The attackers managed to blacklist most of the top 100 exit relays - thus most of the Tor exit capacity - with regard to Blockchain and CloudFlare. "F or periods during late October and much of November it was very difficult if not impossible to get to Blockchain through Tor without hitting 'New Identity' in Tor several times," he said. “Of the 1000 or so exit relays, the biggest 100 probably carry 90 per cent of the traffic. Or they can create their own fake SSL certificate for the site to make it seem like the connection is normal, though the attacker would have to rely on a gullible user who'd ignore a Tor browser warning.
With this they can start to intercept and alter the traffic coming through. But any nefarious type who runs a malicious relay can use an encryption removal technique known as SSL stripping, where connections are no longer protected through the Secure Sockets Layer, which usually shows users are protected with the HTTPS section of a web address. Legitimate exit relays act as the final jump from the anonymising Tor network, which loops users through a number of randomly-chosen servers across the world to protect their identity, onto the clear web. The attackers used a tried-and-tested method to begin with, setting up a number of malicious exit relays on Tor. And according to the man who witnessed the attacks go off last year, Digital Assurance director Greg Jones, it looks like buyers and sellers of dark markets were the targets. Security-focused email services, Riseup and Safe-mail were also targeted by the same crew. They were robbed of significant sums, probably tens of thousands of dollars worth of the virtual currency, possibly more. Across October and November of last year, some unlucky users of the world’s most popular Bitcoin wallet,, and one of the better-known exchanges, LocalBitcoins, had their usernames and passwords silently pilfered.
0 kommentar(er)
