Tor users may have been de-anonymized due to a â€˜relay earlyâ€™ attack that spawned from February 2014 to July 4, according to The Tor Projectâ€™s blog post.
Tor is a complex network of virtual tunnels focused on privacy and anonymity of its users from surveillance.
“If this attack was in fact related to the research done by CERT/CMU for Black Hat, then – judging by the abstract the researchers wrote for their presentation – the attack did successfully deanonymize users and hidden services,” said Runa Sandvik, Tor Privacy and Security Researcher.
Tor representatives believe that the attack was a combination of two attack classes, more precisely a Sybil attack and a traffic confirmation attack.
“We know the attack looked for users who fetched hidden service descriptors, but the attackers likely were not able to see any application-level traffic,” the advisory said.
“In theory the attack could also be used to link users to their destinations on normal Tor circuits too, but we found no evidence that the attackers operated any exit relays, making this attack less likely.”
Tor users should upgrade to the most recent releases in order to mitigate future attacks until the protocol vulnerability will be closed and a new Tor browser version released.
Confirmation of the attack comes just days after Russiaâ€™s Government announced a grand-prize of $110,000 for any Russian hacker thatâ€™s able to crack Tor.