14 ms·

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This

Here is what I don't understand: Let's say I as a private individual fund 1000 tor nodes (guard and exit nodes included) and have them all log everything. This could cost less than $5000 for a month, with some time needed to get guard node status. I want to find a certain kind of person so I look for people that access a specific hidden service or clearnet url. Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? It will take a long time, and I can't target a specific person, but eventually I can find someone who has all three bounces through tor nodes I control, no?

gaba 2y ago
Tor Project has a team that looks at relays and checks if relays are engaging in bad practices or any suspicious activity like a lot of nodes run by one operator. https://community.torproject.org/relay/governance/ https://community.torproject.org/relay/governance/
- alasdair_ 2y ago
  Iran probably has enough money that it could pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions. This could all be automated pretty easily.
  - krunck 2y ago
    When you think about countries that have the resources to "pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions" your first thought was Iran?
    - alasdair_ 2y ago
      My first thought was actually "I could probably do that myself given some motivation" Hiring people on something like fiverr could take care of most of the manual part. My point is that if I could do it, a nation state cracking down on dissidents could likely do it too.
      - kaliqt 2y ago
        Like Israel, Germany, the UK, Brazil, etc. Iran really is not the first country that should come to anyone's mind given how far it is from home.
    - deleted 2y ago
      [deleted]
- hnisoss 2y ago
  how do you protect yourself from botnets? lets say just monkrus release was infected and now N-thousand teens are running infested windows installations and software tools..
_5hxt 2y ago
Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.
- system33- 2y ago
  It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …
  - beeflet 2y ago
    Why not just have greater number of relays by default? Internet bandwidth tends to increase over time, and the odds of this correlation attack are roughly proportional to the attacker's share of relays to the power of the number of relays used. So latency issues permitting, you would expect the default number of relays to increase over time to accommodate increases in attacker sophistication. I don't think many would mind waiting for a page to load for a minute if it increased privacy by 100x or 1000x.
    - system33- 2y ago
      If you’re advocating for a bigger network… we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while. Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant.
      - beeflet 2y ago
        >Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant. Because of timing attacks? There are ways to mitigate timing attacks if you are patient (but I think clearnet webservers are not very patient and my drop your connection)
ObsidianBreaks 2y ago
I wholeheartedly agree, the 'dragnet' methodology is already documented and well-known and that should factor into your security assessments.
scraptor 2y ago
If your nodes disclose their affiliation that's fine but the client will avoid using multiple. If you try to do this in secret the tor project will attempt to catch you by looking for suspicious nodes that use the same isp and update their tor version at the same time and things like that, to questionable success.
- pushupentry1219 2y ago
  But an adversary with enough money could just buy servers from multiple ISPs, right?
- vkou 2y ago
  State-level actors (five eyes) should have no problem with avoiding that kind of detection.
sigmoid10 2y ago
>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geographical considerations and instead just ask what is the probability that someone randomly chooses three nodes that you own. The answer is less than 0.14%. If that someone decided to use 4 nodes to be extra-safe, that number goes down to 0.015%. And it decreases exponentially for every additional relay he adds. Combine this with the fact that tor nodes are actively monitored and regularly vetted for malicious behaviour[1], and these attacks become increasingly difficult. Could someone like the NSA with limitless resources do it? Quite probably, sure. But could you or any other random guy do it? Almost certainly not. [1] https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Criteria-for-rejecting-bad-relays https://gitlab.torproject.org/tpo/network-health/team/-/wiki... Edit: For all the cynics and doomsayers here, consider this: Tor has been around for a long time, but there has never been an uptick in arrests that could be correlated to cracking the core anonymity service. If you look closely at the actual high profile cases where people got busted despite using tor, these people always made other mistakes that led authorities to them.
- mzs 2y ago
  So if there are greater than only 357 people on topics the GP is interested in that's better than 50/50 odds.
- whimsicalism 2y ago
  > Could someone like the NSA with limitless resources do it? Sure Yes, this is obviously the sort of adversary we would be discussing. > , lets also ignore that there are different types of nodes causing your number to be an underestimate > The answer is less than 0.14%. So almost certainly thousands of people
  - sigmoid10 2y ago
    >Yes, this is obviously the sort of adversary we would be discussing. OP explicitly asked about himself, not some government organisation. >causing your number to be an underestimate Not necessarily. It might even be an overestimate if the attacker fails to supply enough nodes of the right kind. >So almost certainly thousands of people We're talking about a targeted attack. Of course the statistics game works better when you don't target specific people and just fish randomly. But there are probably more cost effective methods as well.
donmcronald 2y ago
> Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? If you're looking for static assets, why would you need to see the whole chain? Wouldn't a connection to a known website (page) have a similar fingerprint even if you wrap it in 3 layers of encryption? Does Tor coalesce HTTP queries or something to avoid having someone fingerprint connections based on the number of HTTP requests and the relative latency of each request? I've always assumed that, if a global adversary attack works, you'd only need to watch one side if you're looking for connections to known static content. I don't know much beyond the high level idea of how Tor works, so I could be totally wrong.
- whimsicalism 2y ago
  ? tor reroutes the packets so how would you identify who is visiting who? it's not just 'layers of encryption' it is layers of redirection
  - donmcronald 2y ago
    If I visit facebook.com it's about 45 requests and 2.5MB of data. Are you saying that if I did that via Tor I would get a different circuit for each request or each individual packet? Eventually the guard has to send the whole payload to me, right? Wouldn't that look similar every time if there's no obfuscation?
    - whimsicalism 2y ago
      you mean inferring the website based on packet traffic pattern if you are the guard? yeah maybe possible, not sure how distinct each website footprint would be in practice seems like it would also be challenging to hold up in actual legal proceedings
      - donmcronald 2y ago
        > you mean inferring the website based on packet traffic pattern if you are the guard? Yeah, basically, but I was thinking that if you're analyzing a pattern going to the client, all you'd need is any point between the guard and the client (ie: an ISP).
jeffbee 2y ago
This attack is quite practical. In 2007 I controlled a huge chunk of Tor traffic from 2 racks of cheap servers in a basement on Folsom Street in SF. It was easy to arrange and nobody noticed. Yeah those were early days for Tor but I don't think scale changes anything. If you're using Tor because you think it is private, you have fooled yourself.
londons_explore 2y ago
You only need to control the entry and exit node - since you know the next and previous hop for all traffic you touch, and default chains are 3 long. With circuits changing every 10 mins, within a few days you would have deanonymized at least some percentage of traffic for nearly every user. I'd call tor broken against any adversary with a little technical skill and willingness to spend $5000. I'm 80% sure Tor is designed as a US supported project to focus those needing anonymity into a service only governments with global security apparatus (who can grab a good chunk of internet traffic) can access.
- k__ 2y ago
  How do you control an exit node? I had the impression, with onion services they are a thing of the past.
  - londons_explore 2y ago
    https://blog.torproject.org/tips-running-exit-node/ https://blog.torproject.org/tips-running-exit-node/
    - k__ 2y ago
      Ah, there are people who use Tor to access non-onion services. Got it. Seemed like onion services were created to solve the security issues that exit nodes bring, so I assumed people stopped using them and started running onion services instead.
      - AstralStorm 2y ago
        For the more scummier or illegal elements on the network, that is true. For onion services, lasering attacks and takeovers plus honeypot are the chief danger.
  - deleted 2y ago
    [deleted]
- bdw5204 2y ago
_yb2s 2y ago
The skilled labor to set that all up, especially in a way that TOR won't notice and shut you down will be worth much much more than $5k. People that have such a sophisticated and resourced team actively hunting them down, likely know about it, and are using many additional layers of security on top of TOR. Even just for personal use out of curiosity to "see what the darkweb is," I used 1-2 additional methods on top of TOR.
- lcnPylGDnU4H9OF 2y ago
  > used 1-2 additional methods on top of TOR Curious: what did you do and what were you hoping to mitigate?
  - _yb2s 2y ago
    Just playing around, not mitigating anything. I think it would be poor practice to share my ideas/techniques- think of your own! Contrary to popular philosophy- obscurity is a powerful security method. People still rob houses with expensive locks… nobody robs secret underground bunkers.
jiveturkey 2y ago
It'd be ten times that cost, easily. You have to buy data volume. Also since you aren't targetting specific people, rather specific interests, it'd be easier to setup an irresistible site serving content of the vice of interest. It can even be a thin wrapper on existing sites. Do you only need to control entry nodes in that case? You'll return user-identifying data in headers or steganographically encoded in images and since you control the entry node you can decrypt it. It doesn't work for a normal (unaffiliated) entry node but since your entry node is in collusion with the server I think this works.
emseetech 2y ago
Using Tor, like all security and privacy tools, must be balanced against what it is being used for. We will always live in a world of limited resources for policing, and systems of privacy work by increasing the difficulty and cost to deanonymize someone. They don't have to be perfect, they just have to be expensive. If you want basic anonymity while researching someone powerful or accessing information, it's extremely unlikely anyone is going to go the lengths people are bringing up here as a way to compromise Tor. The intersection of expertise, funding and time required is too great for such a low value target. If you're an international terrorist leader wanted in multiple countries, a prolific criminal, or enemy #1 of an authoritarian state though? Those who can go to those lengths absolutely will go to those lengths.
- slg 2y ago
  >If you want basic anonymity while researching someone powerful or accessing information, it's extremely unlikely anyone is going to go the lengths people are bringing up here as a way to compromise Tor. The intersection of expertise, funding and time required is too great for such a low value target. Doesn't a solid VPN service also satisfy this exact need? Tor seems to occupy a narrow niche in which you have to care much more about privacy than the average person, but not at a nation state level. I think that is how it got associated with that 2nd tier of internet crime like buying drugs on the dark web or sharing CSAM. The truly sophisticated internet criminals probably know better and the people who only really care about anonymizing themselves are probably doing something simpler.
  - bawolff 2y ago
    > Doesn't a solid VPN Finding a solid one is the hard part. With tor, you kind of know what you are buying. The risks are in the open. With VPN maybe the operator is selling your data to advertizers. Maybe they are keeping logs. You kind of have to just trust them and have no way to verify.
    - slg 2y ago
      This hypothetical was about "a low value target" looking for "basic anonymity". Just get Mullvad and assume the entire company wasn't a 15 year long con set up to better target ads at you specifically.
bragr 2y ago
>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation will just get you marked as a slow node and limit the number of connections you get. Sustaining just 1 Mbps will blow your monthly transfer allocation on the cheap tiers of both Digital Ocean or Linode. [1] https://blog.torproject.org/lifecycle-of-a-new-relay/ https://blog.torproject.org/lifecycle-of-a-new-relay/
- teaearlgraycold 2y ago
  Still easily within the budget of the US, Russia, China, Israel, etc. I wouldn't be surprised if a majority of nodes are ran by intelligence agencies.
  - darby_nine 2y ago
    In fact, you should assume they are. This doesn't imply the network doesn't have utility for a given actor.
  - bawolff 2y ago
    I think the threat model is that the majority are not run by cooperating malicious parties. Russia, china and usa all dont like each other much so are probably not sharing notes (in theory).
    - aftbit 2y ago
      Or perhaps they _are_ sharing notes about tor users with each other, as part of a global club of intelligence agencies (a sort of new world order) who would rather not be overthrown. How are we to know?
      - anticorporate 2y ago
plorg 2y ago
You didn't think someone would notice if the Tor network has 1000 new nodes setup similarly? Or, I suppose, if you find enough heterogenous people and pay them to log their nodes, you're not going to get noticed?
edm0nd 2y ago
Your 1000 Tor nodes would quickly be detected as bad relays and be removed from the network. It would also cost you far more than $5,000 a month.
voldacar 2y ago
With v3 hidden services, relays can no longer see the plaintext of the hidden service's url.
giantg2 2y ago
Wasn't there a thing years ago where the NSA only needed 2 out of the 3 nodes if they got the right ones? Not sure if that was fixed with guard nodes or is still a thing.
EmilyHughes 2y ago
This came out yesterday: https://www.youtube.com/watch?v=Gs0-8ZwZgwI https://www.youtube.com/watch?v=Gs0-8ZwZgwI Apparently in germany they caught a pedo like that. Watching certain nodes and the sizes of files that are sent between them to identify the admin of a pedophile image sharing forum. Took them 1 1/2 years to identify the specific person, but they got him. Considering this I would imagine it's pretty safe for the average user since they have to specifically target you for a long time, however it seems like with enough effort it's possible to identify someone even without Clearnet slip-ups like it was the case with Silkroad. Once they have your address they will just storm your house and catch you on the computer, then you are done for.
Refusing23 2y ago
But the more who use it and/or host tor nodes...
cookiengineer 2y ago
The issue that TOR has is that it's a layered routing concept that won't respect ASN based spreading/scattering of traffic. Circuits are temporary but the traffic is not scattered across the network to make MITM fingerprinting of request/payload sizes/timestamps impossible. A typical MITM like the FBI surveillance van next door can identify you by observing the network packets and by _when_ they were requested and by _how large_ the payloads were. There was a famous court case where this was enough evidence to identify a user of an onion service, without the FBI having access to the Wi-Fi of the user. But they had access to the exit node logs that were encrypted, the pcap logs to the onion service from that exit node, and the encrypted Wi-Fi packets of the user. (Also TLS lower than 1.3 and SNI related problems are relevant here, because DNS TTL 0 effectively makes everyone's privacy compromised, shame on you if you set a DNS TTL to 0) My point is that with more randomized hops across the network and across ASNs it would be less likely that a threat actor can control both guard and exit nodes. (Assuming that they parse RIR datasets to map organizations across ASNs, which the datasets already provide)
- runamuck 2y ago
  Would an Ethernet cable plugged into your ISP router defend against the above mentioned surveillance (i.e., no WiFi snooping)? Or did the FBI PCAP at the ISP?
  - cookiengineer 2y ago
    The problem is also that different network stack implementations have different MTU values and different TCP headers. There's a lot of tools available that can fingerprint different applications pretty well these days. For example, Firefox and TOR Browser can be fingerprinted because of their custom network library that's OS independent. It gets worse if you use a DSL2 connection with scaling because that will uniquely make your packets fingerprintable because they have a specific MTU size that's dependent of the length of the cable from modem to the next main hub. Same for cable internet, because the frequencies and spectrums that are used are also unique. (I'm clarifying this, because an FBI van not having access to your Wi-Fi still has access to the cable on the street when there's a warrant for surveillance / wire tapping issued) [1] https://github.com/NikolaiT/zardaxt https://github.com/NikolaiT/zardaxt (detects entropies of TCP headers and matches them with applications) [2] https://github.com/Nisitay/pyp0f https://github.com/Nisitay/pyp0f (detects the OS) [3] https://github.com/ValdikSS/p0f-mtu https://github.com/ValdikSS/p0f-mtu (detects the VPN provider)
taneq 2y ago
If you thought of this in 10 minutes (or 6 months, or...) as one smart individual, I'd assume any government of any country you've heard of has been doing this for a while.
jrochkind1 2y ago
I think so. And of course for a state-level actor, they can afford a couple orders of magnitude more spend prob too.
MagicMoonlight 2y ago
Yes it’s 100% going to be compromised if you are an enemy of the US government. The primary purpose of tor is for their own use, which is why they have developed and funded it. So the underlying principle is secure, but they’ll definitely be paying for enough of the nodes to compromise it for you.
instagib 2y ago
They have systems in place to eliminate large nodes coming online at the same time. There is some discussion about it in the blog post comments.

gaba 2y ago

Tor Project has a team that looks at relays and checks if relays are engaging in bad practices or any suspicious activity like a lot of nodes run by one operator. https://community.torproject.org/relay/governance/ https://community.torproject.org/relay/governance/

alasdair_ 2y ago
Iran probably has enough money that it could pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions. This could all be automated pretty easily.
- krunck 2y ago
  When you think about countries that have the resources to "pay a thousand different isps in a thousand different ways with a thousand different os versions and tor versions" your first thought was Iran?
  - alasdair_ 2y ago
    My first thought was actually "I could probably do that myself given some motivation" Hiring people on something like fiverr could take care of most of the manual part. My point is that if I could do it, a nation state cracking down on dissidents could likely do it too.
    - kaliqt 2y ago
      Like Israel, Germany, the UK, Brazil, etc. Iran really is not the first country that should come to anyone's mind given how far it is from home.
  - deleted 2y ago
    [deleted]
hnisoss 2y ago
how do you protect yourself from botnets? lets say just monkrus release was infected and now N-thousand teens are running infested windows installations and software tools..

_5hxt 2y ago

Yes, there aren’t that many tor nodes. It’s not the safe haven protocol or transport suite people make it out to be.

system33- 2y ago
It’s then best we’ve got for achieving actually meaningful privacy and anonymity. It has a huge body of research behind it that is regularly ignored by those coming up with sexy or off-the-cuff alternatives. It’s the most popular so it gets the most attention: from academics, criminals, law enforcement, journalists, …
- beeflet 2y ago
  Why not just have greater number of relays by default? Internet bandwidth tends to increase over time, and the odds of this correlation attack are roughly proportional to the attacker's share of relays to the power of the number of relays used. So latency issues permitting, you would expect the default number of relays to increase over time to accommodate increases in attacker sophistication. I don't think many would mind waiting for a page to load for a minute if it increased privacy by 100x or 1000x.
  - system33- 2y ago
    If you’re advocating for a bigger network… we need more relay operators. Can’t wave a magic wand. There’s like 8000 relays. Haven’t looked in a while. Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant.
    - beeflet 2y ago
      >Or if you were arguing for increasing the number of relays in a circuit, that doesn’t increase security. It’s like one of the OG tor research papers deciding on 3. Bad guy just needs the first and the last. Middle irrelevant. Because of timing attacks? There are ways to mitigate timing attacks if you are patient (but I think clearnet webservers are not very patient and my drop your connection)

ObsidianBreaks 2y ago

I wholeheartedly agree, the 'dragnet' methodology is already documented and well-known and that should factor into your security assessments.

scraptor 2y ago

If your nodes disclose their affiliation that's fine but the client will avoid using multiple. If you try to do this in secret the tor project will attempt to catch you by looking for suspicious nodes that use the same isp and update their tor version at the same time and things like that, to questionable success.

pushupentry1219 2y ago
But an adversary with enough money could just buy servers from multiple ISPs, right?
vkou 2y ago
State-level actors (five eyes) should have no problem with avoiding that kind of detection.

sigmoid10 2y ago

>Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? The word "eventually" is doing a lot of heavy lifting here. Let's say you actually manage to add 1000 servers to the tor network somehow without getting detected. The network currently sits at just under 8000 nodes. For simplicity, lets also ignore that there are different types of nodes and geographical considerations and instead just ask what is the probability that someone randomly chooses three nodes that you own. The answer is less than 0.14%. If that someone decided to use 4 nodes to be extra-safe, that number goes down to 0.015%. And it decreases exponentially for every additional relay he adds. Combine this with the fact that tor nodes are actively monitored and regularly vetted for malicious behaviour[1], and these attacks become increasingly difficult. Could someone like the NSA with limitless resources do it? Quite probably, sure. But could you or any other random guy do it? Almost certainly not. [1] https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Criteria-for-rejecting-bad-relays https://gitlab.torproject.org/tpo/network-health/team/-/wiki... Edit: For all the cynics and doomsayers here, consider this: Tor has been around for a long time, but there has never been an uptick in arrests that could be correlated to cracking the core anonymity service. If you look closely at the actual high profile cases where people got busted despite using tor, these people always made other mistakes that led authorities to them.

mzs 2y ago
So if there are greater than only 357 people on topics the GP is interested in that's better than 50/50 odds.
whimsicalism 2y ago
> Could someone like the NSA with limitless resources do it? Sure Yes, this is obviously the sort of adversary we would be discussing. > , lets also ignore that there are different types of nodes causing your number to be an underestimate > The answer is less than 0.14%. So almost certainly thousands of people
- sigmoid10 2y ago
  >Yes, this is obviously the sort of adversary we would be discussing. OP explicitly asked about himself, not some government organisation. >causing your number to be an underestimate Not necessarily. It might even be an overestimate if the attacker fails to supply enough nodes of the right kind. >So almost certainly thousands of people We're talking about a targeted attack. Of course the statistics game works better when you don't target specific people and just fish randomly. But there are probably more cost effective methods as well.

donmcronald 2y ago

> Surely eventually I'm going to get a hit where all three nodes in the circuit are my nodes that are logging everything? If you're looking for static assets, why would you need to see the whole chain? Wouldn't a connection to a known website (page) have a similar fingerprint even if you wrap it in 3 layers of encryption? Does Tor coalesce HTTP queries or something to avoid having someone fingerprint connections based on the number of HTTP requests and the relative latency of each request? I've always assumed that, if a global adversary attack works, you'd only need to watch one side if you're looking for connections to known static content. I don't know much beyond the high level idea of how Tor works, so I could be totally wrong.

whimsicalism 2y ago
? tor reroutes the packets so how would you identify who is visiting who? it's not just 'layers of encryption' it is layers of redirection
- donmcronald 2y ago
  If I visit facebook.com it's about 45 requests and 2.5MB of data. Are you saying that if I did that via Tor I would get a different circuit for each request or each individual packet? Eventually the guard has to send the whole payload to me, right? Wouldn't that look similar every time if there's no obfuscation?
  - whimsicalism 2y ago
    you mean inferring the website based on packet traffic pattern if you are the guard? yeah maybe possible, not sure how distinct each website footprint would be in practice seems like it would also be challenging to hold up in actual legal proceedings
    - donmcronald 2y ago
      > you mean inferring the website based on packet traffic pattern if you are the guard? Yeah, basically, but I was thinking that if you're analyzing a pattern going to the client, all you'd need is any point between the guard and the client (ie: an ISP).

jeffbee 2y ago

This attack is quite practical. In 2007 I controlled a huge chunk of Tor traffic from 2 racks of cheap servers in a basement on Folsom Street in SF. It was easy to arrange and nobody noticed. Yeah those were early days for Tor but I don't think scale changes anything. If you're using Tor because you think it is private, you have fooled yourself.

londons_explore 2y ago

You only need to control the entry and exit node - since you know the next and previous hop for all traffic you touch, and default chains are 3 long. With circuits changing every 10 mins, within a few days you would have deanonymized at least some percentage of traffic for nearly every user. I'd call tor broken against any adversary with a little technical skill and willingness to spend $5000. I'm 80% sure Tor is designed as a US supported project to focus those needing anonymity into a service only governments with global security apparatus (who can grab a good chunk of internet traffic) can access.

k__ 2y ago
How do you control an exit node? I had the impression, with onion services they are a thing of the past.
- londons_explore 2y ago
  https://blog.torproject.org/tips-running-exit-node/ https://blog.torproject.org/tips-running-exit-node/
  - k__ 2y ago
    Ah, there are people who use Tor to access non-onion services. Got it. Seemed like onion services were created to solve the security issues that exit nodes bring, so I assumed people stopped using them and started running onion services instead.
    - AstralStorm 2y ago
      For the more scummier or illegal elements on the network, that is true. For onion services, lasering attacks and takeovers plus honeypot are the chief danger.
- deleted 2y ago
  [deleted]
bdw5204 2y ago

_yb2s 2y ago

The skilled labor to set that all up, especially in a way that TOR won't notice and shut you down will be worth much much more than $5k. People that have such a sophisticated and resourced team actively hunting them down, likely know about it, and are using many additional layers of security on top of TOR. Even just for personal use out of curiosity to "see what the darkweb is," I used 1-2 additional methods on top of TOR.

lcnPylGDnU4H9OF 2y ago
> used 1-2 additional methods on top of TOR Curious: what did you do and what were you hoping to mitigate?
- _yb2s 2y ago
  Just playing around, not mitigating anything. I think it would be poor practice to share my ideas/techniques- think of your own! Contrary to popular philosophy- obscurity is a powerful security method. People still rob houses with expensive locks… nobody robs secret underground bunkers.

jiveturkey 2y ago

It'd be ten times that cost, easily. You have to buy data volume. Also since you aren't targetting specific people, rather specific interests, it'd be easier to setup an irresistible site serving content of the vice of interest. It can even be a thin wrapper on existing sites. Do you only need to control entry nodes in that case? You'll return user-identifying data in headers or steganographically encoded in images and since you control the entry node you can decrypt it. It doesn't work for a normal (unaffiliated) entry node but since your entry node is in collusion with the server I think this works.

emseetech 2y ago

Using Tor, like all security and privacy tools, must be balanced against what it is being used for. We will always live in a world of limited resources for policing, and systems of privacy work by increasing the difficulty and cost to deanonymize someone. They don't have to be perfect, they just have to be expensive. If you want basic anonymity while researching someone powerful or accessing information, it's extremely unlikely anyone is going to go the lengths people are bringing up here as a way to compromise Tor. The intersection of expertise, funding and time required is too great for such a low value target. If you're an international terrorist leader wanted in multiple countries, a prolific criminal, or enemy #1 of an authoritarian state though? Those who can go to those lengths absolutely will go to those lengths.

slg 2y ago
>If you want basic anonymity while researching someone powerful or accessing information, it's extremely unlikely anyone is going to go the lengths people are bringing up here as a way to compromise Tor. The intersection of expertise, funding and time required is too great for such a low value target. Doesn't a solid VPN service also satisfy this exact need? Tor seems to occupy a narrow niche in which you have to care much more about privacy than the average person, but not at a nation state level. I think that is how it got associated with that 2nd tier of internet crime like buying drugs on the dark web or sharing CSAM. The truly sophisticated internet criminals probably know better and the people who only really care about anonymizing themselves are probably doing something simpler.
- bawolff 2y ago
  > Doesn't a solid VPN Finding a solid one is the hard part. With tor, you kind of know what you are buying. The risks are in the open. With VPN maybe the operator is selling your data to advertizers. Maybe they are keeping logs. You kind of have to just trust them and have no way to verify.
  - slg 2y ago
    This hypothetical was about "a low value target" looking for "basic anonymity". Just get Mullvad and assume the entire company wasn't a 15 year long con set up to better target ads at you specifically.

bragr 2y ago

>This could cost less than $5000 for a month I ran a bunch of nodes for a couple years and that's optimistic by perhaps an order of magnitude. No $5 a month VPS provides enough bandwidth to sustain the monthly traffic of a Tor node, and nodes need to be continuously online and serving traffic for about 2-3 months[1] before they will be promoted to guard relays. Throttling traffic to stay in your bandwidth allocation will just get you marked as a slow node and limit the number of connections you get. Sustaining just 1 Mbps will blow your monthly transfer allocation on the cheap tiers of both Digital Ocean or Linode. [1] https://blog.torproject.org/lifecycle-of-a-new-relay/ https://blog.torproject.org/lifecycle-of-a-new-relay/

teaearlgraycold 2y ago
Still easily within the budget of the US, Russia, China, Israel, etc. I wouldn't be surprised if a majority of nodes are ran by intelligence agencies.
- darby_nine 2y ago
  In fact, you should assume they are. This doesn't imply the network doesn't have utility for a given actor.
- bawolff 2y ago
  I think the threat model is that the majority are not run by cooperating malicious parties. Russia, china and usa all dont like each other much so are probably not sharing notes (in theory).
  - aftbit 2y ago
    Or perhaps they _are_ sharing notes about tor users with each other, as part of a global club of intelligence agencies (a sort of new world order) who would rather not be overthrown. How are we to know?
    - anticorporate 2y ago

plorg 2y ago

You didn't think someone would notice if the Tor network has 1000 new nodes setup similarly? Or, I suppose, if you find enough heterogenous people and pay them to log their nodes, you're not going to get noticed?

edm0nd 2y ago

Your 1000 Tor nodes would quickly be detected as bad relays and be removed from the network. It would also cost you far more than $5,000 a month.

voldacar 2y ago

With v3 hidden services, relays can no longer see the plaintext of the hidden service's url.

giantg2 2y ago

Wasn't there a thing years ago where the NSA only needed 2 out of the 3 nodes if they got the right ones? Not sure if that was fixed with guard nodes or is still a thing.

EmilyHughes 2y ago

This came out yesterday: https://www.youtube.com/watch?v=Gs0-8ZwZgwI https://www.youtube.com/watch?v=Gs0-8ZwZgwI Apparently in germany they caught a pedo like that. Watching certain nodes and the sizes of files that are sent between them to identify the admin of a pedophile image sharing forum. Took them 1 1/2 years to identify the specific person, but they got him. Considering this I would imagine it's pretty safe for the average user since they have to specifically target you for a long time, however it seems like with enough effort it's possible to identify someone even without Clearnet slip-ups like it was the case with Silkroad. Once they have your address they will just storm your house and catch you on the computer, then you are done for.

Refusing23 2y ago

But the more who use it and/or host tor nodes...

cookiengineer 2y ago

The issue that TOR has is that it's a layered routing concept that won't respect ASN based spreading/scattering of traffic. Circuits are temporary but the traffic is not scattered across the network to make MITM fingerprinting of request/payload sizes/timestamps impossible. A typical MITM like the FBI surveillance van next door can identify you by observing the network packets and by _when_ they were requested and by _how large_ the payloads were. There was a famous court case where this was enough evidence to identify a user of an onion service, without the FBI having access to the Wi-Fi of the user. But they had access to the exit node logs that were encrypted, the pcap logs to the onion service from that exit node, and the encrypted Wi-Fi packets of the user. (Also TLS lower than 1.3 and SNI related problems are relevant here, because DNS TTL 0 effectively makes everyone's privacy compromised, shame on you if you set a DNS TTL to 0) My point is that with more randomized hops across the network and across ASNs it would be less likely that a threat actor can control both guard and exit nodes. (Assuming that they parse RIR datasets to map organizations across ASNs, which the datasets already provide)

runamuck 2y ago
Would an Ethernet cable plugged into your ISP router defend against the above mentioned surveillance (i.e., no WiFi snooping)? Or did the FBI PCAP at the ISP?
- cookiengineer 2y ago
  The problem is also that different network stack implementations have different MTU values and different TCP headers. There's a lot of tools available that can fingerprint different applications pretty well these days. For example, Firefox and TOR Browser can be fingerprinted because of their custom network library that's OS independent. It gets worse if you use a DSL2 connection with scaling because that will uniquely make your packets fingerprintable because they have a specific MTU size that's dependent of the length of the cable from modem to the next main hub. Same for cable internet, because the frequencies and spectrums that are used are also unique. (I'm clarifying this, because an FBI van not having access to your Wi-Fi still has access to the cable on the street when there's a warrant for surveillance / wire tapping issued) [1] https://github.com/NikolaiT/zardaxt https://github.com/NikolaiT/zardaxt (detects entropies of TCP headers and matches them with applications) [2] https://github.com/Nisitay/pyp0f https://github.com/Nisitay/pyp0f (detects the OS) [3] https://github.com/ValdikSS/p0f-mtu https://github.com/ValdikSS/p0f-mtu (detects the VPN provider)

taneq 2y ago

If you thought of this in 10 minutes (or 6 months, or...) as one smart individual, I'd assume any government of any country you've heard of has been doing this for a while.

jrochkind1 2y ago

I think so. And of course for a state-level actor, they can afford a couple orders of magnitude more spend prob too.

MagicMoonlight 2y ago

Yes it’s 100% going to be compromised if you are an enemy of the US government. The primary purpose of tor is for their own use, which is why they have developed and funded it. So the underlying principle is secure, but they’ll definitely be paying for enough of the nodes to compromise it for you.

instagib 2y ago

They have systems in place to eliminate large nodes coming online at the same time. There is some discussion about it in the blog post comments.