An attack on Tor, a network designed to cloak users in anonymity, resulted in a breach that caused the project team to scramble for a solution. The Carnegie-Mellon researchers who figured out how to deanonymize users of the network have been suspected of working hand-in-hand with the NSA, but that's unlikely. If the government had learned how to identify Tor users, why would it announce the fact?
News that two Carnegie-Mellon CERT researchers have developed an inexpensive way to breach the Tor network has the project, privacy advocates, and probably criminals who use the network equally concerned.
The Tor Project posted has advised relays to upgrade to Tor 0.2.r.23e or 0.2.5.6-alpha to close the protocol vulnerability used by the researchers, but It warned that preventing traffic confirmation in general "remains an open research problem."
Hidden service operators should consider changing the location of their service, the Tor Project said.
"So much for being secure," remarked Jim McGregor, principal analyst at TIrias Research.
"If you were using Tor for classified communications and data, this could be very serious," he told TechNewsWorld.