 2005 it was supported by the Electronic Frontier Foundation.

Actually the software is under development and maintenance of Tor Project. A user that navigate using Tor it's difficult to trace ensuring his privacy because the data are encrypted multiple times passing through nodes, Tor relays, of the network.

Connecting to the Tor network

Imagine a typical scenario where Alice desire to be connected with Bob using the Tor network. Let’s see step by step how it is possible.

She makes an unencrypted connection to a centralized directory server containing the addresses of Tor nodes. After receiving the address list from the directory server the Tor client software will connect to a random node (the entry node), through an encrypted connection. The entry node would make an encrypted connection to a random second node which would in turn do the same to connect to a random third Tor node. The process goes on until it involves a node (exit node) connected to the destination.

Consider that during Tor routing, in each connection, the Tor node are randomly chosen and the same node cannot be used twice in the same path.

To ensure anonymity the connections have a fixed duration. Every ten minutes to avoid statistical analysis that could compromise the user’s privacy, the client software changes the entry node.

Up to now we have considered an ideal situation in which a user accesses the network only to connect to another. To further complicate the discussion, in a real scenario, the node Alice could in turn be used as a node for routing purposes with other established connections between other users.

A malevolent third party would not be able to know which connection is initiated as a user and which as node making impossible the monitoring of the communications.
Tor network
After this necessary parenthesis on Tor network routing we are ready to enter the Deep Web simply using the Tor software from the official web site of the project. Tor is able to work on all the existing platforms and many add-ons make simple they integration in existing applications, including web browsers. Despite the network has been projected to protect user’s privacy, to be really anonymous it's suggested to go though a VPN.
A better mode to navigate inside the deep web is to use the Tails OS distribution which is bootable from any machine don't leaving a trace on the host. Once the Tor Bundle is installed it comes with its own portable Firefox version, ideal for anonymous navigation due an appropriate control of installed plugins, in the commercial version in fact common plugins could expose our identity.

Once inside the network, where it possible to go and what is it possible to find?
Well once inside the deep web we must understand that the navigation is quite different from ordinary web, every research is more complex due the absence of indexing of the content.

A user that start it's navigation in the Deep Web have to know that a common way to list the content is to adopt collection of Wikis and BBS-like sites which have the main purpose to aggregate links categorizing them in more suitable groups of consulting. Another difference that user has to take in mind is that instead of classic extensions (e.g. .com, .gov) the domains in the Deep Web generally end with the .onion suffix.

Following a short list of links that have made famous the Deep Web published on Pastebin.
Tor network
Cleaned Hidden Wiki should be a also a good starting point for the first navigation. Be careful . Stay Hungry .