Security researchers from German antivirus vendor G Data Software have identified a botnet that is controlled by attackers from an Internet Relay Chat (IRC) server running as a hidden service inside the Tor anonymity network.
This strategy offers several advantages to the botnet's operators, but also some disadvantages, the G Data researchers said Monday in a blog post.
LastPass has added two new security features to its popular online password management system; access via TOR (The Onion Router) has been disabled and users can now limit logins to specific countries.
Premium users of the system can already enable two-factor authentication (or limit access to specific computers) as well as increase SHA-256 iterations to confuse brute-forcing of passwords but the company hopes that outlawing access via the anonymising TOR system will cut off another avenue of attack.
Cyberoam, a maker of appliances designed to secure sensitive networks, said it has issued an update to fix a flaw that could be used to intercept communications sent over the TOR anonymity network.
Recently released documents detail the federal government's inability to pursue cybercriminals shrouded by the tricky anonymity tools used by the Silk Road marketplace and other darknet sites - tools which are funded in part by the federal government itself. In this particular case, a citizen reported stumbling upon a cache of child pornography while browsing the anonymous Tor network's hidden sites, which are viewable with specialized, but readily available, tools and the special .onion domain.
The Tor Project is tapping Amazon's EC2 cloud service to make it easier for volunteers to donate bandwidth to the anonymity network.
Developers with the project have released preconfigured Tor Cloud images that volunteers can use to quickly deploy bridges that allow users to access the service. The new system is designed to take some of the pain out running such Tor relays by reducing the work and cost of deploying and running the underlying hardware and software.
