Tor Connections To Hidden Services Could Be Easy To De-Anonymize

angry tapir writes with news of a report presented Friday at Hack In The Box which outlines a counterintuitive fact about Tor: Identifying users who access Tor hidden services — websites that are only accessible inside the Tor anonymity network — is easier than de-anonymizing users who use Tor to access regular Internet websites. That's because the addresses of the Hidden Service Directories (HSDirs) used to index those Tor-network-only sites, though shuffled daily, can be predicted (and hijacked) with cheap brute-force techniques. "The researchers managed to place their own nodes as the 6 HSDirs for facebookcorewwwi.onion, Facebook's official site on the Tor network, for the whole day on Thursday. They still held 4 of the 6 spots on Friday. Brute-forcing the key for each node took only 15 minutes on a MacBook Pro and running the Tor relays themselves cost US$62 on Amazon's EC2 service.

Comments

The good thing is

[gweihir]

TOR is getting a lot more research attention now. That can only make it stronger in the long run.

Re:The good thing is

[GoddersUK]

Well no. You can code out bugs, but you can't code out thugs. The bugs in the programme can be found and fixed, but if the government doesn't want to respect our liberties then, unless we have the numbers and strength to fight back, no liberties for us.

Re:The good thing is

[Gallefray]

Right. By that logic civil liberties have never been stronger. I mean they've been studied since ancient times.

Yes, but civil liberties aren't open source.

Re:The good thing is

[GLMDesigns]

Our liberties have been further and further eroded as we've stopped calling them Individual Rights. Calling them civil liberties takes away the power, the self-awareness that comes from knowing that the right of speech (as for example) comes from YOU and can only be abridged by governments. Rights do not come from governments. Governments can either acknowledge and respect individual rights or abrogate them.

Tor's trust model has always been broken

[nctritech]

The simple fact that it uses "directory servers" for Tor stuff (including hidden services) means that there is centralization in the network. Centralization of control is the enemy of anonymous communications because it vastly shrinks the target surface area required to damage or intercept that communications. This is just another hole in the bottom of the anonymity boat for Tor users. A better system would publish services using the public key of a strong asymmetric encryption algorithm such that the only valid responses could be encrypted with the private key; flooding the network with bad information to turn yourself into the correct node for a given "hidden service" name simply wouldn't work.

Re:Tor's trust model has always been broken

[nctritech]

It's possible that you have misunderstood what "public key" means. It does not mean that it is published for everyone in the world to see. In asymmetric encryption, each key consists of two parts: a public key and a private key. The public key is allowed to be known by anyone and can be used by anyone to encrypt something for the owner of the private key, or to decrypt something that was encrypted by the owner of the private key. That's why it is the "public key." Mere knowledge of what it is allows a person to securely encrypt what it sends to the private key holder and allows that person to validate that the person sending something to them IS the private key holder. It does not offer security in one direction (since one decryption key is "public") but it does offer validation in the direction that data security is not offered. Related: look up Diffie-Hellman key exchange for info on how asymmetric key pairs are used to initiate symmetrically encrypted secure data streams between hosts. Also look up how PGP keys are used to validate that an email was sent by a specific person and/or that the contents of the email were not changed by a "man in the middle."

If you were considering the "published" part, "published" also doesn't necessarily mean that the services are in a nice easy list on some server somewhere for the FBI to download. Of course, the Tor directory servers obviously handle .onion domain name resolution and that makes them a huge problem. You know the garbled names that .onion sites use? My suggestion was to make that the public key and to do away with directory servers, using something like DHT instead.

tl;dr: "Public key" doesn't mean "published key" and "published" doesn't necessarily mean "in an easy-to-read directory somewhere."

Re:Tor's trust model has always been broken

[Burz]

This is a primary reason why I2P (Invisible Internet Project) exists. Its much less centralized than Tor, mixes other peoples' traffic with yours by default, and over the years has typically used stronger encryption than Tor. Its just more private and secure overall.

The people who make the TAILS distro recognize Tor's shortcomings which is why they include I2P along with Tor. I2P isn't built to outproxy to the regular web (although it can), but you do get the ability to do fully decentralized/anonymized messaging and torrents, for instance, along with hidden websites. On top of being more private than Tor, its a protocol that's meant for general purpose use.

https://geti2p.net/en/

Re:Misleading clickbait and FUD

[weilawei]

This is not de-anonymizing anyone.

Really? The slides go over the needed steps to become an HSDir... or several HSDirs... and perform a correlation attack to de-anonymize someone. -1, Overrated.

The researchers essentially brute forced their way into running Tor's "hidden service DNS servers" for a day.

You only need 4 days uptime to become an HSDir. That's a pretty insignificant bar. They also still held 4 of those 6 spots on day #2. It cost a pittance. -1, Overrated.

The new hidden service proposal that fixes this issue among plenty of other improvement is being worked on.

Possibly the only useful part of your comment. +1 Informative.