7 ms·

Potentially I am misunderstanding how Tor's onion routing works, but according to https://metrics.torproject.org/networksize.html https://metrics.torproject.org

Potentially I am misunderstanding how Tor's onion routing works, but according to https://metrics.torproject.org/networksize.html https://metrics.torproject.org/networksize.html there are about 6000 tor relays right now. Surely if some well funded organisation (Eve) were to install a similar number of relays itself, then it is reasonably likely that for a given user a packet would eventually travel across relays solely owned by Eve, and at that point Eve could map a Tor address to a physical IP? Operating 6000 nodes in a manner unlikely to cause suspicion , and correlating packets across those nodes, is a massive undertaking, but it seems that it would be well within the means of e.g. NSA. Would this work, or am I missing something fundamental about how Tor works?

xvector 7y ago
I believe this would work, and is one of the weak points of the ecosystem. I wonder what the impact of spinning up 6K relays in AWS across the globe would be like. I would say that spinning up 6K instances would be affordable for even small companies.
- steeleduncan 7y ago
  Yes, the cost wouldn't be prohibitive. It is not hard to see how it could be profitable for a small security company to do this and sell the information on.
- noident 7y ago
  You can't just spin up 6k new relays and take over the Tor network without somebody noticing. The network is actively monitored for sybil attacks, and it takes 2+ weeks before a new node is "trusted" with significant traffic, giving network monitors plenty of time to blacklist you. What's going to kill Tor is a global passive adversary, meaning someone with perfect visibility of all traffic going in and out of Tor nodes by tapping network infrastructure and correlating at the endpoints. I'm sure the NSA is working on this. They couldn't do it in 2013, but what could they have accomplished in the 6 years since the Snowden leaks? It's also possible to use machine learning to "fingerprint" encrypted blobs entering guard nodes and correlate them with websites (even onion services!), although it gets less feasible as the set of potential websites increases.
coolspot 7y ago
That’s supposedly how silkroad was traced down. There was unusual spike of new nodes months before silkroad admin was caught. Official version is website bug tho.
- blotter_paper 7y ago
  I dunno which Silk Road you're talking about, but the story we're supposed to believe regarding the first Silk Road is that Ulbricht used the name "altoid" both when announcing the site initially and before that on a programming forum in association with an email address tied to his real name. I believe that he really was that sloppy, but I'm still skeptical that this story isn't a parallel construction.
oil25 7y ago
You're not missing anything - Tor is not designed to defend against a global passive network observer. > A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic […] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...
edm0nd 7y ago
Relays that are detected or flagged as malicious get quickly removed from the network, https://trac.torproject.org/projects/tor/wiki/doc/badRelays https://trac.torproject.org/projects/tor/wiki/doc/badRelays More reading: https://blog.torproject.org/how-report-bad-relays https://blog.torproject.org/how-report-bad-relays
- steeleduncan 7y ago
  That page talks about malicious relays in the sense that they spoil traffic either through incompetence or malfeasance. What I am thinking about is the hypothetical case that 3000 of the 6000 active relays today had been started and operated by Eve over the last few years according to Tor guidelines and without any external sign that the nodes were centrally controlled. If that were true it would be hard for a user to detect, and it seems to me that Eve would be able to reasonably easily break the privacy protection of Tor.
  - als0 7y ago
    You’re not misunderstanding Tor. Indeed, if you control more than 50% of the nodes then you can feasibly deanonymize clients. Tor circuits tend to go through many countries and rarely do they go through the same country twice. Not sure if this is part of the node selection criteria. But if you can’t have two nodes within a circuit go through the same country, and someone identifies you, then you’re dealing with a hell of a global adversary. FWIW I think many people are concerned more about being monitored by their local governments rather than foreign ones.
    - viraptor 7y ago
      > But if you can’t have two nodes within a circuit go through the same country, and someone identifies you, then you’re dealing with a hell of a global adversary. You can do that with a credit card and AWS. Setting up server presence in multiple countries is trivial. Setting up enough of them is expensive.
    - x220 7y ago
      Sure, but if the CIA, NSA, FBI, UK, China, and Russia are all trying to control nodes, they keep each other from getting a useful share of the nodes. There are many parties that would want to deanonymize the traffic.

xvector 7y ago

I believe this would work, and is one of the weak points of the ecosystem. I wonder what the impact of spinning up 6K relays in AWS across the globe would be like. I would say that spinning up 6K instances would be affordable for even small companies.

steeleduncan 7y ago
Yes, the cost wouldn't be prohibitive. It is not hard to see how it could be profitable for a small security company to do this and sell the information on.
noident 7y ago
You can't just spin up 6k new relays and take over the Tor network without somebody noticing. The network is actively monitored for sybil attacks, and it takes 2+ weeks before a new node is "trusted" with significant traffic, giving network monitors plenty of time to blacklist you. What's going to kill Tor is a global passive adversary, meaning someone with perfect visibility of all traffic going in and out of Tor nodes by tapping network infrastructure and correlating at the endpoints. I'm sure the NSA is working on this. They couldn't do it in 2013, but what could they have accomplished in the 6 years since the Snowden leaks? It's also possible to use machine learning to "fingerprint" encrypted blobs entering guard nodes and correlate them with websites (even onion services!), although it gets less feasible as the set of potential websites increases.

coolspot 7y ago

That’s supposedly how silkroad was traced down. There was unusual spike of new nodes months before silkroad admin was caught. Official version is website bug tho.

blotter_paper 7y ago
I dunno which Silk Road you're talking about, but the story we're supposed to believe regarding the first Silk Road is that Ulbricht used the name "altoid" both when announcing the site initially and before that on a programming forum in association with an email address tied to his real name. I believe that he really was that sloppy, but I'm still skeptical that this story isn't a parallel construction.

oil25 7y ago

You're not missing anything - Tor is not designed to defend against a global passive network observer. > A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic […] https://svn.torproject.org/svn/projects/design-paper/tor-design.html https://svn.torproject.org/svn/projects/design-paper/tor-des...

edm0nd 7y ago

Relays that are detected or flagged as malicious get quickly removed from the network, https://trac.torproject.org/projects/tor/wiki/doc/badRelays https://trac.torproject.org/projects/tor/wiki/doc/badRelays More reading: https://blog.torproject.org/how-report-bad-relays https://blog.torproject.org/how-report-bad-relays

steeleduncan 7y ago
That page talks about malicious relays in the sense that they spoil traffic either through incompetence or malfeasance. What I am thinking about is the hypothetical case that 3000 of the 6000 active relays today had been started and operated by Eve over the last few years according to Tor guidelines and without any external sign that the nodes were centrally controlled. If that were true it would be hard for a user to detect, and it seems to me that Eve would be able to reasonably easily break the privacy protection of Tor.
- als0 7y ago
  You’re not misunderstanding Tor. Indeed, if you control more than 50% of the nodes then you can feasibly deanonymize clients. Tor circuits tend to go through many countries and rarely do they go through the same country twice. Not sure if this is part of the node selection criteria. But if you can’t have two nodes within a circuit go through the same country, and someone identifies you, then you’re dealing with a hell of a global adversary. FWIW I think many people are concerned more about being monitored by their local governments rather than foreign ones.
  - viraptor 7y ago
    > But if you can’t have two nodes within a circuit go through the same country, and someone identifies you, then you’re dealing with a hell of a global adversary. You can do that with a credit card and AWS. Setting up server presence in multiple countries is trivial. Setting up enough of them is expensive.
  - x220 7y ago
    Sure, but if the CIA, NSA, FBI, UK, China, and Russia are all trying to control nodes, they keep each other from getting a useful share of the nodes. There are many parties that would want to deanonymize the traffic.