Fake Tor Project website delivers malware instead of anonymity
Posted on 14.08.2014
A computer science student has discovered an almost perfect copy of The Tor Project's website, offering malware for download instead of the Tor Browser Bundle and collecting donations that should rightfully go to Tor developers.

Tipped off about the existence of the fake website by a friend, Julien Voisin downloaded the purported Tor Browser Bundle (torbrowser-install-3.6.3_en-US.exe) and managed to reverse engineer it.

What he discovered is that the malware can be commanded to download and upload files, update itself, make screenshots, execute system commands, reboot and restart, upload directories and get drives, and launch new connections.

The communication protocol runs on a hidden service on Tor, and Voisin even managed to get in touch with the botmaster.

"She/he told me that they are a small group (maybe from China) trying to catch pedophiles; by spreading the link to the fake website on pedo-boards, adding that one pedophile was already reported to cybertip (Canadian Centre for Child Protection's tipline)," he shared, but said that he doubts the story, as "the miscreant not only shiped a malware instead of the real TBB, but also replaced the donation page with his own BTC address."

The website had, surprisingly, still online (on torbundlebrowser.org), but I guess it won't be for much longer. It's more than likely that the person(s) behind it will move it to another, equally deceptive, domain.


Credential manager system used by Cisco, IBM, F5 has been breached

Pearson VUE is part of Pearson, the world's largest learning company. Over 450 credential owners (including IT organizations such as IBM, Adobe, etc.) across the globe use the company's solutions to develop, manage, deliver and grow their testing programs.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Nov 25th