3 ms·

How do you know if traffic is from a Tor exit node? Is there a giant list of exit nodes kept somewhere that can be referred to? For that matter, if I'm using

How do you know if traffic is from a Tor exit node? Is there a giant list of exit nodes kept somewhere that can be referred to? For that matter, if I'm using TOR does the ISP have anyway to know that? I know they can't get to the contents of what I'm sending, but does the data look like different to "normal" internet use in a way that could be detected and filtered?

jrockway 14y ago
Yes, there's a list of exit nodes. Which machines are exit nodes is not supposed to be secret and could be easily derived by an interested party. (Send a bunch of requests to your web server over Tor. Observe the list of IPs making requests.) http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_E... And yes, ISPs could detect Tor traffic if they wanted to.
- DrStalker 14y ago
  Could Tor traffic be encapsulated in HTTPS to stop ISPs from identifying it, or would they still be able to either identify the traffic as Tor or identify the relay nodes and block access to them? I'm curious if the Japanese proposal is even possible, or if it's another political policy that isn't supported by technology like Australia's proposed internet censorship system (which was eventually abandoned)
  - cdjk 14y ago
    That's a complicated question. This talk from CCC in 2011 addresses some of the points (and is very interesting in it's own right): http://www.youtube.com/watch?v=GwMr8Xl7JMQ http://www.youtube.com/watch?v=GwMr8Xl7JMQ Tor already uses SSL, so I'm not sure how valuable encapsulating it in HTTPS would be. In fact (and this is from memory, so I may be wrong), some governments were able to block Tor by looking at certificate expiry date - Tor uses short lived certificates, but no real https site is going to use an ssl cert that expires in a couple hours. There were some other ways to fingerprint Tor traffic, but I'd have to watch the video again to remember. The Tor developers also apparently have a list of potential ways to identify Tor traffic, but haven't fixed all of them because they're waiting for evidence that they're being used to block Tor traffic first. As for relays - the bridge system addresses that. It's difficult or impossible to compile a complete list of bridge nodes, so that method should be pretty effective. It's also possible to run a "private" bridge and share it out of band with other. That method certainly should make relay identification extremely difficult.
  - Pitarou 14y ago
    I don't think they're proposing to block the PROTOCOL. (Is it even possible to reliably distinguish Tor traffic from other encrypted traffic?) Rather, I think they're proposing to block all packets being sent to known Tor end-nodes. Of course, miscreants can get around this by bouncing their packets off a relay outside Japan. This will actually HELP Japanese criminals who go to the trouble of using a relay. When they cause trouble, the first response of the authorities will be, "This is the work of foreign criminals." (A common scapegoat, alas.) "It can't possibly be coming from Japan, because we've blocked Tor." (and we're certainly not going to admit that our firewall leaks)
hobs 14y ago
I remember that iron geek has a few talks about this, and specifically about different ways to leak information in a darknet, usually protocols that dont respect what the browser is trying to accomplish, and depending how your tor traffic is setup (browser plugin), may lead someone directly to you. Anyway, here's his fairly simple php script: http://www.irongeek.com/i.php?page=security/detect-tor-exit-node-in-php http://www.irongeek.com/i.php?page=security/detect-tor-exit-...

jrockway 14y ago

Yes, there's a list of exit nodes. Which machines are exit nodes is not supposed to be secret and could be easily derived by an interested party. (Send a bunch of requests to your web server over Tor. Observe the list of IPs making requests.) http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv http://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_E... And yes, ISPs could detect Tor traffic if they wanted to.

DrStalker 14y ago
Could Tor traffic be encapsulated in HTTPS to stop ISPs from identifying it, or would they still be able to either identify the traffic as Tor or identify the relay nodes and block access to them? I'm curious if the Japanese proposal is even possible, or if it's another political policy that isn't supported by technology like Australia's proposed internet censorship system (which was eventually abandoned)
- cdjk 14y ago
  That's a complicated question. This talk from CCC in 2011 addresses some of the points (and is very interesting in it's own right): http://www.youtube.com/watch?v=GwMr8Xl7JMQ http://www.youtube.com/watch?v=GwMr8Xl7JMQ Tor already uses SSL, so I'm not sure how valuable encapsulating it in HTTPS would be. In fact (and this is from memory, so I may be wrong), some governments were able to block Tor by looking at certificate expiry date - Tor uses short lived certificates, but no real https site is going to use an ssl cert that expires in a couple hours. There were some other ways to fingerprint Tor traffic, but I'd have to watch the video again to remember. The Tor developers also apparently have a list of potential ways to identify Tor traffic, but haven't fixed all of them because they're waiting for evidence that they're being used to block Tor traffic first. As for relays - the bridge system addresses that. It's difficult or impossible to compile a complete list of bridge nodes, so that method should be pretty effective. It's also possible to run a "private" bridge and share it out of band with other. That method certainly should make relay identification extremely difficult.
- Pitarou 14y ago
  I don't think they're proposing to block the PROTOCOL. (Is it even possible to reliably distinguish Tor traffic from other encrypted traffic?) Rather, I think they're proposing to block all packets being sent to known Tor end-nodes. Of course, miscreants can get around this by bouncing their packets off a relay outside Japan. This will actually HELP Japanese criminals who go to the trouble of using a relay. When they cause trouble, the first response of the authorities will be, "This is the work of foreign criminals." (A common scapegoat, alas.) "It can't possibly be coming from Japan, because we've blocked Tor." (and we're certainly not going to admit that our firewall leaks)

hobs 14y ago

I remember that iron geek has a few talks about this, and specifically about different ways to leak information in a darknet, usually protocols that dont respect what the browser is trying to accomplish, and depending how your tor traffic is setup (browser plugin), may lead someone directly to you. Anyway, here's his fairly simple php script: http://www.irongeek.com/i.php?page=security/detect-tor-exit-node-in-php http://www.irongeek.com/i.php?page=security/detect-tor-exit-...