4 ms·

There are scripts that run constantly to detect any malicious relays or exits (if they are MITMing or http downgrading attacks) and if detected they are quickly

by edm0nd 4y ago

There are scripts that run constantly to detect any malicious relays or exits (if they are MITMing or http downgrading attacks) and if detected they are quickly removed from the network. There are also dozens of volunteers who are monitoring for this activity as well and will report it. You could in theory hack an exit relay and do some dirty work from it and blame it on being a "Tor exit" without much consequences. I ran a Tor exit for 5 years before shutting it down over legal complaints. If you spun up an exit and let it run for a month or two and then did illegal stuff from it could be easy to hide and blame it on Tor.

O__________O 4y ago
Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?
- TechBro8615 4y ago
  I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.

by edm0nd 4y ago

O__________O 4y ago

Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?

TechBro8615 4y ago
I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.