Re: How are hackers breaking Tor and trojan users?

[phobos@xxxxxxxxxx]

On Tue, Jun 10, 2008 at 09:38:42AM +0000, madathackers@xxxxxxxxx wrote 3.2K bytes in 56 lines about:
: I read that hackers are breaking Tor and turning into a trojan/rootkit?  Is
: this possible?  How can they do this?

We appreciate those who find bugs in our code, and even moreso those who
submit patches or detailed bug reports to fix the bugs.  I expect there
are fine bugs to fix in Tor, and that researchers will find them.  This
iterative process continues to make Tor better and your online anonymity
stronger.  I'm glad we're open source, rather than having to reverse
engineer a black box and then find the bugs.  

: In post: http://www.wilderssecurity.com/showpost.php?p=1257878&postcount=722

This sounds like an attack on Firefox, not Tor.  Apparently Tor will
find out about this exploit if the talk is accepted at Defcon.  Of the
attacks on firefox, it would be interesting to see if it is against
Firefox through Tor, firefox with torbutton 1.0.4, or firefox with the
current development version of torbutton (1.2.0rc2).  This thought comes from the DOM
storage link in that post.

: Is this XeroBank spreading fear to Tor without cause?  Or did hackers break
: Tor and create it a Trojan / Rootkit?

I'm not sure what this means exactly.  I don't see what Xerobank could
gain from devaluing the software they rely upon for their product.  If
such an exploit existed, and can be presented at Defcon, chances are
it's not a difficult exploit, or isn't against the Tor network, but
rather a research network.  Again, we have no information to go on, so
I'm just speculating.  For all I know, they put a banana peel on the
floor for Roger to slip on.

If we tie it back to the Firefox DOM link, well, it could be a firefox
exploit that can decrease your anonymity.  Java, Flash, etc can expose
you, too.

: How can Tor become Trojan / Rootkit, this seems not possible?  How are
: hackers allowed to break user computers and not be illegal?  Why is JanusVM
: working for XeroBank?  Is there a safe Tor Virtual Machine to use?

You should ask Kyle why he's working at Xerobank, and what the status of
JanusVM is these days.  I imagine he likes a paycheck; much like
billions of other people.  I see he's responded to this thread, but I 
don't see a straight answer to your questions.

-- 
Andrew