Copyright © 2007-2011, n3t-t3z Team
Tor Logs Activity but Noone Seems to Care Wipe out these following paths-files out on a regular basis before and after using Tor, \\Tor Browser\\FirefoxPortable\\App\\Firefox\\|removed-files" \\Tor Browser\\FirefoxPortable\\App\\Firefox\\|updater.exe" \\Tor Browser\\FirefoxPortable\\App\\Firefox\\|updater.ini" \\Tor Browser\\FirefoxPortable\\App\\Firefox\\|update-settings.ini" \\Tor Browser\\FirefoxPortable\\App\\Firefox\\searchplugins\\|*.*" \\Tor Browser\\FirefoxPortable\\Data\\profile\\chromeappsstore.sqlite" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|cookies.sqlite" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|cookies.sqlite-shm" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|cookies.sqlite-wal" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|formhistory.sqlite" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|mozilla-media-cache\\|*.*" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|places.sqlite-shm" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|places.sqlite" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|places.sqlite-wal" \\Tor Browser\\FirefoxPortable\\Data\\profile\\bookmarkbackups\\|*.*" \\Tor Browser\\FirefoxPortable\\Data\\profile\\|signons.sqlite" \\Tor Browser\\FirefoxPortable\\Data\\profile\\startupCache\\|*.*" HERE IS ONE OF THE BLEACH LOGS I’VE SAVED! CLEANING COMPLETE - (24.790 secs) -------------------------------------------------- 18.1MB removed. Secure file deletion enabled - Gutmann (35 passes) -------------------------------------------------- Details of files deleted -------------------------------------------------- IE Temporary Internet Files (2 files) 5.02MB C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat 16.00KB C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\????????.default\formhistory.dat 231 bytes C:\Documents and Settings\Owner\Recent\Desktop.ini 150 bytes C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\index.dat 16.00KB C:\Documents and Settings\Owner\Local Settings\Temp\History\History.IE5\desktop.ini 145 bytes C:\Documents and Settings\Owner\Local Settings\Temp\History\History.IE5\index.dat 16.00KB C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\0N0N8WJW\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\AWBOPSUS\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\DCLCVC6R\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat 16.00KB C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\SYEUN7FZ\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\????????.default\XPC.mfl 5.13KB C:\Documents and Settings\Owner\Cookies\index.dat 16.00KB C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\AEU3LWKW\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat 16.00KB C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\K1DTPJAP\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\L813DZKE\desktop.ini 67 bytes C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\MIKM0AVL\desktop.ini 67 bytes C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\cookies.sqlite 0.50MB C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\formhistory.sqlite 0.19MB C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\places.sqlite 10.0MB C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\bookmarkbackups\bookmarks-2014-07-24.json 3.06KB C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\signons.sqlite 0.31MB C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\startupCache\startupCache.4.little 1.87MB C:\Documents and Settings\Owner\Desktop\TOR\Tor Browser\FirefoxPortable\Data\profile\chromeappsstore.sqlite 96.00KB C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\????????.default\history.dat 378 bytes -------------------------------------------------- Regarding the blackout of \Firefox\Profiles\????????.default\ ????????.default = eight unique numbers that identify each firefox user This is just standard Mozilla Firefox, btw. Not Tor. THE TOR CACHE LOGS THAT WERE BLEACHED ARE SEPERATED BELOW! • cookies.sqlite---------------0.50MB • formhistory.sqlite-----------0.19MB • places.sqlite----------------10.0MB • bookmarks-2014-07-24.json----3.06KB • signons.sqlite---------------0.31MB • startupCache.4.little--------1.87MB • chromeappsstore.sqlite-------96.00KB The point being that Tor Browser still collects history logs and cookies just like any other web browser. Here is a link to a report about the dangers of cookie-cache logging, http://news.cnet.com/8301-1009_3-57606178-83/nsa-tracks-google-ads-to-find-tor-users/ “The NSA then cookies that ad, so that every time you go to a site, the cookie identifies you. Even though your IP address changed [because of Tor], the cookies gave you away.” In the NSA document titled “tor stinks” analysists admit one major way to identify a targeted Tor connection is by tracking the cookies (and evercookie.sol - which is an Adobe Flashplayer zombie cookie.) “Use cookies to identify Tor users when they are not using Tor.” “Investigate Evercookie persistence.” http://cryptome.org/2013/10/nsa-tor-stinks.pdf My conclusion: most zero-day exploits against Tor still rely on rather simple exploitation of third-party marketed cache , unless that is to say those Black Hat hackers found a BACKDOOR implanted by an insider, or they discovered undercover agencies hosting a machine-infecting relay. Never-the-less, forward secrecy and offline storage is still the best way to remain anonymous.
Copyright © 2007-2011, n3t-t3z Team