Hack Reveals Russian Plan to Deanonymize Tor Traffic

A breach on SyTech, a contractor for Russia’s national intelligence service, has revealed plans for a system that could deanonymize traffic on Tor, a web browser that hides location, IP address, and other identifying data about its users.

Tor is used by journalists and activists to get around state censorship, so revealing their identities could put them at risk.

BBC Russia, which reported the breach, says a group of hackers called 0v1ru$ broke into SyTech’s Active Directory server on July 13, giving them access to 7.5TB worth of data from the contractor, as well as access to SyTech’s entire IT network. The hackers also took over the company’s main website, posting a “Yoba-face” (an image similar to the trollface meme.)

As The Next Web notes, the Tor project, dubbed Nautilus-S, is one of five other projects the Russian national intelligence service and SyTech were reportedly working on since 2009. These include:

• Nautilus, which collects data on social media users on platforms such as Facebook, MySpace, and LinkedIn.
• Reward, which seeks to hack peer-to-peer networks.
• Mentor, which monitors and searches email communications on the servers of Russian companies.
• Hope (or Nadezhda), Russia’s internet kill switch.
• Tax-3, which would create a closed intranet to store sensitive information about civil servants, judges, and participants in criminal proceedings.

This information was also shared with the hacker group Digital Revolution, which tweeted the stolen files and passed them on to journalists. “It seems that the group is small. Regardless of their number, we welcome their contribution. We are glad that there are people who do not spare their free time, who risk their freedom and help us,” Digital Revolution said, according to a translation of the BBC report.

??, ???, ??? ??? ? ??? ?????????? ? ????????-2? ????? ?????? ?? ???????? ???????? ??????? ?? ???????-1? @Dobrokhotov @RuBlackListNET @leonidvolkov @msvetov @shaveddinov @kozlyuk @RuHackersNews @the_ins_ru @tjournal @kmartynov @bbcrussian pic.twitter.com/RjKCFnXWlT

— DigitalRevolution (@D1G1R3V) July 18, 2019

Recently, it was reported that Russia plans to block nine VPN providers, including NordVPN, ExpressVPN, VyprVPN, TorGuard, and Hide My Ass, after they refused to connect their servers to the government’s content-filtering system.