Fake Tor Project website delivers malware instead of anonymity
Posted on 14.08.2014
A computer science student has discovered an almost perfect copy of The Tor Project's website, offering malware for download instead of the Tor Browser Bundle and collecting donations that should rightfully go to Tor developers.

Tipped off about the existence of the fake website by a friend, Julien Voisin downloaded the purported Tor Browser Bundle (torbrowser-install-3.6.3_en-US.exe) and managed to reverse engineer it.

What he discovered is that the malware can be commanded to download and upload files, update itself, make screenshots, execute system commands, reboot and restart, upload directories and get drives, and launch new connections.

The communication protocol runs on a hidden service on Tor, and Voisin even managed to get in touch with the botmaster.

"She/he told me that they are a small group (maybe from China) trying to catch pedophiles; by spreading the link to the fake website on pedo-boards, adding that one pedophile was already reported to cybertip (Canadian Centre for Child Protection's tipline)," he shared, but said that he doubts the story, as "the miscreant not only shiped a malware instead of the real TBB, but also replaced the donation page with his own BTC address."

The website had, surprisingly, still online (on torbundlebrowser.org), but I guess it won't be for much longer. It's more than likely that the person(s) behind it will move it to another, equally deceptive, domain.









Spotlight

Free security software identifies cloud vulnerabilities

Posted on 21 October 2104.  |  Designed for IT and security professionals, the service gives a view of the data exchanged with partner and cloud applications beyond the network firewall. Completely passive, it runs on non-production systems, and does not require firewall changes.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Tue, Oct 21st
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //