Security forces escalate the fight against anonymity: What's going on with Tor?
The situation surrounding the Tor browser is once again causing concerns among its users. Following recent arrests and successful attempts to de-anonymize administrators of darknet resources, experts have begun actively discussing how safe this tool is for anonymous browsing. The focus has been on the temporal analysis method employed by the investigative authorities in Germany. As a result of this method, the authorities were able to uncover the identities of the owners of major darknet sites, including one linked to the distribution of illegal content.
The temporal analysis method is distinct in that it does not exploit software vulnerabilities but instead requires extensive monitoring of traffic. It enables the establishment of a connection between specific user actions and their IP address. This situation is worrisome as it has cast doubt on the safety of using Tor for anonymous browsing.
The Tor development team has confirmed that they are not aware of the exact details of how the criminals were exposed, but they have speculated about the potential use of the outdated messenger Ricochet, which may have been used by one of the arrested individuals. They note that as the security system of Tor continues to improve, attacks like temporal de-anonymization become more complex but not impossible.
Cybersecurity experts assert that such attacks require significant resources. In particular, a method known as a "Sybil attack" may be employed, where malicious actors capture intermediate nodes to track traffic. In the case of Ricochet, authorities could have been sending requests through these nodes until they established a connection with the suspected criminal.
Interestingly, the majority of Tor relays are located in Germany, which may provide an additional advantage to government entities. The more users that connect to a specific node, the higher the likelihood of its capture. In this context, experts warn of the risks associated with using Tor for ordinary users.