Yes, this is a weakness. Hopefully multiple alphabet soup agencies from different countries will get this idea and end up competing with each other. An arms race of diminishing returns to get a bigger chunk of the Tor network just means we'll have plenty of free Tor bandwidth on the gov't dime.
Protip: You can edit the Tor config or source code to pick geographically diverse nodes yourself.
Apologies about the "hacker" faux pas.
Anyway, you might be right about the cracker coming back with a honeypot. I wish I was a fly on the cracker's wall so I could see how this played out.
As far as gov't grey-hats go, there is definitely a turf war between agencies. Hell, even the Air Force wants a piece of the pie. God help us all!
In a separate February 2007 Cincinnati -based investigation of hackers who'd successfully targeted an unnamed bank, the documents indicate the FBI's efforts may have been detected. An FBI agent became alarmed when the hacker he was chasing didn't get infected with the spyware after visiting the CIPAV-loaded website. Instead, the hacker "proceeded to visit the site 29 more times," according to a summary of the incident. "In these instances, the CIPAV did not deliver its payload because of system incompatibility."
Seems like the FBI exploits browser vulnerabilities a la the Pwn2Own contest in order to deliver CIPAV, but CIPAV itself might not run in linux. I suspect that the FBI will have written a linux-compatible CIPAV after the quoted incident. Probably a bash or perl script so they don't have to worry about different architectures.
On a side note, there was probably some good porn on that page for the hacker to load it 30 times.
I'd be wondering why a child was playing on the freeway in the middle of nowhere.
How about: "what do you think would happen if a ball rolled out into the street in front of your car, followed by a laughing deer?"
If you're going to do it right, then you might as well run sshd on your wireless router and enforce traffic tunneling.
Oh, and make the router's sshd key-authentication only.
...better throw a port knocker on that bad boy, too.
...and make the port knocker's socket combination based off of a one-time pad.
...which was generated using diceware or a hardware random number generator.
...and send the encrypted data packets across a short wave signal like a numbers station rather than using 802.11whatever.
Or you could just realize that wireless is designed for convenience, not security. If someone's going to go through the trouble of using their GPUs to crack your key, then you've already got an adversary sophisticated enough to warrant the use of wired ethernet and a secure facility.
Systems programmers are the high priests of a low cult. -- R.S. Barton
