5 ms·

Anyone able to explain how Tor nodes (entry, relay, exit, bridges, onion/hidden service, etc) keep from getting hacked?

edm0nd 4y ago
There are scripts that run constantly to detect any malicious relays or exits (if they are MITMing or http downgrading attacks) and if detected they are quickly removed from the network. There are also dozens of volunteers who are monitoring for this activity as well and will report it. You could in theory hack an exit relay and do some dirty work from it and blame it on being a "Tor exit" without much consequences. I ran a Tor exit for 5 years before shutting it down over legal complaints. If you spun up an exit and let it run for a month or two and then did illegal stuff from it could be easy to hide and blame it on Tor.
- O__________O 4y ago
  Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?
  - TechBro8615 4y ago
    I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.
TechBro8615 4y ago
You should assume every Tor instance is hacked. You should be concerned if a bridge is malicious and slightly concerned if an exit node is malicious. You can protect yourself by using application layer encryption like TLS which you can enforce with HTTPS Everywhere (an extension now included by default in the Tor Browser Bundle, anyway). Frankly you should assume that all your traffic over Tor to clearnet is deanonymizable and you should act accordingly. For browsing Onion sites, you can be more confident in the integrity of your traffic, but keep in mind you also need to trust the operator of that Onion site not to get hacked or otherwise surrender whatever data you provide to them.
- O__________O 4y ago
  Possible missing something, but most of your response is what a user should do, not how nodes themselves secure themselves. Personally, I neither use Tor, nor would suggest anyone use it; that’s not really topic of this thread though.
  - TechBro8615 4y ago
    Well, I certainly do have a propensity for replying to HN comments with tangentially related rants. Is there any other way to use HN? :) In this case though, I guess I was challenging the idea that many Tor instances are _not_ hacked. And more-so, I wanted to clarify that the risk of using Tor is decoupled from whether any individual Tor nodes have been hacked. If a malicious actor can figure out how to slowly and quietly deploy a sufficiently high number of their own malicious nodes to the network, then they can compromise the anonymity guarantees of the network even while maintaining a fleet of perfectly secure machines.
    - O__________O 4y ago
      Common knowledge that it’s vulnerability, and hacking is not required to gain significant control over network: https://s3.documentcloud.org/documents/2719591/Farrell-Weds.pdf https://s3.documentcloud.org/documents/2719591/Farrell-Weds.... Again, topic is if what if anything Tor does to secure the nodes themselves.

There are scripts that run constantly to detect any malicious relays or exits (if they are MITMing or http downgrading attacks) and if detected they are quickly removed from the network. There are also dozens of volunteers who are monitoring for this activity as well and will report it. You could in theory hack an exit relay and do some dirty work from it and blame it on being a "Tor exit" without much consequences. I ran a Tor exit for 5 years before shutting it down over legal complaints. If you spun up an exit and let it run for a month or two and then did illegal stuff from it could be easy to hide and blame it on Tor.

O__________O 4y ago
Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?
- TechBro8615 4y ago
  I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.

TechBro8615 4y ago

You should assume every Tor instance is hacked. You should be concerned if a bridge is malicious and slightly concerned if an exit node is malicious. You can protect yourself by using application layer encryption like TLS which you can enforce with HTTPS Everywhere (an extension now included by default in the Tor Browser Bundle, anyway). Frankly you should assume that all your traffic over Tor to clearnet is deanonymizable and you should act accordingly. For browsing Onion sites, you can be more confident in the integrity of your traffic, but keep in mind you also need to trust the operator of that Onion site not to get hacked or otherwise surrender whatever data you provide to them.

O__________O 4y ago
Possible missing something, but most of your response is what a user should do, not how nodes themselves secure themselves. Personally, I neither use Tor, nor would suggest anyone use it; that’s not really topic of this thread though.
- TechBro8615 4y ago
  Well, I certainly do have a propensity for replying to HN comments with tangentially related rants. Is there any other way to use HN? :) In this case though, I guess I was challenging the idea that many Tor instances are _not_ hacked. And more-so, I wanted to clarify that the risk of using Tor is decoupled from whether any individual Tor nodes have been hacked. If a malicious actor can figure out how to slowly and quietly deploy a sufficiently high number of their own malicious nodes to the network, then they can compromise the anonymity guarantees of the network even while maintaining a fleet of perfectly secure machines.
  - O__________O 4y ago
    Common knowledge that it’s vulnerability, and hacking is not required to gain significant control over network: https://s3.documentcloud.org/documents/2719591/Farrell-Weds.pdf https://s3.documentcloud.org/documents/2719591/Farrell-Weds.... Again, topic is if what if anything Tor does to secure the nodes themselves.