5 ms·

Tor Project – Metrics

62 points by Trouble_007 4y ago

superkuh 4y ago
https://www.encryptionin.space/tracking-hsdirs-and-the-version-of-tor-they-run https://www.encryptionin.space/tracking-hsdirs-and-the-versi... tracks the fraction of HSDirs that are v2 vs v3 and the likelyhood of any random attempt to resolve a tor v2 address failing. Right now it's about 30%. So the old tor v2 still sort of exists and if it continues like this it will exist until brute forcing prefix collisions becomes feasible for trivial amounts of money. Right now it still takes quite a bit. Or, maybe the Tor project sees tor v2 still has users that don't want to stop, they will release a version with a consensus flag to block old versions that support v2 from the tor project controlled section of the tor network. The tor project metrics used to have tor v2 and v3 overlayed on the same plots but now they're separate and the default date values are for v3 plotting, https://metrics.torproject.org/hidserv-rend-relayed-cells.html https://metrics.torproject.org/hidserv-rend-relayed-cells.ht...
jszymborski 4y ago
I wonder what's going on here with the v3 tor site traffic https://metrics.torproject.org/hidserv-rend-v3-relayed-cells.html https://metrics.torproject.org/hidserv-rend-v3-relayed-cells...
- tg180 4y ago
  It's probably related to a DDOS https://status.torproject.org/issues/2022-06-09-network-ddos/ https://status.torproject.org/issues/2022-06-09-network-ddos...
jacooper 4y ago
Its interesting that after the Ukraine invasion started, Tor bridges and relays haven't increased.
deleted 4y ago
[deleted]
nabakin 4y ago
Found a neat thing: Nearly 50% of Tor's Bridge users are from Russia[1] [1] https://metrics.torproject.org/userstats-bridge-table.html https://metrics.torproject.org/userstats-bridge-table.html
O__________O 4y ago
Anyone able to explain how Tor nodes (entry, relay, exit, bridges, onion/hidden service, etc) keep from getting hacked?
- edm0nd 4y ago
  There are scripts that run constantly to detect any malicious relays or exits (if they are MITMing or http downgrading attacks) and if detected they are quickly removed from the network. There are also dozens of volunteers who are monitoring for this activity as well and will report it. You could in theory hack an exit relay and do some dirty work from it and blame it on being a "Tor exit" without much consequences. I ran a Tor exit for 5 years before shutting it down over legal complaints. If you spun up an exit and let it run for a month or two and then did illegal stuff from it could be easy to hide and blame it on Tor.
  - O__________O 4y ago
    Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?
    - TechBro8615 4y ago
      I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.
booboofixer 4y ago
Anyone know how and why the start of covid relates to an increase in unique .onion addresses? https://metrics.torproject.org/hidserv-dir-onions-seen.html?start=2018-04-27&end=2022-07-26 https://metrics.torproject.org/hidserv-dir-onions-seen.html?...
- dsl 4y ago
  Unrelated. Spikes in new unique onion addresses are tied to ransomware groups, who have their victims use Tor to negotiate payments.
- superkuh 4y ago
  The Tor Project dropped support for tor v2 from their software in October, 2020. At that point in time there were still far more v2 sites and traffic than v3. Probably there were attempts to spin up a bunch of v3 stuff to make the forced drop of v2 support seem more reasonable.
ehPReth 4y ago
How hard would it be to enumerate v3 addresses? Say I have a server and only want 'those with the address' to connect (forgetting for a moment that mutual TLS etc exists)
tintedfireglass 4y ago
Am I the only one who runs tor node on an android OS? Looks like everyone is Linux or BSD

62 points by Trouble_007 4y ago

https://www.encryptionin.space/tracking-hsdirs-and-the-version-of-tor-they-run https://www.encryptionin.space/tracking-hsdirs-and-the-versi... tracks the fraction of HSDirs that are v2 vs v3 and the likelyhood of any random attempt to resolve a tor v2 address failing. Right now it's about 30%. So the old tor v2 still sort of exists and if it continues like this it will exist until brute forcing prefix collisions becomes feasible for trivial amounts of money. Right now it still takes quite a bit. Or, maybe the Tor project sees tor v2 still has users that don't want to stop, they will release a version with a consensus flag to block old versions that support v2 from the tor project controlled section of the tor network. The tor project metrics used to have tor v2 and v3 overlayed on the same plots but now they're separate and the default date values are for v3 plotting, https://metrics.torproject.org/hidserv-rend-relayed-cells.html https://metrics.torproject.org/hidserv-rend-relayed-cells.ht...

jszymborski 4y ago

I wonder what's going on here with the v3 tor site traffic https://metrics.torproject.org/hidserv-rend-v3-relayed-cells.html https://metrics.torproject.org/hidserv-rend-v3-relayed-cells...

tg180 4y ago
It's probably related to a DDOS https://status.torproject.org/issues/2022-06-09-network-ddos/ https://status.torproject.org/issues/2022-06-09-network-ddos...

jacooper 4y ago

Its interesting that after the Ukraine invasion started, Tor bridges and relays haven't increased.

deleted 4y ago

[deleted]

nabakin 4y ago

Found a neat thing: Nearly 50% of Tor's Bridge users are from Russia[1] [1] https://metrics.torproject.org/userstats-bridge-table.html https://metrics.torproject.org/userstats-bridge-table.html

O__________O 4y ago

Anyone able to explain how Tor nodes (entry, relay, exit, bridges, onion/hidden service, etc) keep from getting hacked?

edm0nd 4y ago
There are scripts that run constantly to detect any malicious relays or exits (if they are MITMing or http downgrading attacks) and if detected they are quickly removed from the network. There are also dozens of volunteers who are monitoring for this activity as well and will report it. You could in theory hack an exit relay and do some dirty work from it and blame it on being a "Tor exit" without much consequences. I ran a Tor exit for 5 years before shutting it down over legal complaints. If you spun up an exit and let it run for a month or two and then did illegal stuff from it could be easy to hide and blame it on Tor.
- O__________O 4y ago
  Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?
  - TechBro8615 4y ago
    I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.

booboofixer 4y ago

Anyone know how and why the start of covid relates to an increase in unique .onion addresses? https://metrics.torproject.org/hidserv-dir-onions-seen.html?start=2018-04-27&end=2022-07-26 https://metrics.torproject.org/hidserv-dir-onions-seen.html?...

dsl 4y ago
Unrelated. Spikes in new unique onion addresses are tied to ransomware groups, who have their victims use Tor to negotiate payments.
superkuh 4y ago
The Tor Project dropped support for tor v2 from their software in October, 2020. At that point in time there were still far more v2 sites and traffic than v3. Probably there were attempts to spin up a bunch of v3 stuff to make the forced drop of v2 support seem more reasonable.

ehPReth 4y ago

How hard would it be to enumerate v3 addresses? Say I have a server and only want 'those with the address' to connect (forgetting for a moment that mutual TLS etc exists)

tintedfireglass 4y ago

Am I the only one who runs tor node on an android OS? Looks like everyone is Linux or BSD