Slashdot Mirror
Spoiled Onions: Exposing Malicious Tor Exit Relays
An anonymous reader points out this recently published study (PDF) on detecting malicious (or at least suspicious) Tor exit relays. From their conclusions: "After developing a scanner, we closely monitored all ~1000 exit relays over a period of four months. Wed discovered 25 relays which were either outright malicious or simply misconfigured. Interestingly, the majority of the attacks were coordinated instead of being isolated actions of independent individuals. Our results further suggest that the attackers made an active effort to remain under the radar and delay detection."
One of the authors, Philipp Winter, wrote a followup blog post to help clarify what the paper's findings mean for Tor users, including this clarification: "First, it's important to understand that 25 relays in four months isn't a lot. It is ultimately a very small fraction of the Tor network. Also, it doesn't mean that 25 out of 1,000 relays are malicious or misconfigured (we weren't very clear on that in the paper). We have yet to calculate the churn rate of exit relays which is the rate at which relays join and leave the network. 1,000 is really just the approximate number of exit relays at any given point in time. So the actual number of exit relays we ended up testing in four months is certainly higher than that. As a user, that means that you will not see many malicious relays 'in the wild."
So, they tested around 1000 tor exit nodes, but actually tested many more? 25 of those node might have been malicious or maybe just misconfigured?
What?
If you want news from today, you have to come back tomorrow.
if you can monitor all exit relays?
I am kind of surprised by how small the Tor network is. Only 1000 exit relays? Guess I'll spin up a few.
My vague understanding of this (and I haven't really been following it so take with salt) is that this really doesn't defeat TOR itself, but merely takes advantage of ones position as an exit node to perform well known man in the middle style attacks.
TOR is about hiding your identity. The exit node can see what you are sending and receiving, but doesn't know your actual IP (just the IP of the last node in the chain), the entry node knows your IP, but not what you are sending and receiving. This attack doesn't appear to compromise that.
This is a followup on http://yro.slashdot.org/story/... but the only new content is the blog posting.
The primary development goal of Tor is to prevent the request from being traced back to the requester. (As a secondary effect, it also bypasses various national/regional content blocking schemes.) Malicious exit relays are detrimental, but in theory the user should be aware of the trust issues involved. I would label this as a user education issue.
The major points being:
What you send along to though can include things potentially mor idenifying than your IP might have ever been. The lesson is that there are no magic bullet solutions to anonymity and security which do not involve some degree or reading and learning how things work.
However, by performing a MITM and stripping that encryption, there may be identifying information in those packets. They might not see Joe Bobs IP, but instead snatched his logon creds, shipping address and payment info that was mused at illegalgunemporium.biz and giantbuttplugs.info
Silence is a state of mime.
If all it takes is one relay to be compromised to remove the entire point of using Tor,
That's not at all what the article is saying. A relay injecting content into your connection does not de-anonymize you. Tor works to guarantee anonymity. It doesn't guarantee that the exit relay isn't watching what's going through it or modifying the connection. That's why it's important to use HTTPS.
What people must understand is that the exit node is, to the server you're connecting to, essentially "you". In other words, it can see everything your computer could see if taking a look at the packet sent out. Everything a tool like Wireshark running on your computer could come up with is also what this exit node can see. If you send unencrypted traffic through TOR, the exit node will be able to read everything in plain text. That includes all credentials or cookies sent in plaintext.
More, it can alter and modify the stream. That means it can easily inject cookies itself or other objects. I didn't try it yet, but I would not deem it impossible for an exit node to inject objects that can bypass TOR (like flash and the like) that could eventually compromise the users' identity. At the very least it would be trivial to inject a cookie that contains your TOR surfing habits. If I was a country, I'd try to team up with someone who has a high chance to be surfed to with a "normal" connection like a social media website or a search engine to ferret out someone's TOR surfing habits. If they use the same browser for TOR surfing and normal surfing, it becomes fairly trivial to detect them.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Sounds like a good reason to tunnel your traffic through a vpn on top of tor, no?
So actually Tor software should warn the user when plaintext stuff is being sent over the network.
This could be difficult to accomplish. But one easy way is to simply detect plaintext HTTP headers.
If Pandora's box is destined to be opened, *I* want to be the one to open it.
Hardly. People would just use Freenet or Gnunet instead.
Only if you purchase and maintain that VPN completely anonymously. Otherwise, that's a great way to de-anonymise yourself real quick.
The leaser "knows" who's using their service( you )
You seem to have confused Tor and VPNs. The Tor exit node doesn't know who is using their node unless the user has screwed up and/or the exit node is a malicious node that is reading the user's email and able to figure out the identity, in which case the user has still screwed up.
Also, you are then susceptible to the very same MITM attacks by the VPN provider. (Although they do have an incentive to remain honest.)
From the very first days of Tor I've assumed that at least one, and probably several different agents (legal and illegal, gov't and private) would be smart or at least interested enough to run a significant percentage of Tor hosts. This is akin to Willie Sutton's reasoning for why he robbed banks - "That's where the money is." Since Tor is of most interest to folks who want to keep things private, that's where people who want to know private things are sure to lurk. In the case of NSA, it's worth doing just in case they can _someday_ decrypt data going through. This would work best when some significant percentage of hosts is 'owned', which would allow those hosts to cooperate in determining the true path for some fraction of the data going through.
For a made-up example, assuming 1/3 of all Tor hosts are compromised in one way or another and preserve or report the data, the incoming and outgoing routes to the agent. If those hosts are optimally situated worldwide, they will on some occasions (often?) comprise a sufficiently large portion of the onion route between two 'bad actors', so that various techniques such as timing comparisons will assist in filling in the blanks and some, if not all, of the useful information will be exposed.
Then there are the possibilities of deeper hacks into apparently legitimate Tor hosts, which NSA is known to be capable of.
I'm just speculating, but if I, a relatively security-naive person can come up with these thoughts, I'm sure that folks who specialize in this could come up with better ones.
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
"giantbuttplugs.info" he said, using it as a metasyntactic variable.
So I says to myself, "who the fuck would register that?" Then I says to myself, "it's the internet, someone must be using it." .gov, .info, .org, .mil, .net are all available.
The .com is taken.
Domain Name: giantbuttplugs.com
Registry Domain ID:
Registrar URL: http://www.fabulous.com/
Updated Date: 2013-06-30T17:14:35Z
Creation Date: 2006-08-16T02:14:40Z
Registrar Registration Expiration Date: 2014-08-16T00:00:00Z
Registrar: FABULOUS.COM PTY LTD.
Registrar IANA ID: 411
Registrar Abuse Contact Email: abuse@fabulous.com
Registrar Abuse Contact Phone: +61.730070015
Reseller: N/A
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Registry Registrant ID: N/A
Registrant Name: Domain Admin
Registrant Organization: Sunlane Media LLC
Registrant Street: PO Box 231789
Registrant City: Encinitas
Registrant State/Province: CA
Registrant Postal Code: 92024
Registrant Country: US
Registrant Phone: +1.877 849 6203
Registrant Phone Ext: N/A
Registrant Fax: +1.877 849 6203
Registrant Fax Ext: N/A
Registrant Email: fabulous@sunlane.com
Registry Admin ID: N/A
Admin Name: Domain Admin
Admin Organization: Sunlane Media LLC
Admin Street: PO Box 231789
Admin City: Encinitas
Admin State/Province: CA
Admin Postal Code: 92024
Admin Country: US
Admin Phone: +1.877 849 6203
Admin Phone Ext: N/A
Admin Fax: +1.877 849 6203
Admin Fax Ext: N/A
Admin Email: fabulous@sunlane.com
Registry Tech ID: N/A
Tech Name: Domain Admin
Tech Organization: Sunlane Media LLC
Tech Street: PO Box 231789
Tech City: Encinitas
Tech State/Province: CA
Tech Postal Code: 92024
Tech Country: US
Tech Phone: +1.877 849 6203
Tech Phone Ext: N/A
Tech Fax: +1.877 849 6203
Tech Fax Ext: N/A
Tech Email: fabulous@sunlane.com
Name Server: ns1.fabulous.com
Name Server: ns2.fabulous.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2014-01-26T13:00:00Z
The .com expires in August, you can probably snap it up then.
--
BMO
Dubious idea. Some countries prohibit you to share your network connection or face the consequences for any non-legal use of it.
Until the last technocrat is strangled by the wiring of the last transhumanist.
IOW, at any given time, you've got ~0.25% chance to be routed through a bad exit node.
[cough] .. 25 out of 1000 would be 2.5%
25 per 100 = 25%
25 per 1000 = 2.5%
25 per 10000 = 0.25%
etc. etc.
If you don't pray in my school, I won't think in your church.