Re: [tor-talk] IMPORTANT: Heartbleed vulnerability impact on Hidden Service experiment

[Matthew Finkel <matthew.finkel@xxxxxxxxx>]

On Sat, Apr 12, 2014 at 12:16:18PM +0300, s7r@xxxxxxxxxx wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> Hi,
> 
> After seeing the challenge done by CloudFlare, to setup a server open
> to the internet with that vulnerable OpenSSL version so everyone could
> try and get its private keys (to see if it's actually possible), after
> speaking earlier with people in #tor IRC channel, we think it's a good
> way to find out for sure if the Hidden Services could have been
> compromised or not. And if yes, make a more serious and visible banner
> to notify them. Because so far nobody has changed the Hidden Service
> address, from all the Hidden Services I am using.
> 

Where do you propose the "more serious and visible banner" be placed?
With all of the attention that heartbleed attracted in the mainstream
media, I would think (but would probably be wrong) that relay and
hidden service operators are aware of the vulnerability and the fact
that their keys were potentially compromised.

> I don't want them to be exposed to risks and when something happens,
> yet another thing which will be blamed on Tor.
> 
> So, to developers and special reference to arma, proposition:
> - -- Can we setup a Tor circuit, separate from the Tor network, or
> within it if it's better this way (if we can choose all the relays in
> a circuit via torrc), a circuit in which all the relays are running
> the vulnerable version of OpenSSL with heartbeats enabled?
> 

I'm not sure this will accomplish exactly what you think it will
accomplish. Hidden services are merely one-last-proxy, so as far as we
know, the way to retrieve a hidden service's private key is the same way
as retrieving a relay's private key, by connecting to it's OR Port and
establising (most of) a TLS connection. If you connect to a hidden
service and attempt to establish a TLS connection then you're
connecting to that-thing-behind-the-hidden-service (whether that's
apache, nginx, sshd, etc). Due to the way hidden services are designed,
a non-local user/attacker should not be able to interact with the
instance of Tor that runs the hidden service (where "local" in this
situation includes anyone who can directly connect to the server).

But to answer your question more directly, your proposal won't be
extremely easy to do. In order to establish a connection only through
relays using vulnerable versions of OpenSSL it will require some
modifications to Tor on th hidden service-side to guarantee that it
builds such a circuit. On the client side you can use a controller
(Stem, txtorcon(?)) to choose your hops. Is there a reason you
specifically want this, though? Is there added benefit when every hop is
vulnerable?

> I have a server and offer it to be the Hidden Service and everyone can
> test and exploit the heartbleed vulnerability and prove if they
> managed to get the private key.
> 

Great! If I'm wrong then an attacker only needs the hidden service
address and port number to be able to retrieve the private key. If I'm
not then the attacker really needs your IP address and OR Port (if
you're a relay).

> If you think the experiment is worth it email me directly and let me
> know what do i have to do. I am sure many others will join.
> 
> 
> s7r
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.17 (MingW32)
> 
> iQEcBAEBCAAGBQJTSQRiAAoJEIN/pSyBJlsRqe4H/3JB7136euT/3tQLJqMjHqZS
> OKyptAUFg6ZnOqGeOnacAqxz79XfNYXDDV8Bxh2erWpVvAIxQjzJFatKtUdjzGBG
> UKHQyNuDRifbaOSAoFcf93hfWvS387I3YMAhHWR5+yQjcucGpcECh8gmlOJNnsZD
> Zt1U1MjzQJfY6t9J5PXMvNDIYXhYE2DYtAmVXRDDNYKssX18Cc/qDid1s1t5OjGr
> wnWWK6lnZ64VJx+U8wsYutLYVUzrXOyp+POK6j8rM22vJlbrdbtGRGscCyaUGVTi
> L+cvFodxn16mL+x+7AjVa1ReHxu0KYXW+3l94Kil9qu2LiW0sPTG358zIOTb1as=
> =zrv8
> -----END PGP SIGNATURE-----
> -- 
> tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
> To unsubscribe or change other settings go to
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk