3 ms·

Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly he

Mainly talking about keeping the machines from being hacked, not the Tor traffic; as this would be the first step any 3rd-party attacker would take; commonly hear about attackers spinning up servers to run attacks, never heard of servers being attacked, which to me seems like an obvious thing to happen. ___ That said, since you mentioned it, if the counter-measure you’re describing are similar to the ones described here: https://security.stackexchange.com/questions/215155/how-does-tor-protect-against-mitm-attacks-between-the-client-and-relay-nodes https://security.stackexchange.com/questions/215155/how-does... What’s to stop an attacker from just swapping back to the approved key if a “Tor auditor” connects to the machine — or — routing only a know targets traffic to an mitm key?

TechBro8615 4y ago
I replied to your other comment, but I see what you mean now in this context. Why is hacking individual Tor nodes with a common exploit not a more common method of exploitation compared to Sybil attack? It’s a good question. Keep in mind that, while exit node IP addresses are public, it’s generally difficult (and sometimes impossible dependent on NAT) to enumerate all the IP addresses of non-exit nodes. You would need to operate a malicious directory server (probably not that hard) and/or crawl the DHT (new in v3, I’m not yet familiar with it). I believe Tor also has explicit mitigations against this sort of enumeration, by eg directory server hashing the first bits of the client IP with a nonce for the current time period. But I don’t know the details and it’s been a long time. It’s also worth noting that Zerodium has quite a large bounty for targeted deanonymization of Tor users.