Re: Why TOR Operators SHOULD always sniff their exit traffic...

[tor <tor@xxxxxxxxxxxxxxx>]

Hi Eugene ,
   I would say hard to intercept or trace under certain conditions 
rather than "unblockable"
  A tor carrying worm communicating via DNS tunneling might have 
considerable more success for the immediate future
  in penetrating "the Great FireWall of China"... although due to 
serialization concerns DNS/UDP is MUCH more suitable for first having a 
UDP/IP/TLS transport run over it first OpenVPN is what comes to mind and 
then anonymous circuits via tor/TCP could then be added. Its actually 
pretty neat/fast/cute on OC1 and faster networks . And it is a 
tremendous CPU hog as a server. plan for VIA Nehemiah? class processors 
with embedded AES crypto support and custom drivers for SSL/TLS 
possibly(ah the price of bleeding edge!!)

see "Black OPS of DNS" at Dan Kaminsky s site www.doxpara.org   for 
details on DNS tunneling .(I have spammed this list too much tonite 
according to at least one person:).. Dan has ssh and audio transports 
working via perl code over DNS/UDP. He has given demos at Codecon and 
other places for the past year or so of this capability..(there were 2 
earlier efforts I am aware of that went public)

     a tor operator
ps JAP was tapped on at least one occasion via court order, and I 
believe at one point there were plans to have JAP support at least tor 
client usage, did that ever happen?



Eugen Leitl wrote:

> On Fri, Jun 10, 2005 at 08:59:21AM +0200, Kristian K?hntopp wrote:
>  
>
> > On Wednesday 08 June 2005 21:51, tor wrote:
> >    
> >
> > > Of particular interest is the increasing
> > > sophistication of automated worm-based attacks. He cites the
> > > developing W32.spybot.KEG
> > > worm -- once inside a network it scans for several
> > > vulnerabilities and reports its findings via IRC. 
> > >      
> > And Sober variants routinely use JAP to fetch updates.
> >    
>
> There no reason for a worm to not use a P2P onion network for control
> traffic, and unblockable software updates. Sooner or later it's bound to
> happen.
>
> A Tor worm in China would actually be a good thing.
>
>