A while back DEranged Security posted a list of credentials to users of Governments & Emassies. It wasn’t appreciated much, and the Swedish government was forced by American law enforcement to close down the website. The website resurrected again, and now they revealed their method of gaining the credentials.
#1 Five ToR exit nodes, at different locations in the world, equipped with our own packet-sniffer focused entirely on POP3 and IMAP traffic using a keyword-filter looking for words like “gov, government, embassy, military, war, terrorism, passport, visa” as well as domains belonging to governments. This was all set up after a small experiment looking into how many users encrypt their mail where one mail caught my eye and got me started thinking doing a large scale test. Each user is not only giving away his/her passwords but also every mail they read or download together with all other traffic such as web and instant messaging.
Did you get it? These governments told their users to use ToR, a software that sends all your traffic through not one but three other servers that you know absolutely nothing about. Yes, two are getting encrypted traffic but that last exit node is not. There are hundreds of thousands ToR-users but finding these kinds of accounts was… hmm… chocking! The person who wrote the security policy on these accounts should reconsider changing profession, start cleaning toilets! These administrators are responsible for giving away their own countries secrets to foreigners. I can’t call it a mistake, this is pure stupidity and not forgivable!
ToR isn’t the problem, just use it for what it’s made for.
So when using an anonymous proxy for something… be aware that the owner can sniff out what you’re sending across! Some might be honorable in their intentions, but some might not be!
