Tor is a network overlay designed to enable anonymous browsing and data exchange over the internet. While the "darknet" promises freedom from surveillance, determined agencies can sometimes breach its complex layers to uncover the true identities of individuals.
According to the German news source Tagesschau, local law enforcement recently arrested four individuals in connection with a ransomware operation and the hosting of child sex abuse material (CSAM) on servers hidden within Tor. These suspects used Tor to conceal their activities, but authorities managed to track and apprehend them.
Investigators employed a technique known as a "timing analysis" attack, which involved monitoring Tor nodes over an extended period. By analyzing connections between darknet servers and local internet sources, they were able to identify the suspects. This case highlights that law enforcement agencies are actively surveilling hidden servers on the Tor network.
During the investigation, authorities took control of a Tor address linked to a ransomware group, redirecting its traffic to a page that blocked access to stolen, encrypted files. Through timing analysis, they eventually identified "Andres G," a key individual behind an .onion site known as "Boystown."
While details about the timing analysis technique remain limited, developers from the Tor Project pointed out that one of the suspects was using an outdated version of Ricochet, a decentralized Tor-based messaging app. This version lacked protection against timing analysis, leaving the user vulnerable to a guard discovery attack. A new version, Ricochet-Refresh, has since been released to address these privacy concerns.
Tor developers also emphasized that users can only access Onion services from within the Tor network, making exit node monitoring irrelevant. The Tor network itself has continued to expand, with over 2,000 new exit nodes becoming operational in recent years. These exit nodes are the final point of connection before users access the clearnet.
A Tor developer commented, "While many questions remain unanswered, one thing is certain: Tor users can still rely on Tor Browser to browse the web securely and anonymously."
