[tor-talk] Tor Weekly News â January 22nd, 2014

[dope457 <dope457@xxxxxxxxxx>]

========================================================================
Tor Weekly News                                       January 22nd, 2014
========================================================================

Welcome to the third issue in 2014 of Tor Weekly News, the weekly
newsletter that covers what is happening in the Tor community.

Future of the geolocalization database used in Tor software
-----------------------------------------------------------

The first version of Tor to include an IP-to-country database was
0.2.0.27-rc [1], released in 2008. In 2010, the database switched [2]
from data provided by WebHosting.Info to use the more up-to-date
MaxMindâs GeoLite service. All was good, until two years later when
MaxMind started to hide the country of Tor relays [3], marking them as
from the âA1â country, standing for âanonymous proxyâ.  Karsten Loesing
has been tirelessly doing manual database updates ever since.

MaxMind has launched GeoIP2 [4] as a successor of its previous service.
The very good news, as spotted by Karsten [5], is that the new format
âprovide the A1/A2 information in *addition* to the correct country
codesâ.

The question lies on how should this new database be integrated into the
different software using geolocalization information: Tor, BridgeDB, the
metrics database and the metrics website. The format used by Tor so far
has always been a custom format, so writing a converter from MaxMindâs
database format is one option. Another option is to integrate the
parsing libraries provided by MaxMind into Tor software.

Both approaches have their advantages. In any cases, they can be useful,
fun and small projects for someone new to the Tor community. Be sure to
have a look at Karstenâs suggestions if you feel like helping.

   [1] https://gitweb.torproject.org/tor.git/tree/ee60a8dd
   [2] https://gitweb.torproject.org/tor.git/commit/befcc84f
   [3] https://bugs.torproject.org/6266
   [4] http://blog.maxmind.com/2013/07/01/introducing-the-geoip2-beta/
   [5] https://lists.torproject.org/pipermail/tor-dev/2014-January/006080.html

Key generation on headless and diskless relays
----------------------------------------------

Following up on his work on Torride [6] â a live Linux distribution
meant to run Tor relays â anarcat asked about key generation in low
entropy situation. Lunar had raised [7] a similar question for the
Tor-ramdisk distribution [8] a couple of months ago.

âThe concern here is what happens when Tor starts up the first time. I
believe it creates a public/private key pair for its cryptographic
routines. In Torride, this is done right on the start of the operating
system, when the entropy of the system is low or inexistentâ explained
anarcat.

Gerardus Hendricks has made a quick analysis [9] of Tor source code to
determine that key were generated using entropy from /dev/urandom â an
insecure behavior in low entropy situation.

Nick Mathewson suggested [10] to change the initialization procedure in
order to âtry to read a byte from /dev/random before it starts Tor, and
block until it actually can read that byte.â This would âensure that the
kernel RNG has (by its own lights) reached full entropy at least once,
which guarantees cryptographic quality of the rest of the /dev/urandom
stream.â More general solutions are now discussed in a newly created
ticket [11].

   [6] https://redmine.koumbit.net/projects/torride
   [7] http://opensource.dyc.edu/pipermail/tor-ramdisk/2013-January/000101.html
   [8] http://opensource.dyc.edu/tor-ramdisk/
   [9] https://lists.torproject.org/pipermail/tor-talk/2014-January/031725.html
  [10] https://lists.torproject.org/pipermail/tor-talk/2014-January/031773.html
  [11] https://bugs.torproject.org/10676

Exposing malicious exit relays
------------------------------

Anyone is free to start a new Tor relay and join the Tor network. Most
Tor relay operators are volunteers who dedicate time and money to
support online privacy.

Unfortunately, as Philipp Winter and Stefan Lindskog wrote in the
introduction of their new research project [12], âthere are exceptions:
in the past, some exit relays were documented to have sniffed [13] and
tampered with [14] relayed trafficâ. The project, dubbed âspoiled
onionsâ, is meant to âmonitoring all exit relays for several months in
order to expose, document, and thwart malicious or misconfigured
relaysâ.

The paper [15] gives more details on the modular scanning software [16]
that has been developed. It elaborates on how it can detect tampering
with the HTTP, HTTPS, SSH, and DNS protocols. The paper also discusses
that occasionally itâs the relayâs ISP that is responsible for an attack
despite the operatorâs good faith.

The authors also describe an extension to the Tor Browser that can help
with detecting HTTPS man-in-the-middle attacks: if the browser is unable
to verify a certificate, it will automatically retrieve the certificate
again using a different Tor exit node. If the certificates do not match,
a warning can then be issued informing the user that an attack might be
happening and offering to notify the Tor Project. However, the extension
is merely a proof of concept and not usable at this point.

Philipp and Stefanâs efforts have already identified 25 bad relays that
have subsequently been marked as such by directory authority operators.
Even if we wish the number of problematic relays to stay low, letâs hope
this will help to identify those who try to abuse Tor users as soon as
possible in the future.

  [12] http://www.cs.kau.se/philwint/spoiled_onions/
  [13] http://www.cs.columbia.edu/~mikepo/papers/tordecoys.raid11.pdf
  [14] https://trac.torproject.org/projects/tor/wiki/doc/badRelays
  [15] http://www.cs.kau.se/philwint/spoiled_onions/techreport.pdf
  [16] https://github.com/NullHypothesis/exitmap

Miscellaneous news
------------------

Alex reported [17] his bad experience with Hetzner when attempting to
participate in the âTrusted Tor Traceroutesâ experiment [18]. Paul
GÃrgen reported [19] having similar troubles, even with a lower packet
per second rate. Relay operators might want to warn their ISP before
undertaking the experiment in the future to avoid similar misadventures.

  [17] https://lists.torproject.org/pipermail/tor-relays/2014-January/003620.html
  [18] https://web.engr.illinois.edu/~das17/tor-traceroute_v1.html
  [19] https://lists.torproject.org/pipermail/tor-relays/2014-January/003625.html

Anupam Das reported [20] that they have âreceived a good rate of
participation by relay operators to our measurement projectâ [18]. To
measure progress, there is now a live scoreboard [21] of all
participants.

  [20] https://lists.torproject.org/pipermail/tor-relays/2014-January/003686.html
  [21] http://128.174.241.211:443/relay_scoreboard

The integration of âpluggable transportsâ in the main Tor Browser
Bundle [22] is moving smoothly. David Fifield published beta images of
his recent work [23], and the initial implementation adding a default
set of bridges to Tor Launcher [24] has been completed.

  [22] https://bugs.torproject.org/9444
  [23] https://gitweb.torproject.org/user/dcf/tor-browser-bundle.git/shortlog/refs/heads/3.6-beta
  [24] https://bugs.torproject.org/10418

Following up on last week call for help [25] regarding Tor Weather [26],
Karsten Loesing is organizing an IRC meeting [27] with interested
developers on Wed, Jan 22, 18:00 UTC. The meeting will happen in
#tor-dev on OFTC.

  [25] https://lists.torproject.org/pipermail/tor-dev/2014-January/006039.html
  [26] https://weather.torproject.org/
  [27] https://lists.torproject.org/pipermail/tor-dev/2014-January/006102.html

As part of the website redesign effort, Marck Al proposed [28] an
updated visual identity. Lunar also highlighted a couple of tasks [29]
that could be undertaken to move the website redesign forward.

  [28] https://lists.torproject.org/pipermail/www-team/2014-January/000196.html
  [29] https://lists.torproject.org/pipermail/www-team/2014-January/000216.html

Tailsâ release calendar [30] has been shifted by two weeks because of
the holiday break from Mozilla [31].

  [30] https://tails.boum.org/contribute/calendar/
  [31] https://mailman.boum.org/pipermail/tails-dev/2014-January/004757.html

Ximin Luo has been discussing with I2P [32] developers on how Pluggable
Transports [33] could be made easier to use by other projects [34].

  [32] http://geti2p.net/
  [33] https://www.torproject.org/docs/pluggable-transports.html
  [34] https://bugs.torproject.org/10629

Isis Lovecruft has sent late reports on her activity for October [35],
November [36] and December 2013 [37].

  [35] https://lists.torproject.org/pipermail/tor-reports/2014-January/000431.html
  [36] https://lists.torproject.org/pipermail/tor-reports/2014-January/000432.html
  [37] https://lists.torproject.org/pipermail/tor-reports/2014-January/000433.html

There are two weeks left to participate in the crowdfunding campaign
started by the Freedom of the Press Foundation [38]. Among other
projects, the money will support core Tor development and Tails 1.0
release.

  [38] https://pressfreedomfoundation.org/

Tor help desk roundup
---------------------

Frequently users email the Tor help desk because they cannot access a
particular public-facing website. Often this is because an increasing
number of websites have begun blocking connections that appear to come
from the Tor network. A partial list of websites that do this can be
found on Tor Projectâs wiki [39]. Feel free to add more sites to the
list, and to contact the websiteâs operators to explain why banning Tor
is not the best course of action.

Some users reported websites that do not allow logins when using the Tor
Browser. This is not always related to website blocks or blacklists.
There is a known bug in the Tor Browser Bundle such that Private
Browsing Mode disallows cookies in a way that some sites donât like.
Disabling Private Browsing mode via Torbuttonâs Preferences is a
workaround and will hopefully be fixed soon [40].

  [39] https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor
  [40] https://bugs.torproject.org/10569

Upcoming events
---------------

Feb 1-2   | Tor @ FOSDEM
          | Brussels, Belgium
          | https://fosdem.org/2014/
          |
Feb 8     | Aaron @ New Media Inspiration 2014
          | Prague, Czech Republic
          | http://www.tuesday.cz/akce/new-media-inspiration-2014/
          |
Feb 8     | Colin @ Winnipeg CryptoParty
          | Winnipeg, Canada
          | http://wiki.skullspace.ca/CryptoParty


This issue of Tor Weekly News has been assembled by Lunar, Matt Pagan,
Philipp Winter, Karsten Loesing, Sandeep, and dope457.

Want to continue reading TWN? Please help us create this newsletter.
We still need more volunteers to watch the Tor community and report
important news. Please see the project page [41], write down your
name and subscribe to the team mailing list [42] if you want to
get involved!

  [41] https://trac.torproject.org/projects/tor/wiki/TorWeeklyNews
  [42] https://lists.torproject.org/cgi-bin/mailman/listinfo/news-team

--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk