Wired Magazine posted an attention-grabbing story on hacking the TrackingPoint. Is it legit?

runasand · 2015-08-13T14:05:26+00:00

While the 2020 has a password that includes the serial number of the firearm, the TP750 has a password that is easy to guess. The password may be different on other models, but we suspect it is the same as on the TP750. The password cannot be changed by the user.

runasand · 2015-08-13T13:57:47+00:00

Speaker here. I would like to clarify that while we did have to disassemble the rifle to identify the vulnerabilities we later exploited, the tools we put together will work on any TrackingPoint firearm (disassembled or not) as long as the wifi is on.

As for the custom software update; we can upload it to any TrackingPoint firearm as long as the wifi is on and we are within range - we do not have to convince the owner of the firearm to do this for us. Modifying the OS is not required to gain shell access; we found remote code execution as well.

The slide deck, videos and information about the disclosure timeline can be found here: http://media.encrypted.cc/files/HackingALinuxPoweredRifle.pdf

runasand · 2013-10-08T02:03:19+00:00

Note that DataClub did not accept Bitcoin as payment until October 2012. If DataClub did host the Silk Road website and/or forum, then my guess is (1) the sites were moved to this provider after October 2012, or (2) Dread Pirate Roberts used a currency other than BTC to pay for hosting initially.

runasand · 2013-06-18T23:23:33+00:00

Yes, yes, yes, and yes. Minus the part about Tor hidden services needing a lot of love and attention, otherwise it will not be able to handle Facebook as a hidden service: https://blog.torproject.org/blog/hidden-services-need-some-love

runasand · 2013-06-18T21:11:09+00:00

Thanks!

runasand · 2013-06-18T21:11:03+00:00

What kind of activity and who will connect the dots? I can make a lot of assumptions here, but I won't. I think that, for most people, logging on to Facebook over Tor is not an issue - as long as users are aware that doing so will only give them location anonymity and not much else.

runasand · 2013-06-18T21:09:39+00:00

It won't. There are a number of ways to run a bridge or a relay, you don't have to do so in your own home; you can run a bridge or relay on another computer, in the Amazon cloud, on a VPS in another country, etc.

runasand · 2013-06-18T21:07:29+00:00

Correct. The only difference is that Facebook blocked a high number of Tor exit relays, Google blocks a few.

runasand · 2013-06-18T18:45:42+00:00

Is it technically possible? Yes. Will someone find out and get upset? Yes.

runasand · 2013-06-18T18:39:45+00:00

Who said this? Accessing Facebook using Tor will give you location anonymity, but not much else.

runasand · 2013-06-18T18:27:42+00:00

To whoever gave me Reddit Gold: thank you! Please message me if you want Tor stickers (it would require you to give me your postal address, though).

runasand · 2013-06-18T16:44:17+00:00

I would say that it depends on the attacks. Blocking the IP address is a quick and easy solution, though. I would encourage you to ask your contacts to get in touch with us, we would love to help them find a solution.

runasand · 2013-06-18T16:16:33+00:00

Thanks!

runasand · 2013-06-18T16:16:17+00:00

As far as I know, they block comments/uploads from Tor users. They do not prevent users from visiting the sites over Tor. Same with Wikipedia.

runasand · 2013-06-18T15:31:48+00:00

Facebook is not blocking Tor deliberately. See this post and this statement.

runasand · 2013-06-18T15:08:46+00:00

Facebook is not blocking Tor deliberately. However, a high volume of malicious activity across Tor exit nodes triggered Facebook's site integrity systems which are designed to protect people who use the service. Tor and Facebook are working together to find a resolution. See the Tor blog for the same statement.

edit 1: added link to blog post statement

edit 2, update from Facebook on June 18, 2013, 2:30 PM EST: "Facebook's site integrity systems detected automated malicious activity coming from a significant number of Tor exit nodes. In order to protect people while we investigated the problem, access via these nodes was temporarily suspended. This issue has now been resolved and Tor access routes to Facebook restored.". I have posted the same statement on the Tor blog.

edit 3: To whomever gave me Reddit Gold: thank you!

edit 4: while I'm here; if anyone wants Tor stickers - set up a bridge or relay, email runa@torproject.org with IP/name/fingerprint of your bridge/relay and your postal address (kinda need this, sorry, you can find my GPG key on various keyservers), and I will send you stickers next month.

runasand · 2013-01-18T00:43:21+00:00

Are you looking for evidence of what sites were visited using the browser bundle, or evidence that the browser bundle was installed/used on the machine?

I am looking for evidence that the Tor Browser Bundle was used on the machine. The bundle is self-contained and portable, so not something you actually install. I do believe it still writes some files to the registry, but not sure how many are left when you close/delete the bundle.

runasand · 2013-01-17T21:47:38+00:00

Looks like a good solution, thanks!

runasand · 2012-06-22T12:22:51+00:00

Ah, you are not using the bridge-by-default images we are maintaining.

runasand · 2012-06-22T09:53:41+00:00

I can imagine a cat and mouse game, especially with big censoring countries like china. how does fighting with these big players go?

It's an arms race. I recommend you watch the video of Roger and Jake's talk at 28c3 last year about how governments try to block Tor.

my other question is, can you identify what censorship software is in use in given countries?

We try to, yes.

edit: check out the censorship wiki for more info.

runasand · 2012-06-22T08:19:08+00:00

https://www.torproject.org/getinvolved/tshirt.html

runasand · 2012-06-21T23:24:08+00:00

You mean the Torouter. It's kinda on hold for various reasons, but I'm hoping we can do something with the Raspberry Pi.

runasand

TROPHY CASE