Slashdot Mirror
Researcher Finds Tor Exit Node Adding Malware To Downloads
Trailrunner7 writes: A security researcher has identified a Tor exit node that was actively patching binaries users download, adding malware to the files dynamically. The discovery, experts say, highlights the danger of trusting files downloaded from unknown sources and the potential for attackers to abuse the trust users have in Tor and similar services. Josh Pitts of Leviathan Security Group ran across the misbehaving Tor exit node while performing some research on download servers that might be patching binaries during download through a man-in-the middle attack.
What Pitts found during his research is that an attacker with a MITM position can actively patch binaries–if not security updates–with his own code. In terms of defending against the sort of attack, Pitts suggested that encrypted download channels are the best option, both for users and site operators. "SSL/TLSis the only way to prevent this from happening. End-users may want to consider installing HTTPS Everywhere or similar plugins for their browser to help ensure their traffic is always encrypted," he said via email.
What Pitts found during his research is that an attacker with a MITM position can actively patch binaries–if not security updates–with his own code. In terms of defending against the sort of attack, Pitts suggested that encrypted download channels are the best option, both for users and site operators. "SSL/TLSis the only way to prevent this from happening. End-users may want to consider installing HTTPS Everywhere or similar plugins for their browser to help ensure their traffic is always encrypted," he said via email.
And I'm glad the article says everything is just fine and there are no problems. What a relief.
Or check the checksum
Is "SSL connections only" an option with Tor? If so, it should be the default. Shouldn't be relying on the browser.
Thanks, now I'm having flashbacks of Chuck Norris jokes in the Barrens on Drak'thul.
Who's to say that your friendly ISP or government agency isn't doing the same? Or even better yet, how about for OS updates.
Last time I checked even my linux *.list files were referencing HTTP hosts rather than HTTPS (not that HTTPS is really much better, when gov't agencies are concerned)
Might make sense to use an SSL-enabled connection and a key that's provided with the distro.
Does the malware run under Linux? Unless they're able to infect Linux software, I really don't care because that's all I run.
Good, inexpensive web hosting
Cloudflare offers a fake SSL service called "Flexible SSL". Cloudfront gets a cert generated with a long list of domains. Users connect to Cloudfront, Cloudflare sets up a secure connection from the user's browser to Cloudflare, acts as a man-in-the-middle, and makes an unencrypted connection to the destination host.
And, of course, there's an exploit for this.
Even if you buy Cloudflare'ss "most secure" option, and have SSL to your own server using your own certificate, you have to give Clouldflare your SSL cert's private keys. Does Clouldflare take responsiblity for the security of your private keys? No.
So do not use Cloudflare for sites which handle any valuable data, such as credit card numbers.
Digital signatures is exactly the technology that solves this problem. If you download binaries from the internet (especially if you have need to use Tor to get them!), check the signatures!
Now, it may be possible to also dynamically patch the signatures when these are downloaded -- but that requires much greater control since signatures can be obtained separately, and since Tor can mitigate the problem by routing different downloads through different exit notes.
And get nailed by a fake cert? How does this sidestep the trust issue?
“He’s not deformed, he’s just drunk!”
I thought the general consensus by now was that Tor is essentially a honeypot for the NSA & FBI...
The only thing that really works is verifying PGP signatures. SSL is broken and the Tor node may well have legitimate certificates at its disposal.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is an old and well-known attack. Your inane response just shows that you have no clue at all.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Is there any wonder why when I use Tor I always compare files with that obtained via a VPN or at another site to see if they match, I have been doing this long before digital signed executables came on the scene.
I had Roger Dingledine explain that to me about 12 years ago. Your argument is simplistic and ignores reality. There is no way to "infiltrate" Tor. It is expected that people try that and the design is quire resistant against it.
But your language already shows that you are nothing but a clueless troll and you are probably jerking off to the things you write here.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
There have been several reports of Bitcoin users that use online wallets and exchanges, even over https, getting MITM attacked when using Tor. They visit the wallet site, get bad certificates but continue anyway, and poof, their Bitcoins in the service are gone and their passwords are known by the attacker. With recent SSL vulnerabilities or clever redirection, the cert errors could be avoided also. For other sites, users can be piped through a "universal phisher" to steal any credentials.
Clearly Tor users are under attack by exit nodes, many of them running automated tools against many web destinations.
Probably varies Linux distro to distro. In Windows, the MSU files are all signed by MS so the download path isn't of issue, since if it is compromised any alterations to the file would break the signature.
Tor provides anonymity. It does not provide authenticity or secrecy, and doesn't pretend to. If you want those things, you should use something else in addition to tor. For example, TLS or SSH might suit your needs.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
Please reference many years of comics culture and style that GP is emulating.
The repeated consonants or vowels, usually at the start of a sentence or thought, indicate heightened emotion--usually fear, trepidation, worry, or embarassment. The halting flow of the language is representative of those conditions, where the speaker's confidence is not sufficient to continue the strings of phonemes without retrying / restarting the word or phrase several times.
I hope this clears up your questions and possibly takes away some of your anti-stuttering bias. I feel better now too.
Scarce, scared, scarred, sacred... -Col. Bruce Hampton
... but amazed it hasn't happened sooner.
If you own the majority of the exit nodes, that is not an "infiltration", that is a "take-over". But yes, that is possible. It is why the Tor project is trying all the time to get more exit-nodes from different people in different countries. Also possible are traffic analyses if you own a large part of the relays or of the Internet itself. The Tor project has research papers on these attacks and has a pretty good idea where the thresholds lie.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.