Treasury Department blames Tor for increased cyberattacks

The majority of bank account hijackings over the past decade used the Tor privacy service to hide thieves’ locations, according to a US Treasury Department report obtained by KrebsOnSecurity reporter Brian Krebs. The non-public report said the heists could have been prevented had financial institutions noticed that the accounts were being accessed over Tor IP addresses, according to an article Krebs published Friday. The report, which was produced by the Financial Crimes Enforcement Network, was based on a review of so-called suspicious activity reports (SARs) filed by banks. Krebs wrote: “Analysis of these documents found that few filers were aware of the connection to Tor, that the bulk of these filings were related to cybercrime, and that Tor related filings were rapidly rising,” the report concluded. “Our BSA [Bank Secrecy Act] analysis of 6,048 IP addresses associated with the Tor darknet [link added] found that in the majority of the SAR filings, the underlying suspicious activity—most frequently account takeovers—might have been prevented if the filing institution had been aware that their network was being accessed via Tor IP addresses.”