I read in this article that the FBI was able to crack the anonymity of Tor.

From what I heard and read, onion routing makes it almost impossible to de-anonymize a user.

The last time I heard anyone trying to crack Tor was the NSA and it did not succeed or at least they did not publicly advertise it (The article was 2 to 3 years old now and may not be that relevant anymore).

Do anyone have any insights on how the FBI might have done it?

  • 9
    They didn't break the technology, just ran a lot of tor nodes. Commented Mar 31, 2016 at 19:45
  • 3
    If you control enough nodes you can crack TORs anonymity.
    – AstroDan
    Commented Mar 31, 2016 at 19:46
  • 2
    An Ars article from late 2014 suggests that flash attacks have been used as early as 2006, making the "never before seen technique" line in this article a bit suspect: arstechnica.com/security/2014/12/…
    – Jeff Meden
    Commented Mar 31, 2016 at 20:22
  • 1
    I think the ibtimes article may be wrong. They're confusing the new attacks with the malware attacks. They cite a Motherboard article which goes into the history of malware attacks.
    – mgjk
    Commented Mar 31, 2016 at 20:29
  • 2
    Yes, the malware attack was simple. An error in the site let them deanonymize the hidden service, once captured, they ran the site to target the users and included a flash-based callback which would be able to gather info from the local system such as MAC andIP. The second, newer form of attack is against the network itself and is much more complex... check out the 32c3 video in my answer.
    – mgjk
    Commented Mar 31, 2016 at 20:39

3 Answers 3


The article you link says that the FBI obtained "the MAC address" for the user computers. MAC addresses are specific to each ethernet hardware, and they don't travel beyond the first hop -- meaning that they are visible to your home router, possibly the one provided by the ISP, but not beyond. If that specific piece of information is true, then this means that the FBI really deployed a piece of malware on the site, and the users simply got it on their computer.

After all, the FBI first seized the offending site and ran it, at which point they had full control over its contents. People using Tor to access a child pornography site are not necessarily smarter than average people, and they would intrinsically "trust" that site, making malware deployment possible, even easy.

Tor anonymity relies on the idea that potential attackers (the FBI in that case) cannot control sufficiently many nodes to make correlations possible. However, that "sufficiently many" is not that big a number; if one of your connections, even temporarily, goes through an "entry node" controlled by the attacker, and the same attacker can see what happens on the exit (and he can, if he actually hosts the target site), then correlation is relatively easy (through both timing of requests and size of packets, because encryption does not hide size). With control of the target site, it would be even possible to change the size of individual response packets to help correlation.

However, Tor does nothing against hostile code sent to the user and executed by the user, and if the MAC address was recovered then such code was involved.

  • 3
    "Tor anonymity relies on the idea that potential attackers (the FBI in that case) cannot control sufficiently many nodes to make correlations possible." This is tor cracking in a nutshell; there have been several exploits against flaws in the protocol to allow attackers to do this against users and against hidden services, with a shockingly small number of cleverly configured nodes.
    – Jeff Meden
    Commented Mar 31, 2016 at 20:13
  • @JeffMeden I believe there has only been one such attack, the RELAY_EARLY attack. There were others which allowed guard discovery that required very few relays, though.
    – forest
    Commented Apr 25, 2022 at 22:47

The article you posted states how they did it. But the author doesn't seem to be knowledgeable on the subject and it got lost in the article. They didn't crack Tor and more so found a way to collect analytics that didn't go through Tor's network.

First the FBI confiscated the servers running the child porn ring on Tor known as Playpen.

After seizing the computer server running Playpen from a web host in Lenoir, North Carolina, in February 2015, the FBI decided to run the child pornography web site from its own servers in Newington, Virginia, for an additional two weeks between 20 February and 4 March of that year.

They then ran the site with a Flash embed on the page. The Flash application was not hosted via Tor. And connected through traditional means such as HTTP or sockets. When establishing these connections it bypasses Tor completely. The Flash application then collected the information from the user. As far as getting a MAC address I cannot verify the claims. This could either be the FBI blowing smoke or they could of exploited a vulnerability in Flash player to accomplish this. Unlike JavaScript, Flash is not sandboxed and has the potential to gather more information from the machine which has resulted in quite a few CVEs. The FBI has also utilized this method known as a NIT (network investigative technique/toolkit) in the past.

When visitors accessed the website, although their traffic might have been encrypted, a Flash application was secretly installed on the user's computer that quietly sent important data about the user straight to the FBI so that it did not pass through the Tor network at all, according to Motherboard Vice.

  • Hi @BradMetcalf what means CVE?
    – Andy K
    Commented Apr 1, 2016 at 4:58
  • 1
    @AndyK Common Vulnerability and Exposures. When a vulnerability is discovered it may be issued a CVE ID to track/reference it. Searching up CVE DB on Google will bring up several vulnerability databases which track these IDs. en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
    – Bacon Brad
    Commented Apr 1, 2016 at 5:05

Nobody's sure at this point because the details haven't been released. There's a lot of suspicion that this has to do with methods Carnage Melon developed back in late 2014 and executed mid-2015.


There were weaknesses fixed in mid-2015, but there are some weaknesses which are very difficult to protect against (e.g., traffic analysis attacks). It's not so easy to control the majority of the Tor network, so it's not easy to answer "what is the identity of this visitor?", but using these attacks, it was easy to answer "give me a list of some of the IPs communicating with this hidden service".


"It also requires the attacker to have previously collected unique network characteristics that can serve as a fingerprint for that particular service."

My understanding is that the July 2015 fix was to address those weaknesses.

Tor is on shaky ground though, this Blackhat talk late 2014 was pulled mysteriously... then things went nuts in 2015:


"In our analysis, we've discovered that a persistent adversary with a handful of powerful servers and a couple gigabit links can de-anonymize hundreds of thousands Tor clients and thousands of hidden services within a couple of months."

7:26 of Dec 2015 "state of the onion" goes into some of this:


Not the answer you're looking for? Browse other questions tagged .