[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Is this a practical vulnerability?
On 19/10/2012 04:12, Lee Whitney wrote:
I was reading a paper on discovering hidden service locations, and couldn't find any reason it shouldn't work in principle.
However being that I'm a Tor novice, I wanted ask here.
In a nutshell they propose throwing some modified Tor nodes out there that modify the protocol enough to track down the location. It does take some time, but it doesn't seem like years.
My experience is that there s already an easy method of identifying Tor
hidden service nodes and this takes little time to do.
Let me explain why I come to that opinion.
Having a static IP net connection, I set up a test web site as a Tor
service on a Tor middleman server. That server had been a middleman
server for about a year, no problems, no attempts to hack it in all that
time.
Within 24hrs of making that Tor hidden service live I could see, in my
firewall logs, hundreds of repeated attempts trying to hack my server,
directly from the internet, not via my hidden Tot service. All were
attempting to access various types of services/permissions which were
mainly focused on attempting to gain control of a "web page server". All
attacks were from US based places of higher education (colleges and
universities), most from establishments where Tor servers were situated
but not from Tor servers themselves.
Now bearing in mind that I had only EVER requested 1 web page (a blank
test page - requested about 4 times) from my own Torrified web browser
(out and back so to speak), and no OTHER (external) page requests were
EVER received via the Tor hidden service, as shown by its log. Then
someone must have been able to immediately see the service enter and
track its source, who then attempted to hack the web server itself and
it appeared to be a group of about 3 or 4 persons, each trying different
attack strategy over a 12 hour period. Hundreds of commands were sent,
many in quick succession as if they were in some sort of script file,
but some were live, at one point I even watched them live as they were
coming in as I countered their hack attempts.
As a result of this I did some serious thinking about Tor and came to
the conclusion that someone out there and I believe it is THE global
adversary (USA mil/sec) is able see with perfect transparency all Tor
traffic.
Consider.:
Most Tor users see the Tor connections as merely a set of 3 or 4
connected nodes over which their traffic is routed, e.g. Tor1 - US, Tor
2 - Germany, Tor 3 France - EXIT. But in reality then internet is not
like that, this is only the UPPER structure level. At the lower level
the packets are routed over many dozens of sub-nodes, these nodes are
invisible to the Tor map of your traffic. You can find out this info
yourself if you wish to test out a single ROUTE to another IP address
just by doing a traceroute url (tracert url for windows) command from a
command line prompt window. As you will see this is about a dozen hops
to the average local url. But this is not the end of the problem, as
some hops are hidden and they report only a virtual hop back to you.
e.g. lets say a node is in a server in an IBM/US telecoms company based
in France, then that server will almost certainly be routing ALL its
traffic through the USA and back to itself (or another node in the same
company) before sending it on to the next external node. This diversion
is NEVER reported as ONLY a single "virtual node ip" is quoted. The only
way you can ever tell its been done is by looking at the time delay,
however this is also often difficult/impossible to spot because these
routes are often the fastest on the internet. OK - I know this goes on
for certain because there are internal tools used within these companies
to trace the TRUE route and I have seen such servers send their traffic
in this manner 24/7 - 365. Having discussed this as "wasted effort" with
a network engineer I was told there is a "payment" made somewhere to
compensate. At the same time all of this is camouflaged in apparently
nice and legitimate reasons for it being that way, but when you pull it
apart you see the lie, but you can't PROVE it.
As about 70% of Europe's internet traffic passes through an IBM/US
telco's servers then it almost certain that in any one of these Tor node
to Tor node connections there is at least one sub-nodes that passes the
traffic through the USA, who is the global adversary using Total Traffic
Timing Tracking.
You should be able to work the rest out for yourself.
Any comment appreciated, here's a link to the paper:
http://www.cs.uml.edu/~xinwenfu/paper/HiddenServer.pdf
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk