Re: [tor-relays] 90% of exits vulnerable to TCP off-path attack

[Roger Dingledine <arma@xxxxxxx>]

On Fri, Aug 12, 2016 at 12:01:03PM -0400, Zack Weinberg wrote:
> Tor's use of TLS _should_ mean that the worst an attacker can do here
> is denial-of-service.  The Register article suggests that they might
> also be able to force the use of specific exit relays (by disrupting
> connections that don't go through those relays) but weaponizing that
> against specific users (rather than everyone trying to use an exit the
> attacker doesn't like) strikes me as nontrivial.

Agreed. I attended the talk at Usenix Security this week, and the
presenter seemed to think that if a TCP connection between two relays
gets cut, then the first relay will redirect all those circuits to some
other relay. If that were true, then you could do the "keep cutting the
connection until your target circuit goes the way you want it to" attack.

But Tor clients are the ones that choose their paths, and when a circuit
fails, they throw it out and choose a new path, without memory of what
links inside the Tor network did or didn't work in the past. So clients
will effectively fail closed, meaning they will keep trying a circuit of
their choice and you will keep trying to find it and tear it down, but
you won't be able to "direct" their path in the way the authors thought.

That said, this kind of TCP level attack is indeed neat, and people
should keep thinking about ways to apply it, or something like it, to Tor.

For an earlier paper in the same area, see also
http://freehaven.net/anonbib/#tcp-tor-pets12

> Right now I think one should not panic and should wait for the kernel
> people to do a proper fix.

Yes, this makes sense.

Another option is to encourage people to remember that operating system
diversity is important. :)
https://torbsd.github.io/

--Roger

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays