Re: blocking tor is not the right way forward. It may just be the right way backward.

["Joel Jose" <joeljose420 () gmail com>]

see, its pitty how we dont understand that we are trying to defend
using the wrong principles.

just like the other poster pointed out.. protect your data == plug
holes + preserve + restore data.. != go for a witch hunt.

moreover.. we when "blocking" tor and denying access are assuming 3 things :
1) tor cannot be recreated(dont bet on that.. imagine a tor-2 network
which corrects(takes different policy measures) the blacklisting
facility, if we hold the rope so tight as to choke.. the privacy
people and the community will come up with a better and more effective
tool.. )
2) scarce resources is the way forward. Cmon public open proxies, tor
like public projects..etc are not "scarce" resource for the attacker..
but it is a scarce resource for the users... dont get fooled..
ofcourse all it takes for a determined(and well funded) attacker is
"shift" his cables to get onto a different network to attack you ;)
3)TOR is not the problem.. its a solution for privacy... it would be
much better if you try to find time to code for better webserver
protections against a dos.. or even write a patch for that new
full-disclosure vulnerability.. did i say proof-of-concept.. yikes..
;)

PS : ofcourse right now discussions are on on how to "label" / "mark"
tor users so that CIA triad is maintained for resources accessed by
tor users having different access privileges. psuedonyms are a serious
model thats being considered and researched...

joel.

On 6/4/06, Tonnerre Lombard <tonnerre.lombard () sygroup ch> wrote:
> Salut,
>
> On Sat, 2006-06-03 at 16:15 -0400, John Sprocket wrote:
> > i imagine a forensics person looks and sees a tor ip and thinks "okay.
> > i just deadended. there's nothing i can do because this is a tor exit
> > node." with a botnet, most bots can be traced back to their meeting
> > point which is a little bit more useful.
>
> The question is also whether one should actually waste one's time trying
> to figure out who actually conducted the intrusion. When one of our
> systems gets broken into, I spend my time figuring out what happened,
> which data got corrupted, and then I fix the hole the intruder used and
> rebuild the system.
>
> There isn't much use in trying to find someone to punish for the fact
> that one was running insecure software. The only legitimate thing to do
> in this situation is to fix the hole and to carry on working.
>
> If it was so easy to sue away all intruders, why would anyone ever hire
> a pentester?
>
> Anyway, I'm not sure whether this non-technical implication of a
> specific technical product should really be discussed here. It's not
> exactly a vulnerability after all, while of course the vulnerability the
> attacker used to bite Jason surely was one.
>
> Wrong end, people...
>
>                                 Tonnerre
> --
> SyGroup GmbH
> Tonnerre Lombard
>
> Loesungen mit System
> Tel:+41 61 333 80 33    Roeschenzerstrasse 9
> Fax:+41 61 383 14 67    4153 Reinach
> Web:www.sygroup.ch      tonnerre.lombard () sygroup ch


--
As soon as men decide that all means are permitted to fight an
evil, then their good becomes indistinguishable from the evil
that they set out to destroy.
                     - Christopher Dawson, The Judgment of Nations

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/