Slashdot Mirror
Tor Connections To Hidden Services Could Be Easy To De-Anonymize
angry tapir writes with news of a report presented Friday at Hack In The Box which outlines a counterintuitive fact about Tor:
Identifying users who access Tor hidden services — websites that are only accessible inside the Tor anonymity network — is easier than de-anonymizing users who use Tor to access regular Internet websites.
That's because the addresses of the Hidden Service Directories (HSDirs) used to index those Tor-network-only sites, though shuffled daily, can be predicted (and hijacked) with cheap brute-force techniques.
"The researchers managed to place their own nodes as the 6 HSDirs for facebookcorewwwi.onion, Facebook's official site on the Tor network, for the whole day on Thursday. They still held 4 of the 6 spots on Friday. Brute-forcing the key for each node took only 15 minutes on a MacBook Pro and running the Tor relays themselves cost US$62 on Amazon's EC2 service.
TOR is getting a lot more research attention now. That can only make it stronger in the long run.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The simple fact that it uses "directory servers" for Tor stuff (including hidden services) means that there is centralization in the network. Centralization of control is the enemy of anonymous communications because it vastly shrinks the target surface area required to damage or intercept that communications. This is just another hole in the bottom of the anonymity boat for Tor users. A better system would publish services using the public key of a strong asymmetric encryption algorithm such that the only valid responses could be encrypted with the private key; flooding the network with bad information to turn yourself into the correct node for a given "hidden service" name simply wouldn't work.
This is not de-anonymizing anyone.
Really? The slides go over the needed steps to become an HSDir... or several HSDirs... and perform a correlation attack to de-anonymize someone. -1, Overrated.
The researchers essentially brute forced their way into running Tor's "hidden service DNS servers" for a day.
You only need 4 days uptime to become an HSDir. That's a pretty insignificant bar. They also still held 4 of those 6 spots on day #2. It cost a pittance. -1, Overrated.
The new hidden service proposal that fixes this issue among plenty of other improvement is being worked on.
Possibly the only useful part of your comment. +1 Informative.
It most certainly DOES affect anonymity. Read the slides, which explain how to set up a correlation attack. They can become the HSDirs for specific hidden services, for a pittance, and then they can run a correlation attack since you'll be having to go through them first to get to said hidden service.
How the fuck did this factually incorrect tripe get modded up?
I wonder if they're doing it already?
And how do you think they have been able to make multiple arrests in the Silk Road case? Hmmm...?
Gee, I mean, of course, Ross Ulbricht had pretty much zero SecOps, babbling this way and that on different forums, but it's still very suspicious he and other Silk Road operators and ''customers'' got arrested so fast.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
With every major Nation in the world trying to glean intelligence from Tor, every major law enforcement agency trying to track down child porn and drugs, and several very high profile leaks involving highly classified information that have caused extreme harm to several western countries (the US not being the only one), and with several academic professors intrigued; does it not surprise us that the protocol of Tor (to include Bridges and Hidden Services) would be analyzed and profiled to the tiniest of details to determine areas of exploitation of the protocol?
Select from tblFriends where interesting >= 4;
You could read the wired piece on how they caught DPR and actually find out.
Hint: It wasn't this.