Slashdot Mirror
Tor Connections To Hidden Services Could Be Easy To De-Anonymize
angry tapir writes with news of a report presented Friday at Hack In The Box which outlines a counterintuitive fact about Tor:
Identifying users who access Tor hidden services — websites that are only accessible inside the Tor anonymity network — is easier than de-anonymizing users who use Tor to access regular Internet websites.
That's because the addresses of the Hidden Service Directories (HSDirs) used to index those Tor-network-only sites, though shuffled daily, can be predicted (and hijacked) with cheap brute-force techniques.
"The researchers managed to place their own nodes as the 6 HSDirs for facebookcorewwwi.onion, Facebook's official site on the Tor network, for the whole day on Thursday. They still held 4 of the 6 spots on Friday. Brute-forcing the key for each node took only 15 minutes on a MacBook Pro and running the Tor relays themselves cost US$62 on Amazon's EC2 service.
pun intended
TOR is getting a lot more research attention now. That can only make it stronger in the long run.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
This is not de-anonymizing anyone. This problem is already known and being worked on.
The researchers essentially brute forced their way into running Tor's "hidden service DNS servers" for a day. This could be used as a stepping stone for more complicated attacks, but by itself this is nothing.
The new hidden service proposal that fixes this issue among plenty of other improvement is being worked on. Hidden services need some love, but they are still the only way to run a service that has actually succeeded at protecting people from real, motivated, well funded bad guys.
The simple fact that it uses "directory servers" for Tor stuff (including hidden services) means that there is centralization in the network. Centralization of control is the enemy of anonymous communications because it vastly shrinks the target surface area required to damage or intercept that communications. This is just another hole in the bottom of the anonymity boat for Tor users. A better system would publish services using the public key of a strong asymmetric encryption algorithm such that the only valid responses could be encrypted with the private key; flooding the network with bad information to turn yourself into the correct node for a given "hidden service" name simply wouldn't work.
I wonder if they're doing it already?
If I understand correctly, this attack has a similar effect to a DNS attack : you replace a server for an address with one of your own servers instead, so that users requesting the service will be routed to you.
While this is bad, I'm not sure how it affects anonymity in any way. Obviously, the spoofed service might try to serve some Tor vulnerability to the users to identify them, but this relies on finding an actual weakness in Tor, or in the user's setup, to identify them.
Religion is the best example of mass psychosis
Ask Dread Pirate Roberts helm man, but hurry. In a few he will be asshole deep in the pokey.
With every major Nation in the world trying to glean intelligence from Tor, every major law enforcement agency trying to track down child porn and drugs, and several very high profile leaks involving highly classified information that have caused extreme harm to several western countries (the US not being the only one), and with several academic professors intrigued; does it not surprise us that the protocol of Tor (to include Bridges and Hidden Services) would be analyzed and profiled to the tiniest of details to determine areas of exploitation of the protocol?
Select from tblFriends where interesting >= 4;
Isn't it cheap enough for various intelligent services to just participate in the TOR network by adding large numbers of servers under their control and monitoring incoming and outgoing traffic? If they have a high enough portion of the entire TOR network, wouldn't they be able to track traffic. (Not need to be always--even a low hit rate would mean you could trace who is talking to whom
>Until governments gain access to, and forbid citizen ownership of, superior hardware and software, we'll continue to experience the circus we have today.
Intel AMT/Vt/VPRO
>300 MILLION pea shooters picking off the milita
You can't marry a girl child now.
You could for all of human existance untill feminism in the 1870s.
Think about that.