Received: from relay.hackingteam.com (192.168.100.52) by EXCHANGE.hackingteam.local (192.168.100.51) with Microsoft SMTP Server id 14.3.123.3; Mon, 13 Apr 2015 21:13:33 +0200 Received: from mail.hackingteam.it (unknown [192.168.100.50]) by relay.hackingteam.com (Postfix) with ESMTP id 5238260063 for <d.vincenzetti@mx.hackingteam.com>; Mon, 13 Apr 2015 19:50:50 +0100 (BST) Received: by mail.hackingteam.it (Postfix) id A551B2BC228; Mon, 13 Apr 2015 21:13:33 +0200 (CEST) Delivered-To: d.vincenzetti@hackingteam.com Received: from manta.hackingteam.com (manta.hackingteam.com [192.168.100.25]) by mail.hackingteam.it (Postfix) with ESMTP id 92E292BC031 for <d.vincenzetti@hackingteam.com>; Mon, 13 Apr 2015 21:13:33 +0200 (CEST) X-ASG-Debug-ID: 1428952411-066a757fe5c4ca0001-cjRCNq Received: from smtp-out-08.c2kmail.it (smtp-out-08.comm2000.it [212.97.32.78]) by manta.hackingteam.com with ESMTP id 0bpTKApGpiN5fgTD for <d.vincenzetti@hackingteam.com>; Mon, 13 Apr 2015 21:13:31 +0200 (CEST) X-Barracuda-Envelope-From: stefano@quintarelli.it X-Barracuda-Apparent-Source-IP: 212.97.32.78 Received: from [192.168.255.102] (5-157-115-232.v4.ngi.it [5.157.115.232]) by smtp-out-08.c2kmail.it (Postfix) with ESMTPA id 5D49E4212A0 for <d.vincenzetti@hackingteam.com>; Mon, 13 Apr 2015 21:13:31 +0200 (CEST) Message-ID: <552C155A.2030609@quintarelli.it> Date: Mon, 13 Apr 2015 21:13:30 +0200 From: Stefano Quintarelli <stefano@quintarelli.it> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 To: David Vincenzetti <d.vincenzetti@hackingteam.com> Subject: Re: What TRAFFIC flows THRU TOR? References: <90DD0C5833BC9B4A82058EA5E32AAD1BA7AB4A@EXCHANGE.hackingteam.local> <552C1074.1080309@quintarelli.it> <74C95B01-518B-4ECC-AEE4-86106D330063@hackingteam.com> X-ASG-Orig-Subj: Re: What TRAFFIC flows THRU TOR? In-Reply-To: <74C95B01-518B-4ECC-AEE4-86106D330063@hackingteam.com> X-Barracuda-Connect: smtp-out-08.comm2000.it[212.97.32.78] X-Barracuda-Start-Time: 1428952411 X-Barracuda-URL: http://192.168.100.25:8000/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at hackingteam.com X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.00 X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=3.5 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=8.0 tests=BSF_SC5_SA210e X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.17877 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 BSF_SC5_SA210e Custom Rule SA210e Return-Path: stefano@quintarelli.it X-MS-Exchange-Organization-AuthSource: EXCHANGE.hackingteam.local X-MS-Exchange-Organization-AuthAs: Internal X-MS-Exchange-Organization-AuthMechanism: 10 Status: RO MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--boundary-LibPST-iamunique-1345765865_-_-" ----boundary-LibPST-iamunique-1345765865_-_- Content-Type: text/plain; charset="utf-8" vediamo se mi spiego... sto lavorando con gli interni per la legge sulle intercettazioni li' si disciplinera' molto. li' ci sara' scritto: per i reati x,y, si puo' fare B; per w e z si puo' fare C se non c'e' scritto, non si puo' fare. ora, essendo che l'interesse del legislatore e' fare il bene della collettivita', ed essendo io (legislatore) preoccupato dall'uso di tor e VPN varie, se mi dici che cosa e' abilitato dai tuoi tools, io posso suggerire che tale funzione sia prevista. neutralizzare e' troppo generico. puo' voler dire che ci leggi dentro, che blocchi la comunicazione, che la rendi inutilizzabile, ecc. se vuoi dirmi cosa intendi per "neutralizzare", io posso suggerire che sia incluso. senno', amen. (e la prossima volta che si torna sulla legge, dopo questo giro, sara' nella prossima legislatura..) ciao!, s. On 13/04/2015 21:05, David Vincenzetti wrote: > E’ una cosa nuova, totalmente nuova, come lo era la sicurezza offensiva > nel 2013 quanto ho fondato Hacking Team. > > Sembra black magic, sembra una cosa impossibile — > http://en.wikipedia.org/wiki/Clarke's_three_laws : la TERZA legge, my > friend :-) > > Cheers, > David > > -- > David Vincenzetti > CEO > > Hacking Team > Milan Singapore Washington DC > www.hackingteam.com <http://www.hackingteam.com> > > email: d.vincenzetti@hackingteam.com > mobile: +39 3494403823 > phone: +39 0229060603 > > >> On Apr 13, 2015, at 8:52 PM, Stefano Quintarelli >> <stefano@quintarelli.it <mailto:stefano@quintarelli.it>> wrote: >> >> ma intendi bloccare o intercettare o cosa ? >> sto lavorando con gli interni su questo genere di cose e la facolta' >> va prevista normativamente. >> non possiamo scrivere un generico "neutralizzare" >> >> On 13/04/2015 14:58, David Vincenzetti wrote: >>> Innovation, my old friend! >>> >>> >>> DV >>> -- >>> David Vincenzetti >>> CEO >>> >>> Sent from my mobile. >>> >>> ----- Original Message ----- >>> From: Stefano Quintarelli [mailto:stefano@quintarelli.it] >>> Sent: Monday, April 13, 2015 01:29 PM >>> To: David Vincenzetti >>> Subject: Re: What TRAFFIC flows THRU TOR? >>> >>> questo invece lo condivido.. ;-) >>> ma cosa intendi per "neutralizzare" ? >>> >>> On 10/04/2015 03:47, David Vincenzetti wrote: >>>> [ I dedicate this posting to my dearest friends, the privacy >>>> activists:-) — In truth, the most prominent of them are just smart >>>> businessmen making hefty money by astutely exploiting the Big Brother Is >>>> Watching You FUD (Fear, Uncertainty and Doubt) phenomenon. ] >>>> >>>> >>>> Good morning gents, >>>> >>>> The day before yesterday I posted the following: >>>> >>>> ~ >>>> >>>> /“Evolution” was interesting. / >>>> / >>>> / >>>> /It was acting as a trusted middle man between two anonymous users. >>>> A trusted third party between the seller and the acquirer. Possibly >>>> keeping the acquirer’s money in an escrow account until the seller >>>> has actually complied with his nefarious obligations. Yes it was >>>> interesting, and handy too, and used by countless bad guys. Now it’s >>>> gone. Or moved to a different location with a different name. Or >>>> further evolved. Make no mistake: the DARKNET is growing, and >>>> growing very fast, not shrinking./ >>>> / >>>> / >>>> /*The DARKNET is your enemy. TOR is your enemy. ENCRYPTION is your >>>> enemy. The DARKNET Is where Jihadists make their plots. It is where >>>> criminals of all sorts sell weapons (how nice: you will receive your >>>> gun piece by piece sent to different locations), illegal drugs, >>>> "personal assault" services. In the DARKNET you will find recipes >>>> for lethal poisons, for a dirty bomb, for a terrorist action. For >>>> evil.*/ >>>> / >>>> / >>>> /The DARKNET (and TOR, and ENCRYPTION) CAN BE NEUTRALIZED. WITHOUT >>>> agents. WITHOUT infecting your targets. A novel technology? >>>> Definitely. / >>>> / >>>> / >>>> /*The DARKNET should be neutralized in your jurisdiction.* The >>>> right technology exists. Rely on us./ >>>> / >>>> / >>>> / >>>> / >>>> / >>>> / >>>> /From >>>> http://thehackernews.com/2015/03/evolution-drug-market-bitcoin.html >>>> , FYI,/ >>>> /David/ >>>> / >>>> / >>>> >>>> >>>> /Deep Web Drug Market Disappeared suddenly Overnight, $12 Million >>>> in Bitcoin Missing/ >>>> <http://thehackernews.com/2015/03/evolution-drug-market-bitcoin.html> >>>> >>>> /Wednesday, March 18, 2015Mohit Kumar >>>> <http://thehackernews.com/p/authors.html>/ >>>> >>>> */ >>>> /* >>>> >>>> */ >>>> /* >>>> >>>> // >>>> >>>> >>>> […] >>>> ~ >>>> >>>> >>>> And THEN I received a number of sharp rebukes, to say the least. That’s >>>> why I am REPOSTING this 2013 account by the MIT Technology Review which >>>> clearly SHOWS WHAT type of TRAFFIC REALLY FLOWS THROUGH the TOR >>>> NETWORK. >>>> >>>> >>>> "/*The Tor anonymity network is championed as a tool for freedom of >>>> speech and anonymity. But the reality is depressingly different*, say >>>> internet researchers who have analysed the network’s traffic using a >>>> security flaw."/ >>>>> >>>> >>>> [ FURTHER, recommended reading: the original paper: please go to: >>>> http://arxiv.org/pdf/1308.6768v2.pdf ] >>>> >>>> >>>> Have a great day, >>>> David >>>> >>>> >>>> >>>> >>>>> Begin forwarded message: >>>>> >>>>> *From: *David Vincenzetti <vince@hackingteam.it >>>>> <mailto:vince@hackingteam.it> >>>>> <mailto:vince@hackingteam.it>> >>>>> *Subject: **Security Flaw Shows Tor Anonymity Network Dominated By >>>>> Botnet Command And Control Traffic* >>>>> *Date: *September 12, 2013 at 4:20:05 AM GMT+2 >>>>> *To: *"list@hackingteam.it <mailto:list@hackingteam.it> >>>>> <mailto:list@hackingteam.it>" >>>>> <list@hackingteam.it <mailto:list@hackingteam.it> >>>>> <mailto:list@hackingteam.it>> >>>>> >>>>> VERY depressing! >>>>> >>>>> " “*The most popular…addresses are command and control centers of >>>>> botnets and resources serving adult content*,” conclude Biryukov >>>>> and co." >>>>> >>>>> From yesterday's MIT Technology Review, also available at >>>>> http://www.technologyreview.com/view/519186/security-flaw-shows-tor-anonymity-network-dominated-by-botnet-command-and-control/ >>>>> , FYI, >>>>> David >>>>> >>>>> >>>>> >>>>> September 11, 2013 >>>>> >>>>> >>>>> Security Flaw Shows Tor Anonymity Network Dominated By Botnet >>>>> Command And Control Traffic >>>>> >>>>> /The Tor anonymity network is championed as a tool for freedom of >>>>> speech and anonymity. But the reality is depressingly different, say >>>>> internet researchers who have analysed the network’s traffic using a >>>>> security flaw / >>>>> >>>>> >>>> >>>> >>>> >>>> >>>>> The Tor network is an online service that allows users to surf the web >>>>> anonymously. Its main benefit is to reduce the chances of network >>>>> surveillance discovering a user’s location or web usage. For that >>>>> reason it is championed as an important tool for promoting free speech >>>>> and protecting personal privacy, especially for people under >>>>> authoritarian regimes such as that in China. >>>>> >>>>> However, Tor is also often criticised for carrying illegal, shady or >>>>> controversial content such as pornography and “Silk Road” traffic for >>>>> illegal goods. So an interesting question is what kind of traffic >>>>> prevails? >>>>> >>>>> Today, we get an answer thanks to the work of Alex Biryukov, Ivan >>>>> Pustogarov and Ralf-Philipp Weinmann at the University of Luxembourg. >>>>> And the results are not as eye-sparklingly freedom-protecting as you >>>>> might imagine. >>>>> >>>>> These guys conclude that the Tor network is dominated by botnet >>>>> traffic and that much of the rest is adult content and traffic related >>>>> to black market and illegal goods. >>>>> >>>>> First up, if Tor is so anonymous, how did these guys get their data? >>>>> It turns out that until recently, the Tor protocol contained a flaw >>>>> that allowed anybody in the know to track users back to their origin. >>>>> >>>>> This flaw was actually discovered by Biryukov, Pustogarov and Weinmann >>>>> earlier this year and immediately corrected by Tor. However, before >>>>> the flaw became public, these guys took the opportunity to analyse Tor >>>>> traffic to see where it came from and what it contained. >>>>> >>>>> On 4 February, they collected some 39,000 unique addresses offering >>>>> Tor content. They then estimated the popularity of each address and >>>>> classified its content. In particular, they roughly divided the >>>>> addresses into two groups: those providing illegal content or shady >>>>> services and those providing other hidden services, such as freedom of >>>>> speech and the anonymous search engine DuckDuckGo. >>>>> >>>>> The results are eye-opening. Biryukov and co say the number of >>>>> addresses devoted to legal and not-so-legal content is about equal. >>>>> “Among Tor hidden services one can even find a chess server,” they say. >>>>> >>>>> But a different picture emerges when it comes to the relative >>>>> popularity of these services. Of the top twenty most popular Tor >>>>> addresses, eleven are command and control centres for botnets, >>>>> including all of the top five. Of the rest, five carry adult content, >>>>> one is for Bitcoin mining and one is the Silk Road marketplace. Two >>>>> could not be classified. >>>>> >>>>> The FreedomHosting address is only the 27^th most popular address >>>>> while DuckDuckGo is the 157^th most popular, according to this >>>>> analysis. >>>>> >>>>> “The most popular…addresses are command and control centers of botnets >>>>> and resources serving adult content,” conclude Biryukov and co. >>>>> >>>>> That’s a depressing picture but perhaps it’s the price humanity has to >>>>> pay for freedom of speech. >>>>> >>>>> Discuss—anonymously or not—in the comments section below. >>>>> >>>>> Ref: arxiv.org/abs/1308.6768 <http://arxiv.org/abs/1308.6768> >>>>> <http://arxiv.org/abs/1308.6768>: Content >>>>> And Popularity Analysis Of Tor Hidden Services >>>>> >>>>> -- >>>>> David Vincenzetti >>>>> CEO >>>>> >>>>> Hacking Team >>>>> Milan Singapore Washington DC >>>>> www.hackingteam.com <http://www.hackingteam.com> >>>>> <http://www.hackingteam.com/> >>>>> >>>> >>>> Nessun virus nel messaggio. >>>> Controllato da AVG - www.avg.com <http://www.avg.com> >>>> <http://www.avg.com> >>>> Versione: 2015.0.5863 / Database dei virus: 4328/9503 - Data di >>>> rilascio: 10/04/2015 >>>> >>> >>> >>> ----- >>> Nessun virus nel messaggio. >>> Controllato da AVG - www.avg.com <http://www.avg.com> >>> Versione: 2015.0.5863 / Database dei virus: 4328/9525 - Data di >>> rilascio: 13/04/2015 >>> > > Nessun virus nel messaggio. > Controllato da AVG - www.avg.com <http://www.avg.com> > Versione: 2015.0.5863 / Database dei virus: 4331/9530 - Data di > rilascio: 13/04/2015 > ----boundary-LibPST-iamunique-1345765865_-_---