5 ms·

Malicious computers caught snooping on Tor-anonymized Dark Web sites

57 points by nols 10y ago

pdimitar 10y ago
Isn't it obvious by now that Tor is outdated and instead of trying to repair it, something next-gen should be devised? IPFS looks like a good starting point, and unlike Tor, it sounds like it has a real shot to evolve if enough people stand behind it (since its various components aren't glued together and allow for new protocol elements in the stack). I am aware IPFS has limitations and that there are valid P2P attacks to which it either couldn't resist well (reduced capacity) or it could straight out give away its users IP addresses -- but hey, in my opinion Tor has been mostly compromised by authorities around the world and is currently widely used to persecute people -- some of which might simply be paranoid like myself and dislike being tracked, without doing anything illegal. Doesn't that mean that Tor has outlived its usefulness? Must we be afraid or tracking and profiling everywhere we go on the net? Have the bad guys already won?
- zimbatm 10y ago
  There might be better alternatives to Tor in the future but IPFS has nothing to do with anonymized communication. It also also not designed for bi-directional communication. It brings a lot of interesting things to the table but anonymity of the users is not one of it's priority.
  - mintplant 10y ago
    Indeed, the ticket tracking IPFS-over-Tor support has been sitting idle for three months now: https://github.com/ipfs/notes/issues/37#issuecomment-234697606 https://github.com/ipfs/notes/issues/37#issuecomment-2346976...
  - pdimitar 10y ago
    I realize that Tor and IPFS aren't aiming at the same goals. But theoretically, if a darknet website uses content addressing to be fetched in its entirety, it'd be harder to track the users unless some much more advanced techniques are employed, like monitoring traffic spikes, timing attacks, etc. EDIT: Forgot to mention that since IPFS is a solid upgrade over the BitTorrent way of doing things, then yes, people downloading pieces of data by their content hash can still be targeted. My bad.
- deftnerd 10y ago
  Tor has suffered a lot of bad PR, FUD, and failures lately. I'm beginning to lose faith in the network itself. I attempted to ask some of the developers if there was, or any interest in, a Javascript version of Tor. My thought was that Electron apps or clearnet websites could use the javascript to load resources or data from onion addresses. The push back I got from the concept made me feel sad. Some of the responses I got varied from "By only having one reference Tor, it keeps the whole network safe" to "Mixing clearnet with Onion access will make people unsafe." Tor is doing a good job with the mission purpose of providing one software application that allows an individual to communicate with the world, even inside of a nation that practices extreme censorship. But for the purposes of preventing the US, the largest and most prevalent state actor, from monitoring the entirety of the network? It seems to be failing. For the purpose of hiding the source of an onion website, the jury is still out. It appears that the US government has enough of a view into the Tor network that they're able to often deanonymize the hosting location of the backend server. They've been talking about refactoring the hidden service portion of the code for a long time now but I'm worried that all of the hits the project has taken lately will make that too little, too late.
  - PeCaN 10y ago
    To be honest, that's far from the worst feedback you could get to a “JavaScript version of Tor”.
  - ken__m 10y ago
    jesus was crucified because of attempt of tor on javascript
  - frauch 10y ago
    jesus was crucified because of attempt of tor on javascript
  - mike_hearn 10y ago
    If you're thinking about desktop apps, then one way to do it is simply ship a Java app that embeds WebKit (if you insist on using HTML even when a real widget toolkit is available). There is a Java Tor client available that can be embedded called Orchid, and then binding Orchid through to the Javascript world is not very difficult. It'd be a weird way to do things though. May as well just ship all needed data files and resources in the app itself. On the wider issue, I don't know if Tor is really doing such a great job of helping people in censoring states. Whenever I hear about Chinese people crossing the firewall it's always with VPNs and never Tor, which is thoroughly blocked for a long time now. One of the theories of Tor was that if there was lots of legitimate usage, it'd be harder to filter out Tor traffic ("anonymity loves company" they call it), but that goal was clearly better achieved using VPNs which impose minimal performance costs and has left Tor itself largely isolated. This sort of attack on the Tor network by large groups of malicious nodes is inevitable in a borderless community where there is no procedure for vetting or ID verifying new node operators. Tor assumes ideological loyalty from its node operators, that's a fundamental security assumption, but at the same time, a part of the Tor ideology is that there's no vetting procedure for nodes, nor are there any real rules for running them beyond a few trivial ones, and anyway without the former there's no way to enforce the latter. Tor is built on a giant contradiction, essentially. Of course that's not a problem unique to Tor. All communities that make majority trust assumptions without any way to control group membership have that problem. Bitcoin has suffered from this too, as has the British Labour party (which recently changed its rules to allow anyone to become a member by paying just £3, a move which immediately led to Corbyn and may yet lead to ~all existing MPs being fired and replaced by hard-left zealots).
- Ixiaus 10y ago
  GNUNet / SecuShare though it isn't quite mature enough...
  - pdimitar 10y ago
    Thanks for the ping on those. I had them bookmarked but completely forgot about them. I'll check them out in more details.
- kerkeslager 10y ago
  > Isn't it obvious by now that Tor is outdated and instead of trying to repair it, something next-gen should be devised? No, it's not obvious. All evidence I know of indicates that compromises of anonymity have occurred at the web application layer (XSS, SQL injections causing servers to give out information they don't intend to share), the browser level (using HTTP instead of HTTPS, not disabling JavaScript, TorBrowser not patching vulnerabilities found in Firefox), or the human level (users giving out data that allows other people to figure out who they are). None of these breaches of anonymity are problems that Tor attempts to solve: Tor is only one part of an infrastructure that allows anonymity. > I am aware IPFS has limitations and that there are valid P2P attacks to which it either couldn't resist well (reduced capacity) or it could straight out give away its users IP addresses I don't know whether these problems with IPFS are real (I know little about it) but if it could straight out give away its users' IP addresses, it's completely useless as an alternative to Tor, to the point that I'm unsure why you're proposing it. > but hey, in my opinion Tor has been mostly compromised by authorities around the world and is currently widely used to persecute people Is this opinion based in any evidence? > Doesn't that mean that Tor has outlived its usefulness? You mentioned before "authorities around the world". I would not be surprised if some more technically capable governments (USA, Israel, China) have compromised Tor, but I would be extraordinarily surprised if even mid-level "authorities" even in those same countries has those capabilities. An exploit widely usable by many authorities would eventually become public knowledge. The fact that such an exploit has not become public knowledge leads me to believe that at least a significant number of the people you refer to as "authorities" don't have the capability to de-anonymize Tor. So maybe I don't trust Tor to protect me from the NSA, but there are a good many people I do trust it to protect me from. Especially since, like you, my reasons for using Tor are largely ideological rather than practical--I just don't want to be tracked, and Tor significantly decreases the number of actors capable of tracking me.
  - pdimitar 10y ago
    I appreciate your response. The fact that Tor, or any other service that attempts to anonymize its user base, is hiding behind the "we can't promise you full anonymity" legal safety net, isn't helping any of us who want to be anonymous anyway. I understand they have legal issues to deal with and must use evasive language so as to be not eliminated easily by anyone disagreeing with them. Still, it doesn't help us the users either. As I pointed out, IPFS indeed has limitations, but same as Tor, if it doesn't get wider adoption, it won't ever become better. Being a programmer, I believe I can properly time the moment we should stop trying to repair something that looks like it's already working against us, and just start over. As a human being, I recognize I might be wrong and I agree with your counterpoint. I have no evidence that Tor is compromised, but if we're to believe what we're told via the official news, what another conclusion would you draw? It's an honest question, not an attempt to shift the burden of proof. Objectively speaking, I have no evidence or proof. If I had any, I think there's a reasonable chance I would be in prison because the FBI doesn't like citizens knowing how do they penetrate their cyber targets. Again, I agree with you. I know many possible malicious actors don't have the tech and/or the talent to deanonymize Tor users. But IMO the whole point is to make every single malicious actor powerless. In that regard, it seems Tor is failing a lot in the last 1 year.
- ashitlerferad 10y ago
  > Tor is outdated and instead of trying to repair it Tor is continually evolving and being researched and attacked and fixing vulnerabilities and so on goes the cycle.
- white-flame 10y ago
  The only "real" alternative out there is I2P. It's set up mostly as a darknet with a few HTTP proxies out to the clearnet; while Tor is focused more as an anonymous proxy to the clearnet, with lesser-used darknet features. I2P claims some of its design is more robust security-wise than Tor, but it also has a smaller userbase and fewer eyeballs on its source. It does have enough of a critical mass to be properly functional and have an ecosystem of usage, and is almost as old as Tor (2003 vs 2002).
  - dmix 10y ago
    If I2P's codebase is anything like it's user interface I'd stay far away from it. I often see a correlation between caring for the UI and caring for the quality of code. Although most OSS is pretty bad UX wise , particularly security software. I also had a lot of trouble getting the it working properly. But the clearnet distinction you noted is interesting.
  - pdimitar 10y ago
    I've never checked I2P in more details. Thanks for reminding me to research it.
kyboren 10y ago
I host multiple onion services, mainly for email proxies and firewall traversal, and this is exactly the reason I use stealth onion services. With this setup, only those client machines onto which I pre-load a cookie can decrypt a per-client encrypted copy of the "introduction point contact info" part of the descriptor. Malicious HSDirs wouldn't even know where to introduce themselves to my services, let alone the correct cookie for the INTRODUCE2 cells. If you want to host an onion service, but don't want it publicly accessible, use 'HiddenServiceAuthorizeClient'.
- dmix 10y ago
  This built into the tor server software? It parses cookies? This makes me want to learn how hidden services work. I'm curious how complex the code is.
  - ryanlol 10y ago
    No, the cookie is set in the config file. Search for HidServAuth and HiddenServiceAuthorizeClient at https://www.torproject.org/docs/tor-manual.html.en https://www.torproject.org/docs/tor-manual.html.en for further elaboration.
    - dmix 10y ago
      Yes clearly the client needs to store a cookie somewhere (config files, db, browser) but the server needs to parse it in order to authenticate the user. Thanks for the link.

57 points by nols 10y ago

Isn't it obvious by now that Tor is outdated and instead of trying to repair it, something next-gen should be devised? IPFS looks like a good starting point, and unlike Tor, it sounds like it has a real shot to evolve if enough people stand behind it (since its various components aren't glued together and allow for new protocol elements in the stack). I am aware IPFS has limitations and that there are valid P2P attacks to which it either couldn't resist well (reduced capacity) or it could straight out give away its users IP addresses -- but hey, in my opinion Tor has been mostly compromised by authorities around the world and is currently widely used to persecute people -- some of which might simply be paranoid like myself and dislike being tracked, without doing anything illegal. Doesn't that mean that Tor has outlived its usefulness? Must we be afraid or tracking and profiling everywhere we go on the net? Have the bad guys already won?

zimbatm 10y ago
There might be better alternatives to Tor in the future but IPFS has nothing to do with anonymized communication. It also also not designed for bi-directional communication. It brings a lot of interesting things to the table but anonymity of the users is not one of it's priority.
- mintplant 10y ago
  Indeed, the ticket tracking IPFS-over-Tor support has been sitting idle for three months now: https://github.com/ipfs/notes/issues/37#issuecomment-234697606 https://github.com/ipfs/notes/issues/37#issuecomment-2346976...
- pdimitar 10y ago
  I realize that Tor and IPFS aren't aiming at the same goals. But theoretically, if a darknet website uses content addressing to be fetched in its entirety, it'd be harder to track the users unless some much more advanced techniques are employed, like monitoring traffic spikes, timing attacks, etc. EDIT: Forgot to mention that since IPFS is a solid upgrade over the BitTorrent way of doing things, then yes, people downloading pieces of data by their content hash can still be targeted. My bad.
deftnerd 10y ago
Tor has suffered a lot of bad PR, FUD, and failures lately. I'm beginning to lose faith in the network itself. I attempted to ask some of the developers if there was, or any interest in, a Javascript version of Tor. My thought was that Electron apps or clearnet websites could use the javascript to load resources or data from onion addresses. The push back I got from the concept made me feel sad. Some of the responses I got varied from "By only having one reference Tor, it keeps the whole network safe" to "Mixing clearnet with Onion access will make people unsafe." Tor is doing a good job with the mission purpose of providing one software application that allows an individual to communicate with the world, even inside of a nation that practices extreme censorship. But for the purposes of preventing the US, the largest and most prevalent state actor, from monitoring the entirety of the network? It seems to be failing. For the purpose of hiding the source of an onion website, the jury is still out. It appears that the US government has enough of a view into the Tor network that they're able to often deanonymize the hosting location of the backend server. They've been talking about refactoring the hidden service portion of the code for a long time now but I'm worried that all of the hits the project has taken lately will make that too little, too late.
- PeCaN 10y ago
  To be honest, that's far from the worst feedback you could get to a “JavaScript version of Tor”.
- ken__m 10y ago
  jesus was crucified because of attempt of tor on javascript
- frauch 10y ago
  jesus was crucified because of attempt of tor on javascript
- mike_hearn 10y ago
  If you're thinking about desktop apps, then one way to do it is simply ship a Java app that embeds WebKit (if you insist on using HTML even when a real widget toolkit is available). There is a Java Tor client available that can be embedded called Orchid, and then binding Orchid through to the Javascript world is not very difficult. It'd be a weird way to do things though. May as well just ship all needed data files and resources in the app itself. On the wider issue, I don't know if Tor is really doing such a great job of helping people in censoring states. Whenever I hear about Chinese people crossing the firewall it's always with VPNs and never Tor, which is thoroughly blocked for a long time now. One of the theories of Tor was that if there was lots of legitimate usage, it'd be harder to filter out Tor traffic ("anonymity loves company" they call it), but that goal was clearly better achieved using VPNs which impose minimal performance costs and has left Tor itself largely isolated. This sort of attack on the Tor network by large groups of malicious nodes is inevitable in a borderless community where there is no procedure for vetting or ID verifying new node operators. Tor assumes ideological loyalty from its node operators, that's a fundamental security assumption, but at the same time, a part of the Tor ideology is that there's no vetting procedure for nodes, nor are there any real rules for running them beyond a few trivial ones, and anyway without the former there's no way to enforce the latter. Tor is built on a giant contradiction, essentially. Of course that's not a problem unique to Tor. All communities that make majority trust assumptions without any way to control group membership have that problem. Bitcoin has suffered from this too, as has the British Labour party (which recently changed its rules to allow anyone to become a member by paying just £3, a move which immediately led to Corbyn and may yet lead to ~all existing MPs being fired and replaced by hard-left zealots).
Ixiaus 10y ago
GNUNet / SecuShare though it isn't quite mature enough...
- pdimitar 10y ago
  Thanks for the ping on those. I had them bookmarked but completely forgot about them. I'll check them out in more details.
kerkeslager 10y ago
> Isn't it obvious by now that Tor is outdated and instead of trying to repair it, something next-gen should be devised? No, it's not obvious. All evidence I know of indicates that compromises of anonymity have occurred at the web application layer (XSS, SQL injections causing servers to give out information they don't intend to share), the browser level (using HTTP instead of HTTPS, not disabling JavaScript, TorBrowser not patching vulnerabilities found in Firefox), or the human level (users giving out data that allows other people to figure out who they are). None of these breaches of anonymity are problems that Tor attempts to solve: Tor is only one part of an infrastructure that allows anonymity. > I am aware IPFS has limitations and that there are valid P2P attacks to which it either couldn't resist well (reduced capacity) or it could straight out give away its users IP addresses I don't know whether these problems with IPFS are real (I know little about it) but if it could straight out give away its users' IP addresses, it's completely useless as an alternative to Tor, to the point that I'm unsure why you're proposing it. > but hey, in my opinion Tor has been mostly compromised by authorities around the world and is currently widely used to persecute people Is this opinion based in any evidence? > Doesn't that mean that Tor has outlived its usefulness? You mentioned before "authorities around the world". I would not be surprised if some more technically capable governments (USA, Israel, China) have compromised Tor, but I would be extraordinarily surprised if even mid-level "authorities" even in those same countries has those capabilities. An exploit widely usable by many authorities would eventually become public knowledge. The fact that such an exploit has not become public knowledge leads me to believe that at least a significant number of the people you refer to as "authorities" don't have the capability to de-anonymize Tor. So maybe I don't trust Tor to protect me from the NSA, but there are a good many people I do trust it to protect me from. Especially since, like you, my reasons for using Tor are largely ideological rather than practical--I just don't want to be tracked, and Tor significantly decreases the number of actors capable of tracking me.
- pdimitar 10y ago
  I appreciate your response. The fact that Tor, or any other service that attempts to anonymize its user base, is hiding behind the "we can't promise you full anonymity" legal safety net, isn't helping any of us who want to be anonymous anyway. I understand they have legal issues to deal with and must use evasive language so as to be not eliminated easily by anyone disagreeing with them. Still, it doesn't help us the users either. As I pointed out, IPFS indeed has limitations, but same as Tor, if it doesn't get wider adoption, it won't ever become better. Being a programmer, I believe I can properly time the moment we should stop trying to repair something that looks like it's already working against us, and just start over. As a human being, I recognize I might be wrong and I agree with your counterpoint. I have no evidence that Tor is compromised, but if we're to believe what we're told via the official news, what another conclusion would you draw? It's an honest question, not an attempt to shift the burden of proof. Objectively speaking, I have no evidence or proof. If I had any, I think there's a reasonable chance I would be in prison because the FBI doesn't like citizens knowing how do they penetrate their cyber targets. Again, I agree with you. I know many possible malicious actors don't have the tech and/or the talent to deanonymize Tor users. But IMO the whole point is to make every single malicious actor powerless. In that regard, it seems Tor is failing a lot in the last 1 year.
ashitlerferad 10y ago
> Tor is outdated and instead of trying to repair it Tor is continually evolving and being researched and attacked and fixing vulnerabilities and so on goes the cycle.
white-flame 10y ago
The only "real" alternative out there is I2P. It's set up mostly as a darknet with a few HTTP proxies out to the clearnet; while Tor is focused more as an anonymous proxy to the clearnet, with lesser-used darknet features. I2P claims some of its design is more robust security-wise than Tor, but it also has a smaller userbase and fewer eyeballs on its source. It does have enough of a critical mass to be properly functional and have an ecosystem of usage, and is almost as old as Tor (2003 vs 2002).
- dmix 10y ago
  If I2P's codebase is anything like it's user interface I'd stay far away from it. I often see a correlation between caring for the UI and caring for the quality of code. Although most OSS is pretty bad UX wise , particularly security software. I also had a lot of trouble getting the it working properly. But the clearnet distinction you noted is interesting.
- pdimitar 10y ago
  I've never checked I2P in more details. Thanks for reminding me to research it.

kyboren 10y ago

I host multiple onion services, mainly for email proxies and firewall traversal, and this is exactly the reason I use stealth onion services. With this setup, only those client machines onto which I pre-load a cookie can decrypt a per-client encrypted copy of the "introduction point contact info" part of the descriptor. Malicious HSDirs wouldn't even know where to introduce themselves to my services, let alone the correct cookie for the INTRODUCE2 cells. If you want to host an onion service, but don't want it publicly accessible, use 'HiddenServiceAuthorizeClient'.

dmix 10y ago
This built into the tor server software? It parses cookies? This makes me want to learn how hidden services work. I'm curious how complex the code is.
- ryanlol 10y ago
  No, the cookie is set in the config file. Search for HidServAuth and HiddenServiceAuthorizeClient at https://www.torproject.org/docs/tor-manual.html.en https://www.torproject.org/docs/tor-manual.html.en for further elaboration.
  - dmix 10y ago
    Yes clearly the client needs to store a cookie somewhere (config files, db, browser) but the server needs to parse it in order to authenticate the user. Thanks for the link.