21 ms·
Possible upcoming attempts to disable the Tor network
- d0mdo0ss 12y agoSomeone posted a somewhat toxic but somewhat valid point, and the project responded with more details about their 'source'. I add their response but it may be best to read the original post. To be sure to keep our source safe, we're not providing more details quite yet. But actually, we don't know many more details than the ones we posted. And as for your 'why', that's an excellent question, and one we've been wrestling with too. There are nine directory authorities, spread around the US and Europe. If they're trying to hunt down particular Tor users, most possible attacks on directory authorities would be unproductive, since those relays don't know anything about what particular Tor users are doing. Our previous plan had been to sit tight and hope nothing happens. Then we realized that was a silly plan when we could do this one [post the warning] instead.
- robertfw 12y agoWhat ability does TOR have to operate in a decentralized manner without the directory servers? Is that something that is possible now, or is it being worked on, or is it even possible? edit: this question was asked in the blog comments, here is arma's response > There are a bunch of research papers looking at exactly this question. Check out http://freehaven.net/anonbib/#usenix11-pirtor http://freehaven.net/anonbib/#usenix11-pirtor for one direction, and then http://freehaven.net/anonbib/#wpes09-dht-attack http://freehaven.net/anonbib/#wpes09-dht-attack http://freehaven.net/anonbib/#ccs09-shadowwalker http://freehaven.net/anonbib/#ccs09-shadowwalker http://freehaven.net/anonbib/#ccs09-torsk http://freehaven.net/anonbib/#ccs09-torsk http://freehaven.net/anonbib/#ccs10-lookup http://freehaven.net/anonbib/#ccs10-lookup for another direction to consider. The current situation is that nobody knows of a better design that is actually better in practice. The one we have is well-studied and has well-understood downsides, so I'm not eager to move to one that is poorly-studied and has poorly-understood downsides.
- chrisfosterelli 12y agoBased on my understanding of the TOR network, it currently cannot function without directory authorities. The directory authorities provide a signed list of all of the TOR network relays, and that includes the set of encryption certificates used for each relay and all of the configuration information about it. The TOR clients come hard coded with a list of directory authorities. Without the ability to query the directory authorities they cannot find a usable TOR route. I don't know if there is some caching involved, but if not then this would effectively stop the network for anyone trying connect to TOR.
- derefr 12y agoSo why couldn't signed lists of relays just, say, float around on a DHT, with a cache-and-forward model like Freenet, but where newer documents (provided they're signed with the same key) will overwrite older documents in the same cache slot? Actually, to put it another way, Freenet is itself the optimal bootstrapping mechanism for Tor. Maybe the two projects should merge, such that Tor would effectively be an optimization over the specific case of two peers generating and searching for one-another's signed Freenet documents (this effectively being an IP tunnel already).
- mike_hearn 12y agoIt's already done that way. Tor relays cache signed consensus documents from the directory authorities. It doesn't change the fact that you need some trusted computers, somewhere, that give you an accurate view of the network.
- StavrosK 12y agoAh, so you need them for a trusted calculation, rather than for a trusted static file. The latter would be easy to sign and store on a CDN.
- SolarNet 12y agoI mean we have the "technology" to do distributed trusted computation (without trusted hardware). It would just be extremely difficult to bring it into the TOR project without rewriting large parts of it.
- userbinator 12y agoI've always thought one of the biggest weaknesses of Tor was that it did rely on a central authority. BitTorrent moved from a centralised tracker model to a decentralised DHT, so I'm quite sure it's theoretically possible. In the worst case, I think a DHT could be used as a routing layer, storing and retrieving encrypted packets in it, and achieve a similar anonymity effect... of course the latencies are going to be horrible, so it might be better to just use it as a way to setup multihop tunnels.
- nickodell 12y agoDoes anyone have any more information? What jurisdictions are these Directory Authorities located in?
- paralelogram 12y ago193.23.244.244: Germany, Chaos Computer Club e.V. 194.109.206.212: Netherlands, XS4ALL Internet BV 154.35.32.5: United States, Cogent Communications 131.188.40.189: Germany, Friedrich Alexander Universitaet Erlangen Nuernberg 199.254.238.52: United States, Riseup Networks 171.25.193.9: Sweden, Foreningen for digitala fri- och rattigheter 128.31.0.34: United States, Massachusetts Institute of Technology 82.94.251.203: Netherlands, NAH6 BV 86.59.21.38: Austria, SILVER:SERVER GmbH 208.83.223.34: United States, Applied Operations, LLC
- freeasinfree 12y agoIronically in countries unfriendly to privacy http://en.wikipedia.org/wiki/Global_surveillance_disclosures_%282013%E2%80%93present%29 http://en.wikipedia.org/wiki/Global_surveillance_disclosures...
- mindslight 12y agoThere really is no Russia/China? Why are all of the servers located within the jurisdiction of USG?!
- dsl 12y agoThe United States may occasionally do some shady shit, but the Chinese will frequently conduct blatant theft of intellectual property off your servers. This is why very few tech companies will host within China proper.
- mindslight 12y agoThat's irrelevant when the entire purpose of directory servers is to propagate signed and published information.
- discostrings 12y agoIt's very interesting that the project has some advanced notice about a threat. My first guess would be that a nation has made some demands of the project that the project won't comply with, and that country has suggested they will seize the directory authority servers located inside it if the demands aren't met soon. [Edit: a new comment by arma on the original story, "To be sure to keep our source safe, we're not providing more details quite yet", makes this seem less likely.] Or perhaps an insider has leaked some plans to the project. Along another line of thought, if the US government wanted to further complicate online privacy, I imagine they'd choose a time like now, when headlines about the "cyber intrusions" of 2014 are at a peak. I wonder what other actors could have large enough power over their directory authority servers for the project to post this message. Edit: Indeed, from a post below by paralelogram [0] and by checking https://atlas.torproject.org https://atlas.torproject.org , it appears 4 of 9 are in the US. There are also two in Germany, one in the Netherlands (as well as another there that is only for bridge relays), one in Austria, and one in Sweden. [0] https://news.ycombinator.com/item?id=8775009 https://news.ycombinator.com/item?id=8775009
- cjbprime 12y agoBut taking out four nodes isn't enough to cause a full consensus outage.
- deciplex 12y agoWe still haven't discovered the thing that the US government can ask, that the Swedish government will refuse. So I think they'll be able to get five.
- Zigurd 12y agoIt could be an opportunistic attack on Tor by MPAA members. If the FBI surveyed all their IT people regarding attacks and they all complained about Tor, they might be able to stampede the FBI and cooperating LEAs into a takedown of directory servers.
- jwcrux 12y agoAssuming it's a legal entity that will be performing these seizures, I'm curious to know the case against these servers. To my (albeit somewhat limited) knowledge of the Tor network, these DA's exist solely to maintain the integrity and structure of the network, and to provide a list of known relays to clients. I also understand that this list of trusted DA's is hardcoded into Tor clients. Since this is the case, I'd be curious how the network could be restored if there is a coordinated action on these servers.
- catshirt 12y ago"I also understand that this list of trusted DA's is hardcoded into Tor clients" forgive my ignorance, why would they do this in the first place? fear of MITM?
- click170 12y agoI think so. It wouldn't be very secure of Tor could be over-riden by an ISP inserting a bad DNS record in their servers.
- boklm 12y agoBecause the clients need to get the list of nodes from somewhere. You can read more about how this works at this URL: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt
- Aoyagi 12y ago>Tor remains safe to use. What are these not-so-rare reports of mass unmasking of people then? I'm genuinely curious, not begging the question.
- pyre 12y agoWhat reports? The site seizures?
- cjbprime 12y agoThese unmaskings have been performed through (usually egregious) opsec failures on the part of the user, rather than performed by attacking the Tor network directly.
- bashinator 12y agoAlso I believe there were some traffic correlation attacks where the attacker was able to get netflow data from both entrance nodes and (?) the traffic destination outside of Tor.
- nominated1 12y agoI'm not aware of network faults just "user errors". Allowing js and plug-ins to run puts you in the "low hanging fruit" category.
- pstrateman 12y agoTor is designed with a specific threat model. That threat model explicitly does not provide protection against a global observer. That means tor is NOT safe against a state level attacker with an extensive surveillance network.
- higherpurpose 12y agoWell be specific. Some have been caught due to using outdated Tor software. Others, like the recent Silk Road bust, because they used "hidden services" incorrectly, and the hidden services were never actually advertised by Tor as being perfectly safe. But the latter one has nothing to do with users, but with "website" operators inside the Tor network.
- cjbprime 12y ago(Disclaimer: I am not affiliated with Tor, I'm just poking around their source code. My conclusions may be totally wrong.) You can see the list of trusted directory authorities in Tor's src/or/config.c: https://gitweb.torproject.org/tor.git/tree/src/or/config.c#n820 https://gitweb.torproject.org/tor.git/tree/src/or/config.c#n... There are nine of them (actually ten, but one is just for bridges), so you'd have to disrupt at least five of them to prevent them forming a majority vote on consensus together. Looks like the countries that own the IP address allocations for each dirauth are: Austria, Germany, Germany, Holland, Holland, Sweden, US, US, US If the above is all correct, a US<->Germany collaboration - to pick the largest set from two countries - would be one way to cause a large problem.
- bachback 12y agointeresting - how does this work?
- higherpurpose 12y agoCould the Tor Project sue against those seizures?
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- chippy 12y agoWould suing repair the damage? How long would it take? Could it actually be a criminal act?
- justcommenting 12y agothe most recently restarted dirauths appear to run Tor 0.2.6.1-alpha-dev, including four of the five US-based dirauths (moria1, Faravahar, urras, dizum). gabelmoo, tor26, longclaw, Tonga, and maatuska appear to be running Tor 0.2.5.10. dannenberg is running Tor 0.2.5.9-rc. roger's dirauth (author of the post) moria1 (US) restarted ~1d ago and shows a blip in traffic earlier today, which may or may not have something to do with the post: https://atlas.torproject.org/#details/9695DFC35FFEB861329B9F1AB04C46397020CE31 https://atlas.torproject.org/#details/9695DFC35FFEB861329B9F... peter's tor26 (austria) restarted 12h ago: https://atlas.torproject.org/#details/847B1F850344D7876491A54892F904934E4EB85D https://atlas.torproject.org/#details/847B1F850344D7876491A5... dizum (netherlands) was also recently restarted 16h ago: https://atlas.torproject.org/#details/7EA6EAD6FD83083C538F44038BBFA077587DD755 https://atlas.torproject.org/#details/7EA6EAD6FD83083C538F44... Tonga (netherlands) looks mostly normal, restarted ~7d ago: https://atlas.torproject.org/#details/4A0CCD2DDC7995083D73F5D667100C8A5831F16D https://atlas.torproject.org/#details/4A0CCD2DDC7995083D73F5... sebastian's gabelmoo (germany) restarted 2d ago: https://atlas.torproject.org/#details/F2044413DAC2E02E3D6BCF4735A19BCA1DE97281 https://atlas.torproject.org/#details/F2044413DAC2E02E3D6BCF... CCC's dannenberg (germany) restarted 3d ago: https://atlas.torproject.org/#details/7BE683E65D48141321C5ED92F075C55364AC7123 https://atlas.torproject.org/#details/7BE683E65D48141321C5ED... jake's urras (US) is showing relatively low bandwidth & restarted ~2d ago: https://atlas.torproject.org/#details/0AD3FA884D18F89EEA2D89C019379E0E7FD94417 https://atlas.torproject.org/#details/0AD3FA884D18F89EEA2D89... Faravahar (US) restarted 4d ago: https://atlas.torproject.org/#details/CF6D0AAFB385BE71B8E111FC5CFF4B47923733BC https://atlas.torproject.org/#details/CF6D0AAFB385BE71B8E111... riseup's longclaw (US) restarted 9d ago: https://atlas.torproject.org/#details/74A910646BCEEFBCD2E874FC1DC997430F968145 https://atlas.torproject.org/#details/74A910646BCEEFBCD2E874... linus's maatuska (sweden) has been up for 30d: https://atlas.torproject.org/#details/BD6A829255CB08E66FBE7D3748363586E46B3810 https://atlas.torproject.org/#details/BD6A829255CB08E66FBE7D... recent activity in tor's commit log may also offer up some clues: https://gitweb.torproject.org/tor.git/log/?showmsg=1 https://gitweb.torproject.org/tor.git/log/?showmsg=1
- robert_foss 12y ago0.2.6.1-alpha-dev doesn't seem to contain anything earth shattering. https://gitweb.torproject.org/tor.git https://gitweb.torproject.org/tor.git
- click170 12y agoIs there anything that users can do to help with this? Donating money or hosting, or running a Tor node? There wasn't any info on the blog about what regular users can do to help with this, if anything.
- robertfw 12y agoThe targeted servers are directory servers, which are not what the user runs. AFAIK there is nothing that can be done short of supporting TOR through donations, so they can focus on whatever needs to be done.
- jloughry 12y agoYou're right, so I sent the Tor Project a donation through paypal. They're a U.S. 501(c)(3) non-profit organization.
- mortov 12y agoI think we can guess we're about to be told the North Koreans used TOR so decisive action needs to be taken against the network as part of the retaliation measures just announced.
- aburan28 12y agoThe United States Government will fail because even if they were to significantly disrupt the Tor network we'll pull out the Zero Knowledge Proofs on them. We have the crypto and technology to build a super resilient Tor replacement that they cannot do a single thing about. Tor is antiquated and I personally hope they take it out because it's replacement will be 100x better.
- josephagoss 12y agoWhere is this 100x better replacement? Lots of people around the world depend on the anonymity of Tor today and having the Government take it out, whilst indirectly kick-starting the next generation anonymity network is all and well for me and my armchair, but it's going to be life threatening for many. Until this 100x better solution exists Tor must be kept running at any cost, many lives depend on it.
- pc2g4d 12y agoSounds like time to stand up some spare directory servers, preferably in different legal jurisdictions than those currently represented.
- guelo 12y agoI'm surprised they're able to talk about this, seems. Like the FBI would have gone with a NSL (National Security Letter).
- Havvy 12y agoThey haven't been sent an NSL at the time of the writing of that post. They don't have details on what the attack is, only that they think there is going to be one.
- declan 12y agoThis is a very big deal if it happens. Roger's linked post on the Tor site talks about "seizure" of directory authority servers; only government authorities would have that power. In the U.S. that would typically happens only after a court grants a seizure order, which would be under seal at this stage. Of the countries where the servers are located, the U.S. has the most extreme copyright laws, which means, sadly, FedGov is the leading candidate to be behind any possible seizure. It would be interesting if an enterprising journalist were to ask MIT, SF-based Applied Operations, and RiseUp if they've been contacted by law enforcement on this matter. Those organizations host some of the U.S.-based servers. RiseUp has a warrant canary but it hasn't been updated recently: https://help.riseup.net/en/canary https://help.riseup.net/en/canary Of course we don't know what actually is going on and it all may be (I hope!) a false alarm. PS: If multiple governments cooperate and a majority of servers are taken down, what happens to Tor after the consensus interval expires? I don't know; maybe someone more familiar with Tor does. The consensus interval was changed to 72 hours a few years ago: https://trac.torproject.org/projects/tor/ticket/7986 https://trac.torproject.org/projects/tor/ticket/7986 PPS: Remember that FedGov's "copyright infringing" domain name seizures have on occasion taken down non-infringing sites in error, as I wrote about here: http://www.cnet.com/news/dhs-abruptly-abandons-copyright-seizure-of-hip-hop-blog/ http://www.cnet.com/news/dhs-abruptly-abandons-copyright-sei...
- declan 12y agoUpdate: Someone at the Tor project kind-of-answered my question about the expiration of the consensus interval a moment ago here: "If four out of the 9 dir auths were compromised and taken offline, then the remaining 5 will continuing publishing the consensus and the network will continue operating normally. If more than 5 are taken offline then this was a horrendously large operation and the necessary corrective actions will be taken to ensure the network remains operational." https://blog.torproject.org/blog/possible-upcoming-attempts-disable-tor-network https://blog.torproject.org/blog/possible-upcoming-attempts-...
- cjbprime 12y agoI don't think the change to 72 hours was merged; I think it's still at 24 hours. > PS: If multiple governments cooperate and a majority of servers are taken down, what happens to Tor after the consensus interval expires? As I understand it, the network would die (all clients would refuse to use the consensus, and thus not connect) 24 hours after the last good consensus. > PPS: Remember that FedGov's "copyright infringing" domain name seizures have on occasion taken down non-infringing sites in error, as I wrote about here: http://www.cnet.com/news/dhs-abruptly-abandons-copyright-sei.. http://www.cnet.com/news/dhs-abruptly-abandons-copyright-sei.... I'm not sure how this is relevant -- the directory authorities are not being accessed via domain name, just IP address.
- mike_hearn 12y agoI doubt this will be a popular post, but I'll make it anyway. If there are some seizures of directory authorities or other project infrastructure, this won't be some totally unpredictable occurrence. It was only about a month and a half ago that some relays were seized as part of a general takedown against Tor hidden services. The Tor project posted this blog in response: https://blog.torproject.org/blog/thoughts-and-concerns-about-operation-onymous https://blog.torproject.org/blog/thoughts-and-concerns-about... That blog post convinced me to shut down my relay. The reason is, to an ambitious prosecutor this blog post looks like: "We view law enforcement operations as attacks and are looking for ways to defeat them, because we are determined to shield the identities of our criminal clients" ... which is exactly what resulted in the operators of the Silk Roads getting arrested even though they were not personally selling drugs. The blog post makes casual reference to the "enormous social value" of hidden services and claim they're worried about "secret police repressing dissidents", but doesn't cite any actual examples. Actually I've never heard of a hidden service that has enormous social value - whilst there are a small number of .onion addresses that aren't completely illegal or unethical, for all the examples I know of the operators are not anonymous. To police forces around the world who keep having investigations hit a dead end because of Tor, going after the project directly will not seem very different than going after services like Liberty Reserve. The people running it are stating publicly that they will do their best to frustrate investigations, and that is dangerously close to admitting participation in a criminal conspiracy. Thin ice doesn't even begin to describe their current situation.
- nate_meurer 12y ago> "Actually I've never heard of a hidden service that has enormous social value" You make it sound like you've actually looked. Perhaps you've spoken to some Ukrainians, or protesters in Turkey or Honk Kong, and they've assured you they have little use for "hidden services"?
- mike_hearn 12y agoI have looked (or at least paid close attention) and I am unaware of anyone in Ukraine, Turkey or Hong Kong using hidden services for political reasons. Additionally, Tor gets way less traffic from people trying to evade national firewalls than VPN services do. They aren't the big fish in that space at all.
- sandworm 12y agoIf this turns out to be (1) real and (2) linked to the Sony fiasco, then North Korea has triumphed. They have taken down two enemies in a single hack: a film and an internet technology. That puts them ahead of the MPAA and the NSA combined.
- driverdan 12y agoWhat are the specs of these servers and how much bandwidth do they require?
- kordless 12y agoI'm hoping Utter.io can help with this by making the infrastructure more trustworthy in the coming years. I'll be launching a Kickstarter right after the 1st to raise money for the project (which is currently in preview mode): https://www.kickstarter.com/projects/kordless/683224456?token=781b2ee9 https://www.kickstarter.com/projects/kordless/683224456?toke... If funded, a user governed foundation will be set up to help prevent influence by misaligned interests, such as those seen with existing providers and closed source software vendors. Infrastructure was always meant to be open, transparent and trustworthy. Especially for those who don't know any better.
- dsl 12y agoHow old is this deck? AWS has 28 availability zones, and averages 4 datacenters per AZ. Way more than the 9 you claim...
- kordless 12y agoFirst, I'd like to point out you are referring to something that isn't on the Kickstarter page, but linked to by it. You are talking about this: http://utter.io/prezo http://utter.io/prezo. Yes, it's a little out of date. Yes, I substitute the industry's word 'datacenter' for Amazon's term 'region'. Three days ago I updated the longer video version from that page and put it on the Kickstarter page, down below the other video. In addition to removing other content, I edited out the amounts you are referring to because they change constantly and are less important to my pitch now I'm doing a Kickstarter campaign. Also, AWS added a 10th region to their list a few months ago. I don't 'count' the government cloud as a public offering. It remains a truth that AWS runs out of ten geographic regions. So, 80% of the world's public cloud is run out of (by your math) <~40 physical buildings. Not a cloud, IMHO. Besides, there doesn't appear to be any public information on how many physically different locations Amazon runs for AWS, which makes it impossible to say how many physical locations (datacenters) they run. I'm not 100% convinced that a 'zone' maps to a physical building, given my memory of ping times across zones and having issues with two neighbor zones at the same time in the early days of using AWS. Amazon having different terminology than the industry's causes confusion and my comments reflected that confusion when I used the term 'datacenter' erroneously. FWIW, Rackspace calls their dataceneters 'datacenters': http://www.rackspace.com/about/datacenters http://www.rackspace.com/about/datacenters. Any remaining minutia related to this topic will be resolved by the end of the week. I'm updating Utter.io in preperation for the Kickstarter launch.
- jgwest 12y agoSeems like somebody in the DoJ just decided that Tor's balance between geeky CompSci curiosity and enabler of real-world criminal behavior has tipped too far in the latter direction. The legal case has been ripe for a while-- after all, Megaupload and many other networks have been disabled by the US government for enabling significantly LESS serious criminality. Ummm... world's biggest drug marketplace, anyone??? What's important to remember is that the gov't can't just go in and seize the directory authority servers willy-nilly. Instead, they must do it as part of a legal process against a specific, identified target. In this case, the likely target is going to be the Tor project itself and possibly the individuals leading it. The legal case might ruffle a few techie feathers but only an insignificant portion of the general public will care, and that portion can be mollified with the "stopping the bad horrible criminals" routine.
- sandworm 12y agoThose were not shutdown for "enabling" criminal activity. They were shut down for actually doing criminal activity. With megaupload it was failure to abide by the DMCA, with silk road it was handling money for/from drug dealers. I cannot see how Tor has actually done anything criminal beyond what a thousand other transitory service providers do every day.
- rasz_pl 12y agoin case of megaupload it was totally ILLEGAL, using bogus charges
- scandinavian 12y agoAccording to the internal emails the prosecutors got their hands on, megaupload was paying out to the top uploaders, and megaupload showed knowledge of what the uploads where. I can't stand commercial piracy. http://www.justice.gov/usao/vae/victimwitness/mega_files/Mega%20Evidence.pdf http://www.justice.gov/usao/vae/victimwitness/mega_files/Meg...
- sandworm 12y agoAside from the physical takedowns, expect a financial crackdown. Tor project assets would be seized, Paypal accounts locked, and CC services withdrawn.
- haakon 12y agoThat would be almost too stupid, considering how Tor is financed in large by U.S. government grants.
- deleted 12y ago[deleted]