Are The Feds Actively Trying To Hack Tor?

One of the ways I recommend to get around the widely unpopular NSA's domestic Internet surveillance is to use Tor. I like it so much that I've installed the Tor Browser Bundle by default in Bauer-Puntu Linux so you can surf the Interwebs in peace without fear of government snooping, the way the internet was originally intended.

Well a new piece of malware has been discovered that takes advantage of a vulnerability in Firfox that will allow the FBI to track your online activity while using the Tor network.

From Wired:

Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network.

The malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting. That would normally be considered a blatantly criminal “drive-by” hack attack, but nobody’s calling in the FBI this time. The FBI is the prime suspect.

“It just sends identifying information to some IP in Reston, Virginia,” says reverse-engineer Vlad Tsyrklevich. “It’s pretty clear that it’s FBI or it’s some other law enforcement agency that’s U.S.-based.”

If Tsrklevich and other researchers are right, the code is likely the first sample captured in the wild of the FBI’s “computer and internet protocol address verifier,” or CIPAV, the law enforcement spyware first reported by WIRED in 2007.

Court documents and FBI files released under the FOIA have described the CIPAV as software the FBI can deliver through a browser exploit to gather information from the target’s machine and send it to an FBI server in Virginia. The FBI has been using the CIPAV since 2002 against hackers, online sexual predators, extortionists, and others, primarily to identify suspects who are disguising their location using proxy servers or anonymity services, like Tor.

It would appear that even Tor might not be safe these days. As far as we know though, PGP is still secure, so make sure to keep using PGP for email and IM encryption.

What do you think about this? Scary or what? Let us know your take in the comments.