Quote from: AtheistAKASaneBrain on February 08, 2015, 02:59:07 PM

Tell me when TOR has ever been compromised by itself and not involving javascript/flash/other useless plugins that you should have OFF exploits, .
I don't think it has ever happened.

NSA programs for identifying Tor traffic on the internet: Stormbrew, Fairview, Oakstar, and Blarney. These are partnerships with telecoms companies carrying the traffic, which identify encrypted packets fitting the Tor protocol and identify users sending and receiving that traffic.

XKeyscore is a database developed by the NSA that monitors all traffic sent and received by identified nodes, whether that traffic is Tor-encrypted or not. IE, using Tor identifies your PBX (that is, your telephone line or cell account, not your IP address or your MAC which could change) for total monitoring. Xkeyscore also monitors traffic and identifies new targets for monitoring based on the content of their searches and the content of the web pages they're reading. According to the NSA's tortured definitions they have not "collected" this information nor identified particular people for monitoring until a human being retrieves the stored information or designates a particular person - they claim in short that as long as it's their programs doing it as opposed to their live people, it's not a constitutional violation.

Quantum (or QUANTUMINSERT if you're on the other side of the Atlantic Puddle) is a set of fake Internet backbone servers, placed by the NSA via partnership with the telecoms companies. Quantum servers' position on the backbone means that they are usually capable of reacting before the legitimate servers to which requests are targeted. Their response is typically to redirect monitored traffic (including the non-Tor traffic of monitoring targets) to or through FoxAcid servers. China apparently uses the same technology to monitor and interfere with their dissidents, but I don't know what name they use for it, nor whether they share information with the NSA.

FoxAcid is a set of fake Internet servers to which traffic gets rerouted in real time, effectively interposing a "Man in the Middle" into Tor and other traffic. Usually this does not imply the ability to decrypt Tor packets; FoxAcid servers' main purpose w/r/t Tor is serving malware to the Tor computers. When successful, this downgrades encryption, enables later tracking, or causes the computer to "leak" identifying information. Arguably, FoxAcid cannot directly eavesdrop on a Tor session if you're not running something vulnerable. In practice, it attacks targets that have run Tor traffic in the past, while they don't have all that vulnerable crap shut down. Also in practice, these are the guys who have strong-arm capability over the people who manufactured or sold your computer. You could be running something vulnerable at the hardware level and not know it. Finally, FoxAcid is also used to manage the NSA botnet of infected computers; that is, when a malware-infested machine makes a 'callback' for new malware, instructions, or to report on what you're doing, a FoxAcid server takes the call.

EgotisticalGiraffe was one such malware delivered by FoxAcid; it was an exploit of a type confusion vulnerability in E4X, a library that the Tor Browser Bundle used for XML extensions for Javascript. The type confusion resulted in XML-encoded javascript being executed even when Javascript was turned off. It was not fixed until Firefox 16.0.2, after the Snowden Papers explained the exploit.

DireScallop is another FoxAcid payload. It is executed from Javascript, and used to stop commercially-available security systems from preventing other malicious payloads from making permanent changes in security configuration on the target systems.

In Early August, 2013, the FBI was running more than half the Tor nodes, including the Tormail nodes. When you're running more than half the nodes, traffic analysis really isn't all that hard. http://www.metafilter.com/130629/Possible-FBI-infiltration-of-TOR

In December 2013, a Harvard student used an anonymous account to access Tor, and used Tor to post a fake bomb threat to avoid a final exam. The FBI found via logfiles that realtime traffic from offcampus did not correlate any Tor packets with the exact time when the threat was posted, got a list of Harvard computers that had used the Tor protocol in the timeframe in question, went through them one by one to find the one from which the threat had been sent, identified the person who had been using it at the time via non-Tor logged traffic, and arrested him.

2012: In "Operation Torpedo", the FBI used Metasploit to send Flash malware called 'Decloaker' to nodes that had recently been observed to use the Tor protocol, resulting in unmasking "a majority" of the Tor users on the net at that time. This was not reported until December 2014: http://www.wired.com/2014/12/fbi-metasploit-tor/

Here are three direct links to images of Snowden documents published in Der Speigel. Guess what: They're using traffic shaping and correlation attacks to de-anonymize Tor users! "WELL DUH!"
http://www.spiegel.de/media/media-35538.pdf
http://www.spiegel.de/media/media-35543.pdf
http://www.spiegel.de/media/media-35542.pdf

September, 2013: A GCHQ program named FLYING PIG is discovered; it cannot decrypt SSL packets, but can identify SSL traffic that is encrypted using the same keys. This was quickly extended to correlate Tor packets. Details are unknown; this may be fixed now that DUAL_EC_DRBG is no longer used and it may not. Interestingly, this came out in the context of an MITM attack in which the NSA was impersonating Google while engaged in economic espionage against Peterobaras, a Brazilian company.

TUMULT, TURBULENCE, and TURMOIL: NSA programs that monitor traffic at the wire or channel level. They parse packets, without regard to where from and where to, looking for associative information -- for example, email lists from Google, YahooMail and other mail services - contact lists from LinkedIn - buddies lists from social media services - usernames appearing in the same thread (and especially in quoted messages, the way I quoted yours above) in forums like this one - etc - essentially anything that identifies people as having contact or friends in common. So if somebody has both you and any of the same people you communicate with via Tor on the same mail list or buddies list, guess what - they already know that you have something to do with them!

Welcome to life in my fishbowl, friend; they already know I'm a troublemaker, and now that I've hit this many keywords in one message, which they know you're reading, and which they know is a reply to your message? They know you're a troublemaker too. Have a nice day.