The Onion Router under fire

Anonymity tool The Onion Router (TOR) has had a pretty rough few months, following confirmation that the FBI used an security flaw in the Tor Browser Bundle to install malware on its users’ computers.

Despite offering our own privacy platform we’re big supporters of TOR and think it’s generally a secure platform to use (you can take a look at some of our guides on TOR right here). But this week’s confirmation that the FBI hacked TOR servers as part of an investigation into child pornography is a good reminder that the platform does have its vulnerabilities.

The target of the FBI’s investigation was Irish-US citizen Eric Marques. The FBI described Marques as the “largest faciliator of child porn on the planet.” According to the FBI, Marques operated Freedom Hosting, which hosted more than 100 child porn sites, which in turn supported thousands of members who had collectively posted millions of images. Freedom Hosting offered “.onion” domains that could only be reached via the Tor network.

In July the FBI seized control of Freedom Hosting and modified its sites to serve malware that targeted users of the Tor Browser Bundle (a version of Firefox customised for TOR use). The malware appeared to transmit the unique MAC address of infected PCs, allowing the FBI to identify users’ IP addresses.

TOR popular with bot nets

The TOR Browser Bundle has since been fixed to protect users from the security flaw the FBI exploited. But TOR has faced more bad press with a report from the University of Luxembourg, which analysed TOR’s traffic types. The researchers used another exploit in TOR, which allowed the researchers to collect data on TOR users and see kind of content they were accessing via the network. The researchers say they achieved this “with only a moderate amount of resources.”

The security flaw was fixed a few months ago, but the results of the research were not good publicity for TOR, which mainly promotes itself as a tool for online freedom activists and people living under censorious regimes. The researchers found the top five most popular TOR addresses belonged to botnet command and control servers. The researchers also found that in total there was balance between the number of hidden services with illegal content/activites and those devoted to human rights and freedom of speech. It’s also worth noting that the research was only counting hidden TOR services. Many TOR users will obviously be using the platform to access regular, non-hidden, websites.

Stay vigilant

Hopefully TOR hasn’t been too damaged by these revelations and can continue to gain the trust of its users by rapidly fixing flaws and addressing concerns. But it’s worth remembering that pretty much every privacy tool will have its vulnerabilities. If you want to achieve a great level of protection you should probably look into combining platforms like TOR with a VPN.

Comments icon
We invite you to discuss this post in our Reddit community or on Twitter. You can also send your feedback to
Tags: Privacy

Most people don't need a commercial VPN to work from home securely

Posted on April 7, 2020 by Nick Pestell

Many small businesses and their employees are concerned about the security of their data whilst working from home during the coronavirus pandemic. We see a lot of confusion surrounding this topic, even from fairly technical folk and there is unfortunately a lot of misinformation being spread by commercial VPN providers themselves.

You can't always get what you want: the eternal conflict between lawful access and privacy

Posted on April 19, 2018 by mirimir

In late March, the US Clarifying Lawful Overseas Use of Data Act (CLOUD Act) took effect. And predictably, the US Supreme Court just dismissed United States v. Microsoft Corp. In that case, Microsoft was fighting a subpoena for data stored in an Irish data center.

Protect yourself today and get peace of mind

Shut out hackers, identity thieves and the global government surveillance apparatus — every time you go online.