[thehackernews] Several Tor Exit Nodes Vulnerable To Heartbleed Bug

Half of the Internet fall victim to the biggest threat, Heartbleed bug and even the most popular online anonymity network Tor is also not spared from this bug.

[net-security] Tor relays vulnerable to Heartbleed dropped from anonymity network

Thanks to the OpenSSL Heartbleed bug, the Tor anonymity network is set to temporarily lose around "12 per cent of the exit capacity and 12 per cent of the guard capacity.” 

[infosecinstitute] What Good is Tor in 2014?

To the uninitiated, Tor, formerly known as The Onion Router, is probably the most popular proxy network for internet anonmyzing. It’s called an onion router because traffic goes through many layers of encrypting servers. The gateway IP of the user and the destination IP are also encrypted, as opposed to being in plain text. The internet server destiination is supposed to only see the IP of the exit node. That’s supposed to prevent users from being identifiable via server logs, whereas traffic being encrypted at all points is supposed to prevent eavesdropping.

[securityaffairs] Tor network is increasingly attractive for cybercrime

Cyber criminals are abusing even more Tor Network for illegal activities, from botnet management to money laundering, the number of services is increasing.

[net-security] Cybercriminals increasingly drawn to Tor anonymity and hidden services

Initially created to help political dissidents bypass traffic restrictions and hide their online activity from authoritarian governments, the Tor anonymity network has long since become a great tool for cyber crooks to hide their criminal activities and infrastructure.

[securelist] Tor hidden services – a safe haven for cybercriminals

Over the last few months I have been closely monitoring so-called Darknet resources, mostly the Tor network. And one thing that is immediately obvious is that the cybercriminal element is growing. Although, the Tor infrastructure and cybercriminal resources are not on the same scale as the conventional Internet, we managed to find approximately 900 hidden services online at the current time. There are also approximately 5,500 nodes in total and 1,000 exit nodes, but the possibility of creating an anonymous and abuse-free underground forum, market or malware C&C server is attracting more and more criminals to the Tor network.

Malware

Cybercriminals have started actively using Tor to host malicious infrastructure.  We found Zeus with Tor capabilities, then we detected ChewBacca and finally we analyzed the first Tor Trojan for Android. A quick look at Tor network resources reveals lots of resources dedicated to malware – C&C servers, admin panels, etc.

Hosting C&C servers in Tor makes them harder to identify, blacklist or eliminate.

 
Cythosia botnet webpanel

Although creating a Tor communication module within a malware sample means extra work from the malware developers, there will be a rise in new Tor-based malware, as well as Tor support for existing malware.

 
.Net SocksBot hardcoded C&C in Tor network

Cybercriminal forums and marketplaces are widely known on the Internet. Some of them are public, some are private and you need the approval or an invitation from an existing member or need to be a respected personality in underground scene. Now another layer has been added – Tor underground marketplaces. It all started from the notorious Silk Road market and evolved to dozens of specialist markets: drugs, arms and, of course, malware.

 
Botnet for sale

A simple registration procedure, trader ratings, guaranteed service and a user-friendly interface – these are standard features of a Tor underground marketplace. Some of the stores require sellers to deposit a pledge – a fixed sum of money – before starting to trade. This is to ensure that a trader is genuine and his services are not a scam or of poor quality.

 
Spyeye for sale

Financial fraud

Carding shops are firmly settled in the Darknet.  Stolen personal info is for sale with a wide variety of search attributes such as country, bank etc.  Tor credit card online shops that have been criticized by cybercriminals for bad quality or for being fake can find a second lease of life in the Darknet.

 
Online shop selling stolen credit card details

Offers are not limited to credit cards – dumps, skimmers and carding equipment are for sale too.

 
Shops with other carding goods

Money Laundering

Bitcoins play an important role in underground financial operations. Almost everything on the Tor network is bought and sold using bitcoins. Although iIt’s almost impossible to make a connection between a bitcoin wallet and real person, it is possible to: track bitcoin transactions as all of them are transparent and public, to build up a scheme of what’s going on, and find out the most valuable transactions made via bitcoin exchange services. That’s why money laundering services exist on Tor. Cybercriminals can create an account, deposit bitcoins and they will be broken up into various quantities, transferred through dozens of different wallets to make any investigation highly complicated.

 
Money laundering service

Conclusions

• A growing number of Tor hidden services and the ease with which they are can be deployed attracts more and more cybercriminals in the Darknet.
• Malware developers are using Tor more and more for a variety of malware-related tasks
• Financial fraud and money laundering are important aspects of the Tor network.

http://www.securelist.com/en/blog/8187/Tor_hidden_services_a_safe_haven_for_cybercriminals

[thehackernews] Tor Instant Messaging Bundle - A New Anonymous and Encrypted messaging Software

We are living in an era of Mass Surveillance, conducted by the Government Agencies like the NSA and GCHQ, and we ourselves gave them an open invitation as we all have sensors in our pockets that track us everywhere we go i.e. Smartphone. Encryption and security are more important today than any other time in our history. So, the best proactive way to keep your tracks clear is - Always use only trusted privacy tools and services.