Slashdot Mirror
Spoiled Onions: Exposing Malicious Tor Exit Relays
An anonymous reader points out this recently published study (PDF) on detecting malicious (or at least suspicious) Tor exit relays. From their conclusions: "After developing a scanner, we closely monitored all ~1000 exit relays over a period of four months. Wed discovered 25 relays which were either outright malicious or simply misconfigured. Interestingly, the majority of the attacks were coordinated instead of being isolated actions of independent individuals. Our results further suggest that the attackers made an active effort to remain under the radar and delay detection."
One of the authors, Philipp Winter, wrote a followup blog post to help clarify what the paper's findings mean for Tor users, including this clarification: "First, it's important to understand that 25 relays in four months isn't a lot. It is ultimately a very small fraction of the Tor network. Also, it doesn't mean that 25 out of 1,000 relays are malicious or misconfigured (we weren't very clear on that in the paper). We have yet to calculate the churn rate of exit relays which is the rate at which relays join and leave the network. 1,000 is really just the approximate number of exit relays at any given point in time. So the actual number of exit relays we ended up testing in four months is certainly higher than that. As a user, that means that you will not see many malicious relays 'in the wild."
"New information" being this isn't 25 of 1,000 nodes.
its 25 of some unknown number of nodes, of which 1,000 are active at any one time.
And as I tried to point out last tiime (and am greatful for the opportunity to reiterate)
exit nodes only account for 100Mbps of tors 3Gbps average traffic (most of the traffic being to hidden services which never go near an exit node)
So if anything this is testament to the security of tor.network.
I guess much of the fear comes from the silkroad take down, but that was foiled by the good old postal service and human error, not the technology itself.
Not to mention we have seen several cases in the past couple of years of users having their computer equipment confiscated for running TOR exit nodes by grabbing them for CP distribution, who is to say that when they get their PC back it doesn't have a little "extra hardware" to keep an eye on TOR users?
But you should be able to test without risking lives, have those using the exit nodes go to a "political website" that has an address that nobody would come up with by accident and see if that site after using supposedly "good" nodes suddenly has a jump in activity.
ACs don't waste your time replying, your posts are never seen by me.
How is that any different from running a free wifi service? Note that most of the illegal material is on Tor hidden services so would never leave your exit node at all, and all censorship on your connection remains in place for everyone using it.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Sounds like a good reason to tunnel your traffic through a vpn on top of tor, no?