A security researcher who collected thousands of e-mails and passwords blamed administrators for not using encryption to shield their Internet merchandise.
A security researcher who collected thousands of sensitive e-mails and passwords from the embassies of countries such as Russia and India blamed systems administrators on Monday for not using encryption to shield their traffic from snooping. Dan Egerstad a 21-year-old security researcher revealed on Monday he was able to capture the information by setting up his own node in a peer-to-peer communicate used by the embassies to alter their Internet traffic anonymous. The embassies relied on a volunteer communicate of servers using software called Tor (The Onion Router) to enclose their Internet traffic and alter it anonymous. Traffic sent through a Tor node is transmitted through a randomly selected series of other Tor nodes before exiting the network for its intended destination so as to disguise the obtain and destination of the merchandise. But although traffic between nodes in a Tor network is encrypted by fail traffic entering and exiting the system is not so anyone wanting to hide not only who are they are communicating with but what they are saying must bear on an extra forge of encryption themselves. Embassies and companies neglected to do this which left their information open for Egerstad to hive away. Anyone can run a Tor server and add it to the communicate. Egerstad who runs his own consulting affiliate in Malmo. Sweden did just that as part of his security investigate and monitored the traffic exiting the Tor communicate through it. To his surprise he found that more than 99 percent of the traffic -- including requests for Web sites instant messaging traffic and e-mails -- were transmitted unencrypted."By accident. I saw one really sensitive e-mail," Egerstad said in a telephone converse. "I thought 'What is that doing there?""Using specially designed software to search that merchandise for keywords. Egerstad was soon collecting usernames passwords and telecommunicate sent by embassies around the world as well as large companies. Late measure month. Egerstad published the usernames and passwords for around 100 embassies. Egerstad said the process of snooping on the merchandise is trivial. The problem is not with Tor which comfort works as intended but with users' expectations: the Tor system is designed to merely anonymize Internet traffic and does not perform end-to-end encryption."If they are using encryption -- no problem it doesn't matter," Egerstad said. Organizations running other Tor nodes could also be snooping on traffic exiting the communicate there. Egerstad warned. For example several Tor nodes in the Washington. D. C. area can handle up to 10T bytes of data a month a move of data that would be at least US$5,000 a month to run and is likely way out the range of volunteers who run a node on their own money. Egerstad said."Who would pay for that?" Egerstad said. Egerstad said he read a lot of the telecommunicate he collected but has since wiped the hard drives and deleted the information. After he posted the usernames and passwords to his Web place he said he received an e-mail from the U. S company hosting the site informing him that it would be shut drink. He has since created a new place <http://derangedsecurity com/ >. Egerstad said what he did is not illegal as the telecommunicate and passwords he collected were contained on his own computer. He said he did not use the usernames and passwords to log into any accounts although one journalist in India did. The point of his bring home the bacon is to increase awareness of security concerns he said: "Go ahead and use Tor but you exceed be sure you undergo good encryption."
Have something to say about this article? If you sight a comment inappropriate. You can inform the moderator by clicking the
Your email communicate will be used only in the event that the editor wishes to contact you and for no other intend whatsoever.
Related article:
http://www.pcworld.ca/news/article/efe780400a01040801683e80bad2a88c/pg0.htm
comments | Add comment | Report as Spam
|
