Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Attacking and Defending the Tor Network

CmdrTaco posted more than 3 years ago | from the takes-a-codpiece-and-a-helmet dept.

Communications 132

Trailrunner7 writes "In a talk at the USENIX LEET workshop Tuesday, Nick Mathewson of the Tor Project discussed the group's recent challenges in responding to suppression efforts by governments in Egypt, China and elsewhere. What the Tor members have learned in these recent incidents is that while governments are becoming more up front about their willingness to shut off Internet access altogether or censor content, users are also becoming more resourceful. Mathewson said that the group is working on methods for alleviating the problems that national-level restrictions cause for Tor users. One method involves moving to a modular transport method in order to get around some of the throttling that ISPs perform on encrypted traffic in order to make Tor usage more difficult. In a separate talk at LEET, Stevens LeBlond of INRIA in France presented research on methods for tracing Tor users back to their IP address. One of the attacks, which LeBlond and his co-authors titled 'Bad Apple,' used an exit node that the researchers controlled in order to trace the streams of data sent by users of BitTorrent over Tor back to their IP addresses."

cancel ×

132 comments

Information Is Like Water (2)

WrongSizeGlass (838941) | more than 3 years ago | (#35657164)

Information is like water and it will always find a way to get through.

Re:Information Is Like Water (2)

bknabe (1910854) | more than 3 years ago | (#35657304)

Yes, but it would be nice if the source survived the sending.

Re:Information Is Like Water (1)

RazzleFrog (537054) | more than 3 years ago | (#35658042)

And like water it can get flavored or poisoned as it goes through. Or it can just get completely frozen.

Re:Information Is Like Water (2)

gnick (1211984) | more than 3 years ago | (#35658394)

So... Are you saying "You can't stop the signal"?

Re:Information Is Like Water (0)

Anonymous Coward | more than 3 years ago | (#35659190)

Information is like water and it will always find a way to get through.

Yes. And the identity of the participants is also information, is it not?

I tried Tor.... (2)

joocemann (1273720) | more than 3 years ago | (#35657236)

... and it was too slow to do anything at all.

meh...

Re:I tried Tor.... (1)

GameboyRMH (1153867) | more than 3 years ago | (#35657386)

I dunno what you were doing wrong. It's fine for web surfing as long as you don't try to run videos through it.

Re:I tried Tor.... (2)

joocemann (1273720) | more than 3 years ago | (#35657566)

Really? I found that even using slashdot takes like 30-60 secs just to load the one page I'm trying to look at... I click something to move forward in my surf, and there goes another 30-60 seconds. Without tor its like 1 second. I'm just too busy/impatient/american to wait so long after each click. Anyway, I just go without and tell myself that I'm not as interesting as I might think I am. This has worked so far.... oh wait, there's a knock at the door... brb.

Re:I tried Tor.... (1)

GameboyRMH (1153867) | more than 3 years ago | (#35657734)

Even when I surf Tor on my PDA via SSH tunnel to one of my Tor nodes, pages generally load in under 10secs...are you going through a caching proxy server (like Polipo) to Tor or directly to Tor? Connecting directly to the Tor proxy itself with your browser is going to be slower and more unreliable.

Re:I tried Tor.... (2)

Hatta (162192) | more than 3 years ago | (#35657780)

If you're going through a proxy server to get to Tor, the proxy server knows your IP and everything you've browsed. This defeats the purpose of using Tor.

Re:I tried Tor.... (2)

GameboyRMH (1153867) | more than 3 years ago | (#35657804)

You misunderstand. The proxy server runs on the same box as Tor (Polipo is installed with Tor by default on the 'buntus and Debian). The caching proxy server is used to smooth out Tor's unreliability. If anyone can see what your proxy server is doing you have much bigger problems.

Re:I tried Tor.... (1)

Hatta (162192) | more than 3 years ago | (#35659086)

Oh right. It was privoxy last time I tried Tor, but whatever. Don't see how much that will really help, since the caching proxy can't know what you're going to want to see in the future. The first time you access any resource will be as slow as plain Tor.

Re:I tried Tor.... (1)

GameboyRMH (1153867) | more than 3 years ago | (#35659402)

Polipo also works like a download accelerator, which is a big help over Tor.

Re:I tried Tor.... (0)

Anonymous Coward | more than 3 years ago | (#35659614)

This should be emphasized. The parent is correct that other proxy servers must be avoided for the reasons stated. As GameboyRMH states, the Polipo proxy is part of the infrastructure installation for TOR and is there for a better user experience (it protects against browser timeouts).

Re:I tried Tor.... (0)

Anonymous Coward | more than 3 years ago | (#35659418)

I dunno what you were doing wrong. It's fine for web surfing as long as you don't try to run videos through it.

It's good for text and small pages. It's less good for multimedia. But for the really important stuff, text is the most you need. Beyond that, if an image is really important, it'll at least get through. The really really important stuff ends up either on freenet or wikileaks.

Re:I tried Tor.... (2)

Tolkien (664315) | more than 3 years ago | (#35657418)

That's because the number of exit nodes isn't very large. If there were more, a corresponding increase in speed would be the result.. If you want to help make Tor faster for other users, set up your own computer as an exit node.

Re:I tried Tor.... (1)

Kjella (173770) | more than 3 years ago | (#35657490)

If you seriously want to deal with everyone accessing everything through your IP address. Be prepared for a world of pain, particularly as a private individual where people will automatically assume you are the guilty one. Honestly, TOR is better off when the system is closed and everything is on .onion sites. There's much less hassle for everyone involved that way.

Re:I tried Tor.... (1)

SuricouRaven (1897204) | more than 3 years ago | (#35657572)

If accused, you can probably prove you were not responsible. After the police have siezed every computer and mobile phone you own, the press has dragged your name through the mud, and half the town are at your door with the traditional pitchforks to expell the suspected pedophile. If you're lucky, the police might even give your computers back after a year or so, once they have finished searching it for any other crimes you may have committed they can charge you with to save face.

Re:I tried Tor.... (1)

Moryath (553296) | more than 3 years ago | (#35657744)

Secondary problem: the ISPs in the US are actively pursuing policies (Comcrap and AT&T's "monthly bandwidth cap" crap for instance) that make it very painful to use Tor in other senses.

Make yourself an exit node and watch your traffic skyrocket...

Re:I tried Tor.... (1)

Runaway1956 (1322357) | more than 3 years ago | (#35659664)

The last time I looked, you could limit how much bandwidth you were willing to share. If your overall bandwidth skyrockets after installing Tor or some similar program, then you've failed to RTFM, and to properly configure the program.

Re:I tried Tor.... (0)

Anonymous Coward | more than 3 years ago | (#35658150)

There are countries where you can get away with running ANYTHING through a Tor exit node...it makes me giggle just thinking of it. But it has to be in the sweet butterzone. Not a first-world country where the corporations run wild and the government cares about what you do on the Internet, and not a 3rd-world hellhole where the gestapo will haul you off. I better not name any places specifically, you can understand why.

Posting anon because I don't want to be a suspected pedo, I just like to do some things that piss of corporations and governments very, very much.

Re:I tried Tor.... (1)

Rei (128717) | more than 3 years ago | (#35658170)

That's what I2P is for. No exit nodes, purely internal. It has a number of neat architectural differences from Tor to make it harder to attack and to improve performance. Also, for those who care, unlike Tor, I2P doesn't try to block filesharing.

Downsides: I2P is Java, so it eats more CPU. Also, it has a smaller userbase, meaning it's been less studied and isn't as resistant to takeover-style attacks like Sybil. And, obviously, you don't route to the outside world from I2P.

Re:I tried Tor.... (1)

TheCarp (96830) | more than 3 years ago | (#35659042)

How exactly does tor attempt to block file sharing? Aside from recommending against certain things like bittorrent (which is pretty pathological on the tor network for various reasons, the designs just do not play nice with eachother), I am unaware of any such attempt.

In fact, I believe there are a few file sharing sites in .onion space. I don't use them, but I am pretty sure I have seen them.

Re:I tried Tor.... (1)

Rei (128717) | more than 3 years ago | (#35659568)

Default exit policy: Link [torproject.org]

Re:I tried Tor.... (1)

TheCarp (96830) | more than 3 years ago | (#35659826)

From the same FAQ answer:
"keep in mind that, any port or ports can be opened by the relay operator"

Of course, by default, p2p services tend to be blocked, but, even looking at the original article mentions that many p2p programs present problems for anonymity, even with tor. Also, these programs tend to open ALOT of connections.... which tends to be a problem.

They also tend to be services that are more likely to cause problems for exit node operators.

All that said, like the FAQ says, any operator of an exit node can turn any or all of these on.

I don't know how many of these have working exit nodes for them, but in any case, its a pretty "soft block".

Now, if they went around slapping any node that did allow these as a "bad exit", then it would be a different story... but so far.... I have only seen that for some pretty suspect setups that made people really uneasy (specifically there was one that only allowed exits on a bunch of the unencrypted ports for various protocols like imap and pop)

Re:I tried Tor.... (1)

Runaway1956 (1322357) | more than 3 years ago | (#35659766)

"No exit nodes,"

You're sure? I'll have to look again, to be sure, but I think that it actually does support exit nodes. The problem is, no one actually creates an exit node.

Re:I tried Tor.... (1)

TheCarp (96830) | more than 3 years ago | (#35658990)

I happen to mostly agree but...

I also ran a tor exit node from my home for a while. Not recommended for a few reasons, but I did. The worst that ever came from it? I found that I couldn't use my IP to post on craigslist anymore. Never heard a peep from my ISP (was comcast at the time), nothing.

Re:I tried Tor.... (1)

Anonymous Coward | more than 3 years ago | (#35657550)

Chalk this up to "This is why we can't have nice things."

I ran a tor exit node, and I was pretty interested in seeing what was being accessed, so I ran it through squid.

And now, I don't run a tor exit node because as far as I can tell, unless I just got all the deviant-redirected traffic, it's not being used for much, if any, good. And I was just redirecting http traffic!

*Now, this only meant I could see what was being accessed. I still couldn't see who/where was accessing what, just looked through the access and store logs, nothing deeper.

Re:I tried Tor.... (1)

royallthefourth (1564389) | more than 3 years ago | (#35657956)

If you had looked deeper, you wouldn't found an incredible quantity of passwords being sent in plaintext to login to websites that don't use SSL.

Re:I tried Tor.... (1)

Runaway1956 (1322357) | more than 3 years ago | (#35659594)

I've found Tor to be slower than an unencrypted direct connection made through standard ports. I'll give you that much. But, Tor's usefulness isn't measured in speed. It's measured in anonymity. Think about it - one doesn't buy a 60 horse John Deere tractor for street racing. Why would you "buy" Tor for speed surfing?

Now, if you care to see something that is really slow, you should look at I2P. It's far more anonymous than Tor - and it's also much slower. Go on, test drive it, for educational purposes. Be warned - it's anonymity level is pretty high, and some really creepy characters use it to find and share child pornography. But, you don't have to see any of that, because you are forewarned. Just use one of the indexing services to find your content, and you'll be safe from that sort of trash.

Never 100% safe (5, Insightful)

Tigger's Pet (130655) | more than 3 years ago | (#35657242)

I guess that the research demonstrated by Stevens LeBlond just goes to prove what most of us have known for a long time - even using TOR (and the same will go for any other type of encryption, IP masking etc) you are not 100% safe if somebody wants to work out who you are. The governments may not care too much if you are just sharing a few pirated movies around, although some companies may, but I can guarantee that those carrying out the real illegal activity, such as sharing child-pr0n, will be tracked down one way or another.
All that TOR does is provides people who aren't really that switched-on with a false sense of security about their activities.

Re:Never 100% safe (0, Interesting)

Anonymous Coward | more than 3 years ago | (#35657544)

Torrent is a naturally leaky protocol, it doesn't take much effort to conceal anything about the user. It isn't even surprising that they could find it.

and the same will go for any other type of encryption, IP masking etc

Equating encryption with IP masking shows that you know nothing about what you are talking about.

I can guarantee that those carrying out the real illegal activity, such as sharing child-pr0n, will be tracked down one way or another.

I could go download 100000 CP videos over Tor\Freenet right now and never fear being discovered. Got read the news, anyone who was caught was using Limewire, tried to access a honeypot, or bought the sick shit.

All that TOR does is provides people who aren't really that switched-on with a false sense of security about their activities.

Does the Tor project, the EFF, and the Navy know that the project that they supported at one time or another have no grounding in mathematics and are just snake oil? Who to believe, some asshole on slashdot, or a peer-reviewed project.....

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657806)

Torrent is a naturally leaky protocol, it doesn't take much effort to conceal anything about the user. It isn't even surprising that they could find it.

Torrent != TOR

totally different in concept, use, and technology.

I could go download 100000 CP videos over Tor\Freenet right now and never fear being discovered.

LeBlond showed that it is possible to locate the IP Addresses of some users on TOR. You may not fear it, but that does not make it impossible.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657868)

Read the fucking summary, I'll even bold the important parts:

LeBlond and his co-authors titled "Bad Apple," used an exit node that the researchers controlled in order to trace the streams of data sent by users of BitTorrent over Tor back to their IP addresses."

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657972)

RTFS:
"used an exit node that the researchers controlled in order to trace the streams of data sent by users of BitTorrent over Tor back to their IP addresses"

It's also in TFA:
"P2P apps on Tor kill privacy and a significant amount of Tor traffic can be traced with application level attacks," LeBlond said. Mathewson acknowledged in his talk earlier in the day that there are well-known issues with using BitTorrent and other P2P applications over Tor.

Re:Never 100% safe (1)

Tigger's Pet (130655) | more than 3 years ago | (#35658030)

My biggest concern with your entire posting is not being referred to as "some asshole on slashdot", it's the fact that you talk about downloading 10000 CP videos and then later on say that those who got caught were the ones who downloaded the 'sick shit'. How the hell do you define that? ANY CP is the 'sick shit'. There's no grading whereby some of it is OK, some of it is dodgy and some of it is bad - it's ALL bad!

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35658154)

I could

Notice that that does not mean that "I will", "I have", "I do", "I might", or "I want to". It means "I could", that it is possible, or that I have the ability to. I do not like CP, don't be a pretentious cunt and pretend that I did, okay? I said that I had nothing to fear should I download some.

Re:Never 100% safe (1)

Unordained (262962) | more than 3 years ago | (#35658192)

I'm curious: what if someone downloaded 10000 videos of people being shot by their governments? Would that be sick shit? Would it be bad? Would they become responsible for the deaths of thousands? (I'm not talking about Hollywood movie clips, I'm talking about, say, amateur video of street protests being repressed violently.)

Re:Never 100% safe (1)

F.Ultra (1673484) | more than 3 years ago | (#35658206)

I don't that he meant what you meant. He meant that he could safely download it using TOR without fearing to be caught. That is not a statemant that he will do that or that he wants to do that. And then he writes that the ones getting caught probably was buying the sick shit or downloading it from a central location such as limewire.

Since he wrote "that sick shit" he probably would never dl any of it, how did you fail to get that?

Re:Never 100% safe (1)

Dishevel (1105119) | more than 3 years ago | (#35659416)

He did not fail to get it.
He got it. But not getting it would allow him to attempt defend his complete lack of knowledge or understanding
of the topic he was posting by just attacking "an evil cp downloader".

Smart move.

But still a failure.

and Tiggers Pet?

What a cute name.
Seems to me to be purposefully designed to lure in children for nefarious purposes.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35658272)

He said "bought" the sick shit. Also, I believe 'sick shit' is meant as a reference to ALL child porn. Saying that he COULD download 100,000 videos without fear of being caught was simply laid out as an example scenario.

I think you may have had a reading comprehension issue.

Re:Never 100% safe (1)

icebraining (1313345) | more than 3 years ago | (#35658456)

While I'm not AC, I think the difference wasn't between CP and 'sick shit', but between those who download and those who bought. It's obvious that a money trail makes it much easier to follow.

Re:Never 100% safe (1)

Qzukk (229616) | more than 3 years ago | (#35659752)

those who got caught were the ones who downloaded the 'sick shit'.

No, he said bought, as in "with their own credit card".

It's sick shit either way, it's the people dumb enough to pay for it who get caught.

Re:Never 100% safe (1)

Rei (128717) | more than 3 years ago | (#35658308)

1) Tor and other such networks haveseveral *known, unresolved* vulnerabilities. Whenever you hear about something like this, you should read it as "another vulnerability discovered". One of the biggest problems such networks have is Sybil attacks, but they're hardly the only ones.

2) While it's technically possible to fileshare over Tor, it is discouraged and they do attempt to block it. If you want to do filesharing, you should be on I2P (which is also faster than Tor -- although still nothing you'd call "fast").

Re:Never 100% safe (1)

prakslash (681585) | more than 3 years ago | (#35657586)

The problem with anonymity, of course, is that it can be used for good or for bad.

On the one hand, these researchers are (admirably) trying to circumvent censorship put in place by repressive regimes. Of course, these regimes do not even care about Tor as they do not have the resources to attack it. Tor-Schmor, they will just throw a switch and cut off all internet access, period. On the other hand, we have sophisticated western organizations like the CIA and FBI that are hellbent on breaking Tor for the ostensible purpose of rooting out child porn and terrorism.

Who will win is anybody's guess.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657662)

The problem with anonymity, of course, is that it can be used for good or for bad.

Yes it can. Never follow an AC link to blog.com unless you want to find out.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35658188)

The problem with anonymity, of course, is that it can be used for good or for bad.

On the one hand, these researchers are (admirably) trying to circumvent censorship put in place by repressive regimes. Of course, these regimes do not even care about Tor as they do not have the resources to attack it. Tor-Schmor, they will just throw a switch and cut off all internet access, period. On the other hand, we have sophisticated western organizations like the CIA and FBI that are hellbent on breaking Tor for the ostensible purpose of rooting out child porn and terrorism.

Who will win is anybody's guess.

Any tool can be used for good or for bad. It is entirely a red herring for governments to claim that they have to defeat anonymity for our own good.

Information can be used for good or bad. Maybe governments should protect us from having information for our own good. Oh, wait. They do that, don't they.

The problem is not whether or not a government should do something to it's people, but rather why do we have a separation between government and people? When we have governments that claim to have something to do with democracy, why do we make a distinction between us and them?

The government shouldn't be allowed to do something for our protection unless we wish it to be so. Now I get the open source governance thing: government is not inherently bad. It is the government-not-of-the-people that is the problem.

Re:Never 100% safe (3, Insightful)

DeadboltX (751907) | more than 3 years ago | (#35658498)

The problem with anonymity, of course, is that it can be used for good or for bad.

Then the solution is clear! We must only allow things that can only be used for good!

Re:Never 100% safe (2)

hairyfeet (841228) | more than 3 years ago | (#35659074)

The funny (or sad, depending on how you very tons of tax dollars wasted) is that the whole child porn things is a red herring as well, at least according to a friend that works at the state crime lab in charge of dealing with the child porn busts (he keeps trying to recruit me, but there ain't enough brain bleach to take THAT job) as according to him all they bust on the net are social retards that frankly haven't touched anyone but themselves and are wanking off to the same old shit that has been floating around since the days of BBS.

So what do the actual child molesters, the sick bastards you really want to catch to actually save and protect kids use? Why its USPS that's right, the fucking mail. They only use the net long enough to set up a few contacts (which according to my friend they have set up the "entrance fee" in a way no cop will be able to pass, like abuse a kid in the manner they describe with an object they tell you to get and you only have X number of days to provide the video) and from them on its encrypted DVDs and mail drops all the way. if they don't receive word from a contact in X number of time they consider that link dead and move on, no trails.

He said all the cops KNOW about it, thanks to an ex cop they busted that had tons of the stuff unencrypted on his drive. Of course knowing and being able to do shit are two different things, we are talking DVDs with 2048 bit encryption, drives set up with Truecrypt inside Truecrypt, drive wiping on X number of wrong login attempts, pretty slick stuff.

But he said the only thing they get on the net anymore is the Chris Hansen total morons and a whole shitload of social retards that have literally mountains of DVDs full of Internet porn and have watched so damned much porn they can't even get a hard on to anything but the sickest shit. According to him the feds care about stuff like Tor because they figure your "hillbilly homegrown terrorist type" would probably use it, but figure any seriously hardcore bunch is probably using what the CP guys use.

Personally I think its a shame so much taxpayer money is wasted on catching the social retards and the Chris Hansen morons instead of trying to set up global networks to track down and bust the ones actually raping kids, but the politicians like seeing big numbers so there you go. I don't see how the guy does it myself, having to sit 8 hours a day and look at that shit? Not enough brain bleach in the world to take that job, and I sure as hell couldn't be all calm and shit when testifying against some guy who had actually raped his 6 year old and filmed it like my friend had to do last year, personally my urge to beat the shit out of him would be too great.

But if you run a Tor exit node or Freenet on a home connection you're bug fucking nuts, as the cops SOP is to kick down your door, charge you based on the IP logs, haul away ALL your shit, which you may or may not get back three to four years from now when they get around to it, that is if it doesn't get lost, and meanwhile the papers have already run your name as "suspected kiddie fiddler" so everyone thinks your a monster. In this red scare climate when it comes to CP you'd have to be insane to touch that software, at least if you live in the USA. Maybe things are saner in Europe, I don't know.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657698)

Pretty much this.
The only way anyone could be really sure they were safe is if they used a connection they don't own, such as open wi-fi, cracked, whatever.
Or VPN's using stolen credentials + Tor, or various free methods.
Tor can easily be broken through with enough resources put behind it.

The only real way you can be safe is darknets and / or sneakernets.
And even that it dependant on the participants. If they are closed off, it is pretty much impossible to get in.
Levels of Trust are the usual methods of distribution of content, typically used in piracy of movies, sometimes before they are even released.
One close group get a hold of content. They leak it to other sites. Then those people upload it to other sites, and usually P2P at this tertiary stage.
One thing I have always wondered is why they don't have camera grids setup in the theatres that can see the whole room, then some patterns that can then be used to triangulate where a recording took place in the room. They can then follow it up.
This might not be too accurate, but it will narrow it down to at least 9-ish people in a crowded room, if done right.

100% secure won't work unless well over half the internet was using some sort of layered encrypted routing system so that it makes it too hard to track people using rogue nodes.
But then it comes to this: no censorship, more secure, more censorship, less secure.
You will end up coming across some content you won't agree with if you want a censorship free communication system, this is a fact.
You'll just have to deal with it in the ways you can if it means getting whatever message you want to send or receive.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657790)

Tor can easily be broken through with enough resources put behind it.

Really? Who are the amazing cryptanalyst who managed that one? Or do you mean that they can just bruteforce it and go from there. Yeah, I'm sure that the evidence will be really useful 200M years after the crime was committed

Re:Never 100% safe (1)

Rei (128717) | more than 3 years ago | (#35658538)

What makes you think you need to break crypto to crack Tor? Have you never bothered to do a google search on Tor's known and unfixed vulnerabilities? Here's a top hit [events.ccc.de] .

Re:Never 100% safe (1)

TheCarp (96830) | more than 3 years ago | (#35659248)

Depends on your definition of "broken". Tor tries to do more than obscure what you are sending. Anyone who has an exit node can sniff your traffic unencrypted... anyone with enough middle nodes is likely to own a whole circuit of yours eventually.

Even without enough to get your whole circuit, packet timing on the end server could be enough, if they have your entry node, to tie the whole connection back, even without the middle hops.

I am sure there are even more clever attacks....none of which involve actually breaking crypto. SSL is enough to keep communications private, tor attempts to defeat traffic analysis too, which is a much harder problem.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657714)

how about if your first node (your system) is a tor node - there'd be no way to tell if the traffic is from that system or relayed from another.

Re:Never 100% safe (4, Informative)

alan_dershowitz (586542) | more than 3 years ago | (#35657748)

The attack relies on the way Bittorrent is used and the fact that it uses UDP for contacting peers (which Tor doesn't route, causing only the tracker connection to be Torified) causing information leak; controlling an exit node to do a MitM); and the fact that Tor multiplexes multiple streams through the same node for performance reasons (meaning you can observe all the traffic that someone is going to through your exit node, once you've established who they are.)

This attack won't work on you if:

1. You are only using one app, in particular it won't work on you if all you're using is a browser and TorButton
2. The same app is not sending data across both Tor and no-Tor
3. The app in question can detect tampered-with data (SSL cert mismatch, etc.)
4. As a precautionary measure, you are doing strict firewall egress filtering while using Tor.

In short, if you are technically knowledgeable and careful, this attack doesn't apply to you. So, it's not the end of the road for Tor and anonymity, although it's a problem for "regular" people using Tor who can't be expected to keep track of all the ways their computer can unmask them.

Re:Never 100% safe (1)

Rei (128717) | more than 3 years ago | (#35658784)

There are just so many ways you can bust people using Tor. Here's just some [events.ccc.de] . Any dedicated professional organization -- the RIAA, MPAA, CIA, China, etc -- can find you if they think it's worth their time and effort. Spending the resources to catch one person obviously would rarely be worth it, but the real concern is whether they feel it's worth it to laydown a blanket exploit to catch as many people as possible so they can filter through the ones they want to expose at their leisure.

Here's an example of why it's so damned hard to maintain anonymity on these networks. Alice is trying to do something online that Bob doesn't want her to do. So she uses Tor. Bob sees that someone is using Tor to break their rules. Bob starts a DOS against all IPs of potential infiltrators, one at a time, until suddenly, the bad activity stops. They let up on their DOS and it starts again. Bingo -- you've just figured out Alice's IP. It can happen so fast that all Alice experiences is a tiny network hiccup. But it gets easier. If Bob is a government, they don't even *need* to do a DOS; ISPs under their control can periodically probe their users for them. Or Bob can just rely on natural network outages and just correlate the outages with lulls in people doing the Bad Thing(TM).

This is but one type of attack against anonymity of these sort of networks out of dozens. There's Sybil attacks, where Bob makes a bunch of fake Tor identities, isolating Alice with a bunch of compromised nodes so that what she sends can be known for certainty that it originated with her. There's clock skew attacks, where you look at the user's unique clock skew when doing the bad thing (Tor has only partial immunity to this). There's cookie attacks, javascript attacks, browser property attacks (everything from user agent strings to browser window height), SSL client certificate attacks, and on and on in order to correlate private browsing with hidden browsing. And on and on and on.

Re:Never 100% safe (1)

ThunderBird89 (1293256) | more than 3 years ago | (#35657874)

Well DUH...

If they control an exit node, it stands to reason they could follow the data back at the very least one node. This is the same as breaking AES: possible, if you can access the system, and run some custom code on it...

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35657910)

Eight years later and counting, no CP arrests related to freenet or tor found. I don't know why you'd use bittorrent over tor anyway, no one does. Least not anyone who has something to hide. Top that off with an open/hacked wifi like I do and you're good as gold, 100% safe to download all the CP you want. Reality is that only stupid fucks get caught, we go on and the quality gets better, the bandwidth gets better and the tools get better than the detection. We won, you lost, fuck you (and the little girls). Do I need to troll? No, I'm just telling you the truth no one else dares. Smart people that like child porn don't risk anything, the backbone never dies. Sure, the police catch a few and announce "mission accomplished" but they got less cred than Bush.

Reality is that you only slow the rate we're winning. Already my CP collection has passed 1TB and growing, millions of pictures and thousands of videos. All the cops want you to do is stick your fingers in the ear and say "LALALALALA we're winning" as loud as you can. You're not. You're losing. Obviously no one speaks for us or less you how many lies you're being fed. Every number you see is lies. They report IP addresses as people, they report any child of someone they arrest a victim. Truth is they catch nothing but cannon fodder, and rarely us. Certainly not enough to make a difference. Except who is going to stand up and tell you that? No one. Nothing but a bunch of liars, all of them. IÂ'd show you proof but that'd ensure this post ends at -1. The truth will still prevail.

Re:Never 100% safe (1)

rpresser (610529) | more than 3 years ago | (#35658074)

You must have a lot of faith in Slashdot's anonymity. More than I would have.

Re:Never 100% safe (1)

dgatwood (11270) | more than 3 years ago | (#35658270)

You're new here, aren't you? Do you think somebody would post a comment like that if he/she had actual child porn?

What we have here is a troll. Nothing more.

Re:Never 100% safe (-1)

Anonymous Coward | more than 3 years ago | (#35658412)

I dare you [10pix.ru] to click this link. NSFW to say the least.

Re:Never 100% safe (1)

Anonymous Coward | more than 3 years ago | (#35658696)

Just a warning: that is CP.

...Child porn on Slashdot.... More original than the Goatse troll, but still nothing new or original. Worse stuff on /b/ all the time.

On a lighter note, Googling "tara child porn arrest" gives http://www.fbi.gov/atlanta/press-releases/2009/at030509.htm [fbi.gov] which says that he was already busted WOOHOO!

Re:Never 100% safe (1)

Urza9814 (883915) | more than 3 years ago | (#35658426)

hahahahahahahaha...

Seriously, you think governments are more concerned with child porn than copyright infringement? Clearly you haven't been paying much attention to what laws have been being passed lately....child porn is something they say they're working on to make people feel good. Copyright infringement is something they actually work on, because the people pushing that have enough money to make sure things actually get done.

Re:Never 100% safe (0)

Anonymous Coward | more than 3 years ago | (#35659842)

Actually I'm sure you are more likely to get traced for distributing movies and music than CP, since the MPAA and RIAA lobbies are simply bigger.

Re:Never 100% safe (2)

Americium (1343605) | more than 3 years ago | (#35659850)

Drive around until you find an open Wifi signal. 100% untraceable back to you.

ISPless inter-meshes? (0)

Anonymous Coward | more than 3 years ago | (#35657296)

So where is this peer-to-peer (as in user nodes, not IPS peers) internet people talk about from time to time?

If people have mobile devices, is there a way they can create ad hoc networks that use nothing but the tools at hand? That is, not even the cell towers, but just the mesh of devices?

Re:ISPless inter-meshes? (1)

SuricouRaven (1897204) | more than 3 years ago | (#35657750)

I've been urging that someone more capable than myself look into that. Unfortunatly routing would be a nightmare and latency just as bad - I imagine that it would be unuseable for real-time communcations, certainly so in sparsely populated areas. But it could still function using some sort of shared caching system, similar to Freenet - or even just using Freenet, with adaptations to run on portable devices and with ad-hoc connections between nodes.

Better not to be a tor exit node.... (-1, Troll)

slushslash6 (2028518) | more than 3 years ago | (#35657316)

Its already happened that one man was charged with felony [blog.com] and lost for defacing a site that was done through his computer that was a tor exit node.

Re:Better not to be a tor exit node.... (1)

Anonymous Coward | more than 3 years ago | (#35657420)

Ugh. Goatse. You asshole.

Re:Better not to be a tor exit node.... (1)

Kjella (173770) | more than 3 years ago | (#35657456)

Ugh. Goatse. You asshole.

UID >2000000 and blog.com. Coincidentally the same problem with anonymous networks, except it's more extreme there. No, goatse is not the worst you can see.

Re:Better not to be a tor exit node.... (2)

0100010001010011 (652467) | more than 3 years ago | (#35657430)

hello.jpg EXIT! DO NOT CLICK.

Hopefully this does more help than a mod down.

Re:Better not to be a tor exit node.... (2)

GameboyRMH (1153867) | more than 3 years ago | (#35657440)

Ohoho, nice try, but you won't goatse me today! ;)

Yay, it's been a while since I last was goatsed (0)

Anonymous Coward | more than 3 years ago | (#35657444)

I just wish I had my webcam recording the look on my face...

Re:Yay, it's been a while since I last was goatsed (1)

rpresser (610529) | more than 3 years ago | (#35658096)

Rest assured, your webcam WAS recording. Just not to your hard drive.

Re:Better not to be a tor exit node.... (1)

Tolkien (664315) | more than 3 years ago | (#35657460)

As far as I understand it, if you want to host a Tor exit node it should be public knowledge that the address serves as a Tor exit node. This means you should advise your ISP that it is, and list the reasons.

Re:Better not to be a tor exit node.... (0)

Anonymous Coward | more than 3 years ago | (#35657468)

I hope you die in a fire before you are old enough to contaminate the gene pool. Besides, shouldn't you be in school right now, or out playing in traffic?

Re:Better not to be a tor exit node.... (2)

Tolkien (664315) | more than 3 years ago | (#35657478)

Oh geez. I replied without clicking the link. It's a goatse. Don't go.

integrate Tor and Incognito Mode? (2)

Speare (84249) | more than 3 years ago | (#35657472)

I'd like to see better integration with Tor and Chrome's Incognito Mode. Normal plain-jane internet route for all my apps, but route all incognito traffic through Tor. Otherwise, I find it a pain in the rear (not to mention more error prone) to keep toggling OSX between "performance mode" and "tinfoil hat mode." Doesn't really matter what I'm viewing in tinfoil hat mode, I just would rather have the same kind of barriers on my local cookie/history storage as I have out in the world.

Re:integrate Tor and Incognito Mode? (0)

Anonymous Coward | more than 3 years ago | (#35658472)

This will work if TOR is packaged with Chrome AND by default your node becomes an exit point. Otherwise the sheer number of new users will overwhelm the current exits, which a known bottleneck.

One word (1)

Locke2005 (849178) | more than 3 years ago | (#35657502)

Steganography. Make it impossible to determine what traffic is encrypted by embedding the encrypted traffic as noise in, say, a video extolling the virtues of the dictator.

Re:One word (0)

Anonymous Coward | more than 3 years ago | (#35657598)

Watch Contact recently did we?

Re:One word (4, Interesting)

SuricouRaven (1897204) | more than 3 years ago | (#35657602)

Massive, massive overhead. Also, only any use for private communications where both parties have already exchanged some form of key.

Re:One word (4, Interesting)

Locke2005 (849178) | more than 3 years ago | (#35657726)

Correct on both counts. But any system that allows new people to join in without being referred by a trusted party invites participation by government infiltrators. Consider key exchange as a form of formal introduction, like a fraternity handshake.

Re:One word (2)

SuricouRaven (1897204) | more than 3 years ago | (#35657976)

Depends on your aim. Freenet is one of the more prominant projects in this area, and it's designed for anonymous publication - that is, you don't mind the government seeing it so long as everyone else can, and it can't be traced to the source. Great for spreading videos of government abuse of power, leaked documents, counterpropaganda, surpressed books, etc. Anything you want everyone to see, but can't risk being identified as a distributor for. There is no invite needed, and yet finding the source of a document is very close to impossible baring some form of user error.

Not that user error is hard to induce. It's quite possible to say, send someone a link to a non-existant news article on a government-controlled server. They get the link, follow the link, find nothing there... and then all the attacker need do is grep the logs, because the one person who accessed that particular fake address must be the one it was sent to.

"Security through obscurity." (1)

westlake (615356) | more than 3 years ago | (#35657838)

Steganography. Make it impossible to determine what traffic is encrypted by embedding the encrypted traffic as noise in, say, a video extolling the virtues of the dictator.

and when the secret police begin asking the right questions about the source of the video, what then?

Steganography is all about blending into the background.

Not drawing attention to yourself.

clandestine exit nodes (0)

circletimessquare (444983) | more than 3 years ago | (#35657690)

everywhere

supported by western governments

you would be correct to assert that western officials have their heads up their asses and won't immediately grasp that tor is a friend, not an enemy, and an excellent way to bring down beijing, tehran, havana, and harare cheaply. but they'll warm up to the possibilities

Re:clandestine exit nodes (1)

royallthefourth (1564389) | more than 3 years ago | (#35658204)

an excellent way to bring down beijing, ... havana,

People in China are generally enjoying a steadily rising quality of life, regardless of how politically repressive the state may be. Revolutions don't happen because some blogger got arrested or a site was blocked. If anything will cause real unrest there, it will be the sort of falling wages that caused Tienanmen.

People in Cuba are well educated and free from disease and starvation. Unlike China, the internet isn't very prolific and is difficult to use at all. They really can't even use Tor because the USA won't allow Cuba to connect to the fiber, so their only access is satellite (until they finish linking with Venezuela). And, of course, there is no private ownership of computers. Last I heard, there's only about 50 political prisoners in the whole country, hardly the level of police state it is made out to be. Consider Guantanamo; the USA has more political prisoners in Cuba than Cuba does!

Certainly the USA-created governments in Iraq and Afghanistan cause more terror and provide fewer opportunities for their citizens than Cuba.
It would take far more than an internet propaganda operation to topple China or Cuba.

Re:clandestine exit nodes (0)

circletimessquare (444983) | more than 3 years ago | (#35658374)

cuba jails political prisoners. period. do you find that acceptable?

iraq and afghanistan's governments are obviously orders of magnitude better than the governments they replaced. true or false?

i really don't have a problem with people who criticize the usa. what drives me nuts are morons who make out the usa's enemies as better than they really are, out of some misguided sense of false equivalency. the usa does plenty wrong in this world. true. but if that observation changes your perception of the usa'ss enemies, you're an idiot. cuba, china: far worse than the usa and vile entities which must have their governments overthrown. no matter what the usa does!

and yes, china won't revolt until the economy sours. since no economy grows forever, it will happen sooner rather than later. at which time, will you stand with the chinese people? or the chinese government?

do you stand with the cuban people? or the cuban government? and i'm sorry, but in a nondemocracy, those are two separate entities, and for failing to understand this fact in commenting on these countries, you're a moron

Re:clandestine exit nodes (1)

TheCarp (96830) | more than 3 years ago | (#35659376)

Yup. Though, I tend to include the USAs rather broken form of "Democracy" on the "nondemocracy" list.... alot of people don't get.... I ONLY criticize the US (generally). Its not that I think Cuba is great... or that China is wonderful (but truth be told, they seem to be way more open and making a lot more progress towards openness than I ever would have predicted 10 years ago, never mind 20.... not giving them a pass, just, some credit for improvement).

I always get "Where would you rather live". Nowhere, I think this place is the best there is, but that doesn't mean I think its sufficiently good. There is no such thing, always strive for better.

That said, I answer your question as no. Its not "acceptable".... but how "Acceptable" is it that the US jails people for growing plants that it doesn't like? Its put people in jail for decades for nothing more than that. How is that acceptable? I see it as just as bad...but the difference.... we also have the highest per capita incarceration rates.

We have LOTS of what I would term "unacceptable imprisonment" right here.

Re:clandestine exit nodes (1)

Billly Gates (198444) | more than 3 years ago | (#35659580)

Reading this I feel the US is going to have some revolts very soon.

In America we are technically still better but we are falling very very fast. In China the country is much poorer but they rising and getting better. If wages fall people protest and the problems at home are always the issue that drives people first regardless if the government is a democracy or a dictatorship.

I am not a tea partier or anyone who hates Obama, but how many banks will we keep bailing out, how many more jobs must we outsource, how many more social services do we have to keep cutting. The unemployed and underemployed will have enough sooner or later.

I feel if the opportunity arouse for people to protest you could bet millions would join.

Re:clandestine exit nodes (0)

Anonymous Coward | more than 3 years ago | (#35658566)

You are assuming Western governments want to bring down Beijing, Tehran, Havana, Harare, etc... Without a persistent 'threat', how can they justify elevated defense budgets? That would be bad for business and entrenched interests. Witness the current Western waivering as supposedly 'evil' dictatorships in the Middle East are falling from within. Their argument: even 'scarier' Islamic Terrorists (TM) may take over.

Once you understand the simple fact that fear beats reason, you'll grasp everything that happens in politics.

Re:clandestine exit nodes (0)

circletimessquare (444983) | more than 3 years ago | (#35658662)

thanks for your input, crackpot

Re:clandestine exit nodes (0)

Anonymous Coward | more than 3 years ago | (#35659628)

it'll never happen. Western governments are corrupt. Some say, corrupted by design by financiers.

Re:clandestine exit nodes (1)

Actually, I do RTFA (1058596) | more than 3 years ago | (#35659686)

you would be correct to assert that western officials have their heads up their asses and won't immediately grasp that tor is a friend, not an enemy

Considering TOR was an invention of the US Navy, you'd assume that the military, at least, considers it a boon.

oblig. (1)

ilsaloving (1534307) | more than 3 years ago | (#35658010)

IP over Avian Carrier could bypass the problem entirely! http://www.faqs.org/rfcs/rfc2549.html [faqs.org]

Re:oblig. (1)

F.Ultra (1673484) | more than 3 years ago | (#35658238)

No it doesn't, in fact it makes it far easier since you can track the pigeons. Some stupid criminals way back in the 70:s or 80:s in the Swedish town of Ystad tried that trick (tried to receive a kidnap ransom safely by having the senders deliver via postal pigeons, so all the police had to do was to track the birds..).

Re:oblig. (2)

ilsaloving (1534307) | more than 3 years ago | (#35658530)

Only because the criminals didn't protect the pigeon's identity by having them wear masks and spandex tights during their flight.

Touhou (0)

Anonymous Coward | more than 3 years ago | (#35658220)

Is Stevens LeBlond a Touhou fan? Why'd he call it "Bad Apple"?

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...