Slashdot Mirror
Spoiled Onions: Exposing Malicious Tor Exit Relays
An anonymous reader points out this recently published study (PDF) on detecting malicious (or at least suspicious) Tor exit relays. From their conclusions: "After developing a scanner, we closely monitored all ~1000 exit relays over a period of four months. Wed discovered 25 relays which were either outright malicious or simply misconfigured. Interestingly, the majority of the attacks were coordinated instead of being isolated actions of independent individuals. Our results further suggest that the attackers made an active effort to remain under the radar and delay detection."
One of the authors, Philipp Winter, wrote a followup blog post to help clarify what the paper's findings mean for Tor users, including this clarification: "First, it's important to understand that 25 relays in four months isn't a lot. It is ultimately a very small fraction of the Tor network. Also, it doesn't mean that 25 out of 1,000 relays are malicious or misconfigured (we weren't very clear on that in the paper). We have yet to calculate the churn rate of exit relays which is the rate at which relays join and leave the network. 1,000 is really just the approximate number of exit relays at any given point in time. So the actual number of exit relays we ended up testing in four months is certainly higher than that. As a user, that means that you will not see many malicious relays 'in the wild."
So, they tested around 1000 tor exit nodes, but actually tested many more? 25 of those node might have been malicious or maybe just misconfigured?
What?
If you want news from today, you have to come back tomorrow.
...relay to be compromised to remove the entire point of using Tor, it's certainly besides the point how high the churn rate or how low the chances are, isn't it?
hookers and grits.
if you can monitor all exit relays?
Scientists detect "spoiled onions" trying to sabotage Tor privacy network
Rogue Tor volunteers perform attacks that try to degrade encrypted connections.
http://arstechnica.com/securit...
I am kind of surprised by how small the Tor network is. Only 1000 exit relays? Guess I'll spin up a few.
This is a followup on http://yro.slashdot.org/story/... but the only new content is the blog posting.
This is case in point of how using Tor is only one part of your security/encryption/privacy toolbox. Watching out for certificate errors is critical to staying safe on the internet, as is making sure you are using end-to-end encryption. Using Tor might hide you from your own ISP, but now we know it may not be good enough privacy.
We have yet to calculate the churn rate of exit relays which is the rate at which relays join and leave the network. 1,000 is really just the approximate number of exit relays at any given point in time. So the actual number of exit relays we ended up testing in four months is certainly higher than that.
IOW, at any given time, you've got ~0.25% chance to be routed through a bad exit node.
I still think Exit Relays should be turned on by default.
Anyone smart enough setting these up will KNOW how to set them up in the first place.
Those that won't will never enable it in the first place, which considerably limits how secure Tor can be. (it'd be trivial for someone with loads of money to make transparent onion routers that scrape everything. I'd hardly be surprised if many of hundreds already are now)
Sure, some people will be screwed over for running servers on their non-business lines, but there is a good chance well over half of those people likely already do nefarious things on their connections, according to the terms.
ISPs only give a damn if that nefarious usage goes beyond a threshold that impacts others connections.
All it'd need to do is detect the upload speed as it connects to other routers and then set a max of say 10% the upload speed, or a max bitrate of X MBytes, whatever is reached first. (don't want to use TOO much just in case people also have bandwidth limits and they might not know)
Of course, a problem with that is it is also pretty sneaky.
It is a double-edged sword that only education will really solve. But the problem with that is most people on the internet are outright thick, not even not used to computing, just straight thickos unwilling to learn anything. These are the types that torrent through Tor like morons and clog everything up.
I wish someone would make a decent Torrenting program with forced onion routing so they'd all beat it over there instead. Fund it Tor developers, fund it hard. For the network.
I was my companies "abuse" department for several years. I processed loads of DMCA complaints, DNS Amplification attacks, NTP reflection attacks, spam, DOS, DDOS, phishing, etc.. In regards to TOR exit nodes most network Admins want them OFF their networks. They invite a lot of unwanted traffic not to mention attention from law enforcement if they're repeatedly used in attacks. TOR is a great way to remain anonymous. However, it's abused badly. Here's the skinny. YOU might by anonymous but your TOR provider isn't. They lease ip's from someone else. The person owning those ip's receives the complaints. They pass them on to the leaser. The leaser "knows" who's using their service( you ). If the pressure from law enforcement is strong enough you can bet you they'll provide them as much info to contact you. From there? Anything can happen. So behave or be smart or be both.
Hardly. People would just use Freenet or Gnunet instead.
From the very first days of Tor I've assumed that at least one, and probably several different agents (legal and illegal, gov't and private) would be smart or at least interested enough to run a significant percentage of Tor hosts. This is akin to Willie Sutton's reasoning for why he robbed banks - "That's where the money is." Since Tor is of most interest to folks who want to keep things private, that's where people who want to know private things are sure to lurk. In the case of NSA, it's worth doing just in case they can _someday_ decrypt data going through. This would work best when some significant percentage of hosts is 'owned', which would allow those hosts to cooperate in determining the true path for some fraction of the data going through.
For a made-up example, assuming 1/3 of all Tor hosts are compromised in one way or another and preserve or report the data, the incoming and outgoing routes to the agent. If those hosts are optimally situated worldwide, they will on some occasions (often?) comprise a sufficiently large portion of the onion route between two 'bad actors', so that various techniques such as timing comparisons will assist in filling in the blanks and some, if not all, of the useful information will be exposed.
Then there are the possibilities of deeper hacks into apparently legitimate Tor hosts, which NSA is known to be capable of.
I'm just speculating, but if I, a relatively security-naive person can come up with these thoughts, I'm sure that folks who specialize in this could come up with better ones.
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
"giantbuttplugs.info" he said, using it as a metasyntactic variable.
So I says to myself, "who the fuck would register that?" Then I says to myself, "it's the internet, someone must be using it." .gov, .info, .org, .mil, .net are all available.
The .com is taken.
Domain Name: giantbuttplugs.com
Registry Domain ID:
Registrar URL: http://www.fabulous.com/
Updated Date: 2013-06-30T17:14:35Z
Creation Date: 2006-08-16T02:14:40Z
Registrar Registration Expiration Date: 2014-08-16T00:00:00Z
Registrar: FABULOUS.COM PTY LTD.
Registrar IANA ID: 411
Registrar Abuse Contact Email: abuse@fabulous.com
Registrar Abuse Contact Phone: +61.730070015
Reseller: N/A
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Registry Registrant ID: N/A
Registrant Name: Domain Admin
Registrant Organization: Sunlane Media LLC
Registrant Street: PO Box 231789
Registrant City: Encinitas
Registrant State/Province: CA
Registrant Postal Code: 92024
Registrant Country: US
Registrant Phone: +1.877 849 6203
Registrant Phone Ext: N/A
Registrant Fax: +1.877 849 6203
Registrant Fax Ext: N/A
Registrant Email: fabulous@sunlane.com
Registry Admin ID: N/A
Admin Name: Domain Admin
Admin Organization: Sunlane Media LLC
Admin Street: PO Box 231789
Admin City: Encinitas
Admin State/Province: CA
Admin Postal Code: 92024
Admin Country: US
Admin Phone: +1.877 849 6203
Admin Phone Ext: N/A
Admin Fax: +1.877 849 6203
Admin Fax Ext: N/A
Admin Email: fabulous@sunlane.com
Registry Tech ID: N/A
Tech Name: Domain Admin
Tech Organization: Sunlane Media LLC
Tech Street: PO Box 231789
Tech City: Encinitas
Tech State/Province: CA
Tech Postal Code: 92024
Tech Country: US
Tech Phone: +1.877 849 6203
Tech Phone Ext: N/A
Tech Fax: +1.877 849 6203
Tech Fax Ext: N/A
Tech Email: fabulous@sunlane.com
Name Server: ns1.fabulous.com
Name Server: ns2.fabulous.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2014-01-26T13:00:00Z
The .com expires in August, you can probably snap it up then.
--
BMO
So...once we identify the people responsible for this, do we publish their names?
What if they are working for Fed.Gov?
What if they are well-meaning idiots who have had the computers hacked?
Do You shun someone when You don't know if You can trust the list of "bad onions?"
It will be an interesting ethical debate for decades...
Until the last technocrat is strangled by the wiring of the last transhumanist.