6 ms·

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your hea

at our lab the tor traffic would be noticed by the cyber security group's ids and all traffic from your host would start dropping at the border so fast your head would spin. you'd get an unpleasant phone call or visit to your office and be warned never to try side stepping the bastion ssh hosts that log all the things ever again.

derefr 5y ago
Obviously, you should plan around this by gathering all the MAC addresses of every machine in the office, and then have your machine spoof through them in rotation. /s
- sillysaurusx 5y ago
  It makes me sad every time I think about it, but Aaron Swartz did this during his saga. Well, sort of: he incremented the MAC address by 1. Point being, it's not foolproof. If some clever undergrad is thinking about dodging the suits, win by fooling them, not by fighting them. If you do insist on fighting, though, start at https://www.whonix.org/wiki/Mental_Model https://www.whonix.org/wiki/Mental_Model and then read the entire Whonix wiki https://www.whonix.org/wiki/Documentation https://www.whonix.org/wiki/Documentation. It's what I used when I was serious about dodging the cartels, and that knowledge will protect you as much as anything will. (You'll hopefully conclude that the protection is too brittle to risk your life, as I did.)
  - nqzero 5y ago
    building a new computer. want to be able to trust it 100% for at least a moment. i can't figure out how to "buy" a trusted copy of any linux and don't have any machines i have 100% trust in (who does), so can't burn it. current plan is to buy a chromebook solely for the purpose of downloading and burning ubuntu. alternatively, buy MSWindows, install on the new machine, burn, and then replace but this mental exercise has convinced me that security is almost impossible in this day and age
    - sillysaurusx 5y ago
      One thing that helps a lot in this situation is to plan based on threat model. There’s no such thing as 100% trust, but you can have a computer which is safe for e.g. <thing>. It’s pretty crucial to pick one or two specific <thing>s and focus only on those. If you just want to browse the darknet and see what the markets are like, for example, Tor on your current computers is fine. If you’re wanting to make a purchase and you’re worried that your existing computers will narc on you, your plan of buy laptop + use ubuntu is A+. If you want a computer to store information on, Edward Snowden style, you’ll need to take increasingly serious steps. Use tails as a baseline. (Note: I’ve been out of the game since 2016, so take this with salt.) If you’re literally dodging the NSA, you need to put on a full face mask in winter, plan a route to a store you’ve recon’d, buy clothes with cash from goodwill, carry them in a trash bag as you walk out of your neighborhood, sneak in between two houses in the dead of night and put the outfit on + mask, walk to a taxi, have it take you near (but not to) the electronics store, buy yourself a burner phone + a few USB wifi dongles + anything else you want completely unlinkable to you (you’re on cameras), pay for all of it while getting some strange and worried looks that you’re going to rob something, then do the entire process in reverse until you’re back at your house with your untraceable electronics. I did all that, and even then I was likely making some small mistake that would’ve blown everything. Yet the city wide surveillance drones (god eye) will still have a nice little record of you that they can ID you with. And you sneaking around in the middle of the night putting on masks will probably get you in serious trouble. It never really occurs to you when you’re doing this sort of thing to stop and consider whether you’re just doing crazy things. (It’s tempting to believe the answer is “no,” especially the more you want to believe it.) Suffice to say, threat modeling is key, and it’s worth thinking carefully about what exactly you want to accomplish.
      - derefr 5y ago
        > If you’re literally dodging the NSA, you need to... Or just make friends with an developing-world advance-fee scammer, and then pay them to have one of their cash mules buy and send you (that is, an empty house somewhere in your city) a laptop.
marcodiego 5y ago
Is tor traffic that easy to detect?
- blendergeek 5y ago
  Yes. It goes to a known tor node.
  - rnhmjoj 5y ago
    Not necessarily true. Tor bridges exist precisely for this reason: https://tb-manual.torproject.org/bridges/ https://tb-manual.torproject.org/bridges/
- Forbo 5y ago
  Relay and exit node IPs aren't private, so admins will often collect them and just block them en masse. This causes problems, because a lot of that same IP space will often be shared with things like pool.ntp.org nodes.
- tga_d 5y ago
  By default Tor doesn't make any attempt to disguise the fact it's Tor traffic. Bridges are unlisted relays, which should work for IP blocking, while Plugable Transports are made to evade censorship-focused traffic analysis (i.e., they will prevent the adversary from detecting and blocking Tor connections as a whole, but not prevent a dedicated adversary from figuring out "has this client been using Tor?").
rattlesnakedave 5y ago
> you'd get an unpleasant phone call or visit to your office and be warned sometimes I wonder why IT departments and security in general get a bad wrap, then I see things like this.
- relax88 5y ago
  When someone just does whatever they feel like and violates policy, what do you think should happen? Should someone send them a sternly worded email for them to ignore? Or maybe they should be allowed to do whatever they want regardless of what risk it poses to the organization?
  - azalemeth 5y ago
    Why do people break rules? In that situation, I'd argue that education and understanding is the appropriate response -- for people on both sides of the table.
azalemeth 5y ago
The meek pluggable transport together with Azure's domain fronting service explicitly makes it look like it's connecting to an Azure instance over https. [1] [1] https://gitlab.torproject.org/legacy/trac/-/wikis/doc/meek https://gitlab.torproject.org/legacy/trac/-/wikis/doc/meek
relax88 5y ago
I can confirm as someone who works in netsec that this exactly how it would have gone at my previous employer. There is a tone of “I know what’s best and will do what I want” in this thread. If you think that the way to get the IT department to implement something for you is to sidestep around policy instead of working with them, you will just piss them off.

derefr 5y ago

Obviously, you should plan around this by gathering all the MAC addresses of every machine in the office, and then have your machine spoof through them in rotation. /s

sillysaurusx 5y ago
It makes me sad every time I think about it, but Aaron Swartz did this during his saga. Well, sort of: he incremented the MAC address by 1. Point being, it's not foolproof. If some clever undergrad is thinking about dodging the suits, win by fooling them, not by fighting them. If you do insist on fighting, though, start at https://www.whonix.org/wiki/Mental_Model https://www.whonix.org/wiki/Mental_Model and then read the entire Whonix wiki https://www.whonix.org/wiki/Documentation https://www.whonix.org/wiki/Documentation. It's what I used when I was serious about dodging the cartels, and that knowledge will protect you as much as anything will. (You'll hopefully conclude that the protection is too brittle to risk your life, as I did.)
- nqzero 5y ago
  building a new computer. want to be able to trust it 100% for at least a moment. i can't figure out how to "buy" a trusted copy of any linux and don't have any machines i have 100% trust in (who does), so can't burn it. current plan is to buy a chromebook solely for the purpose of downloading and burning ubuntu. alternatively, buy MSWindows, install on the new machine, burn, and then replace but this mental exercise has convinced me that security is almost impossible in this day and age
  - sillysaurusx 5y ago
    One thing that helps a lot in this situation is to plan based on threat model. There’s no such thing as 100% trust, but you can have a computer which is safe for e.g. <thing>. It’s pretty crucial to pick one or two specific <thing>s and focus only on those. If you just want to browse the darknet and see what the markets are like, for example, Tor on your current computers is fine. If you’re wanting to make a purchase and you’re worried that your existing computers will narc on you, your plan of buy laptop + use ubuntu is A+. If you want a computer to store information on, Edward Snowden style, you’ll need to take increasingly serious steps. Use tails as a baseline. (Note: I’ve been out of the game since 2016, so take this with salt.) If you’re literally dodging the NSA, you need to put on a full face mask in winter, plan a route to a store you’ve recon’d, buy clothes with cash from goodwill, carry them in a trash bag as you walk out of your neighborhood, sneak in between two houses in the dead of night and put the outfit on + mask, walk to a taxi, have it take you near (but not to) the electronics store, buy yourself a burner phone + a few USB wifi dongles + anything else you want completely unlinkable to you (you’re on cameras), pay for all of it while getting some strange and worried looks that you’re going to rob something, then do the entire process in reverse until you’re back at your house with your untraceable electronics. I did all that, and even then I was likely making some small mistake that would’ve blown everything. Yet the city wide surveillance drones (god eye) will still have a nice little record of you that they can ID you with. And you sneaking around in the middle of the night putting on masks will probably get you in serious trouble. It never really occurs to you when you’re doing this sort of thing to stop and consider whether you’re just doing crazy things. (It’s tempting to believe the answer is “no,” especially the more you want to believe it.) Suffice to say, threat modeling is key, and it’s worth thinking carefully about what exactly you want to accomplish.
    - derefr 5y ago
      > If you’re literally dodging the NSA, you need to... Or just make friends with an developing-world advance-fee scammer, and then pay them to have one of their cash mules buy and send you (that is, an empty house somewhere in your city) a laptop.

marcodiego 5y ago

Is tor traffic that easy to detect?

blendergeek 5y ago
Yes. It goes to a known tor node.
- rnhmjoj 5y ago
  Not necessarily true. Tor bridges exist precisely for this reason: https://tb-manual.torproject.org/bridges/ https://tb-manual.torproject.org/bridges/
Forbo 5y ago
Relay and exit node IPs aren't private, so admins will often collect them and just block them en masse. This causes problems, because a lot of that same IP space will often be shared with things like pool.ntp.org nodes.
tga_d 5y ago
By default Tor doesn't make any attempt to disguise the fact it's Tor traffic. Bridges are unlisted relays, which should work for IP blocking, while Plugable Transports are made to evade censorship-focused traffic analysis (i.e., they will prevent the adversary from detecting and blocking Tor connections as a whole, but not prevent a dedicated adversary from figuring out "has this client been using Tor?").

rattlesnakedave 5y ago

> you'd get an unpleasant phone call or visit to your office and be warned sometimes I wonder why IT departments and security in general get a bad wrap, then I see things like this.

relax88 5y ago
When someone just does whatever they feel like and violates policy, what do you think should happen? Should someone send them a sternly worded email for them to ignore? Or maybe they should be allowed to do whatever they want regardless of what risk it poses to the organization?
- azalemeth 5y ago
  Why do people break rules? In that situation, I'd argue that education and understanding is the appropriate response -- for people on both sides of the table.

azalemeth 5y ago

The meek pluggable transport together with Azure's domain fronting service explicitly makes it look like it's connecting to an Azure instance over https. [1] [1] https://gitlab.torproject.org/legacy/trac/-/wikis/doc/meek https://gitlab.torproject.org/legacy/trac/-/wikis/doc/meek

relax88 5y ago

I can confirm as someone who works in netsec that this exactly how it would have gone at my previous employer. There is a tone of “I know what’s best and will do what I want” in this thread. If you think that the way to get the IT department to implement something for you is to sidestep around policy instead of working with them, you will just piss them off.