Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Tor Open To Attack

Posted by kdawson on Sun Feb 25, 2007 03:58 PM
from the peeling-the-onion dept.
Security Privacy IT
An anonymous reader writes "A group of researchers have written a paper that lays out an attack against Tor (PDF) in enough detail to cause Roger Dingledine a fair amount of heartburn. The essential avenue of attack is that Tor doesn't verify claims of uptime or bandwidth, allowing an attacker to advertise more than it need deliver, and thus draw traffic. If the attacker controls the entry and exit node and has decent clocks, then the attacker can link these together and trace someone through the network."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Tor Open To Attack 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Well, not just that. (Score:5, Interesting)

    by James_Duncan8181 (588316) on Sunday February 25 2007, @04:02PM (#18145700) Homepage
    If the attacker advertises absolutely massive values (and hey, it's only a string) they can time out all of the packets and DoS the network too.

    This actually makes me wonder if there is a military/intel datacentre that does this already.

    • Re: (Score:3, Informative)

      by TubeSteak (669689)

      If the attacker advertises absolutely massive values (and hey, it's only a string) they can time out all of the packets and DoS the network too.
      Wouldn't that only last as long as [max client timeout]?
      At which point the client seeks another route. Right?

      What I'm saying is that I don't think this would be effective with only one or two nodes.
      Though on a larger scale, I agree that this tactic could effectively DOS the network.
      • At which point the client would time out, and pick a new route at random, which could very well be through the node doing the DoSing, if the idea is implemented correctly.

    • COMSEC, not SIGINT (Score:5, Interesting)

      by dr.badass (25287) on Sunday February 25 2007, @04:50PM (#18146138) Homepage
      This actually makes me wonder if there is a military/intel datacentre that does this already.

      Probably, but not for the reasons you think. Tor is known to be used by the military (how much is anybody's guess) for the same reasons anybody else would use it.
      • The military and secretive NSA operations do not care about you or your open source proxy software. Stop trying to make yourself feel special by writing convoluted conspiracy theories.

        No, but the Chinese equivalent of the FBI probably cares a lot about what its citizens are doing on the net, and the ability of users living under hostile regimes to get unfettered network access is one of the goals of projects like Tor.

        There are people with resources besides the NSA.

        • Re: (Score:2, Interesting)

          by Anonymous Coward
          Exactly. I used to work for a spook house. If I described what lengths they went to keep data secret, people here on slashdot would offer me a nice tin foil hat and a pair of plastic unbreakable no-sharp-edge spoons to play with, and offer me a coat (with long sleeves that seem to buckle in the back). The thing to remember though, is that with all the technology we had, we had to assume that everyone else had at least as much. Pointing a laser at a window 2 miles away and receiving the reflection (non-v

      • Re:Well, not just that. (Score:5, Informative)

        by Wonko the Sane (25252) * <wts42@yahoo.com> on Sunday February 25 2007, @04:44PM (#18146084) Homepage Journal

        The military and secretive NSA operations do not care about you or your open source proxy software. Stop trying to make yourself feel special by writing convoluted conspiracy theories.

        If [dailykos.com] only [commondreams.org] that was true [sldn.org]...

          • I would trust DailyKos about as much as I would trust Fox for any reliable, real news. Not saying the story isn't important, but consider the source/election fodder.

            That's true, but there are enough of these stories floating around from different sources that it's safe to just pick some random examples.

            I actually think the OP's reasoning is flawed in that he assumed that the government behaves in a rational manner. Just because it doesn't make any sense to a sane person for the NSA to worry about the TOR pr

            • That's true, but there are enough of these stories floating around from different sources that it's safe to just pick some random examples.

              Can I have a ride on the flying saucer, then?

              (Or, to pick another snarky comment, the plural of anecdote != data).

          • Re: (Score:3, Insightful)

            by bhsx (458600)

            Of course there are going to be police at protests. Blending in with the crowd just makes it easier to take care of things if an incident occurs. Is this supposed to be surprising, scandalous, conspiratorial? Because it's not. It's perfectly logical to anyone with a lick of sense.

            This is from the second link of the GP:

            The officers hoist protest signs. They hold flowers with mourners. They ride in bicycle events. At the vigil for the cyclist, an officer in biking gear wore a button that said, "I am a shameless agitator." She also carried a camera and videotaped the roughly 15 people present. Beyond collecting information, some of the undercover officers or their associates are seen on the tape having influence on events. At a demonstration last year during the Republican National Convention, the sham arrest of a man secretly working with the police led to a bruising confrontation between officers in riot gear and bystanders.

            Perfectly logical? Really?

      • Considering how large a strain TOR puts on the system vs. straight P2P, I'd only use it for very high risk stuff. In the current climate, your average illegal downloads/uploads just don't cut it ( 1 in 10M chance of getting caught, and the punishment is nowhere near what you get for things like political dissent in some places). Perhaps if the risk goes up it will be a worthwhile tradeoff though.

  • "I felt a great disturbance in the Internet, as if millions of child-pornographers suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened."

    Now now, I know Tor isn't just used for naughty stuff. I just thought it was funny. Sorta.

    • Re:Not quite so oblig SW reference.. (Score:4, Informative)

      by Ice Wewe (936718) on Sunday February 25 2007, @04:19PM (#18145838)
      Seriously, this is why Tor tells you at the start that you shouldn't rely on it for strong anonymity.

      "Feb 25 16:16:02.628 [notice] Tor v0.1.1.xx. This is experimental software. Do not rely on it for strong anonymity."

      Thus proving, once again, that Tor is only for the Quasi-anonymous group.

      • Tor tells you at the start that you shouldn't rely on it for strong anonymity.

        Tor also tells you to not use it for BitTorrent, but clueless Diggers continue to do so.

    • So, ze kiddie porn is on vor mind, eh Social Engineer? Very interesting. Who besides grandstanding politicians, media whores and actual pedophiles actually thinks or talks about kiddie porn? You must be one of the bag guys. The FBI vill be watching everything you do for the next ten years.

          • Hate is such a strong word. You're also entirely wrong, as per usual.

            There are plenty of others and they are easy to identify because they keep saying the same things: M$ rules, free software sucks and Slashdot sucks.

            I look forward to you finding where I said any of those things at any point. I'll be waiting, as usual, for any sign of a coherent argument from you.

          • What do I, or Joe, or dedazo, or any of the other user names you intentionally misspelled, have to do with your parent comment?

            Oh, I know. Hate.

            • You hate me.
            • You hate Joe.
            • You hate dedazo.
            • You hate Macthorpe.
            • You hate GeckoX.
            • You hate Microsoft.
            • You hate Bill Gates.
            • You hate Steve Ballmer.
            • You hate Apple.
            • You hate Steve Jobs.
            • You hate anyone who disagrees with you.
            • You hate anyone who knows about your sock puppet, Erris.
            • You hate anyone who holds you accountable for your conduct on this forum.
            • You hate

  • In Soviet Russia... (Score:2, Funny)

    by Anonymous Coward
    In Soviet Russia, Tor attacks YOU!

  • How Many Nodes Do You Need to Own? (Score:5, Insightful)

    by quanticle (843097) on Sunday February 25 2007, @04:15PM (#18145808) Homepage
    "We show that even if an adversary can control a few malicious nodes -- 3 to 6 with a PlanetLab network of 60 honest servers -- the adversary can still compromise the identity of a significant fraction of the connections from new clients."

    3 to 6 servers out of 60 is still 5 to 10 percent. That's fine for small networks, but for a network with hundreds or thousands of nodes, controlling 5 to 10 percent may become infeasible. Does this attack require the number of nodes to scale with network size?

    • Re:How Many Nodes Do You Need to Own? (Score:4, Interesting)

      by TheRaven64 (641858) on Sunday February 25 2007, @04:33PM (#18145960) Homepage Journal
      It doesn't tell you anything meaningful unless it tells you what the requirements on the distribution of the nodes is. You could, hypothetically, run a few thousand tor nodes on a single machine. Would this allow you to compromise a network of a few tens of thousands of nodes?
      • Except you need to convince the nodes to use the same IP for all hops. A TOR client should spread it's hops through out the available / advertised nodes. Also this attack isn't exactly new, timing weakness have been known for as long as the network has been around I should think (it's in the white paper). Granted their approach is somewhat new, but TOR has never claimed to provide strong anonymity, you need something like Herbivore for that.

        • Re: (Score:2, Interesting)

          by mrogers (85392)

          TOR has never claimed to provide strong anonymity, you need something like Herbivore for that.

          Herbivore isn't vulnerable to traffic analysis but it's vulnerable to DoS: the attacker's nodes follow the secure entry protocol and get assigned to random cliques. Then they transmit in every round, jamming communication within their cliques. Jamming doesn't require any more bandwidth than normal participation in the protocol, and the source of the jamming can't be detected because communication within a clique

    • Re: (Score:2, Informative)

      by mrogers (85392)

      That's fine for small networks, but for a network with hundreds or thousands of nodes, controlling 5 to 10 percent may become infeasible.

      Tor scales to a few hundred nodes [noreply.org], but it doesn't scale indefinitely - all the routers are listed in a central directory [seul.org] to ensure that all clients use the same set of routers and the same set of public keys.

      • "Tor scales to a few hundred nodes, but it doesn't scale indefinitely"

        Okay. I understand now. Because Tor can only scale up to a few hundred nodes, you only need ten or twenty compromised nodes to effectively monitor the entire network.

  • Anonymity Vs Performance in Multi-Hop Networks... (Score:5, Interesting)

    by Roger Wilcox (776904) on Sunday February 25 2007, @04:22PM (#18145866)
    ...is really what the article is about. Granted, I only read the abstract, but someone here at /. seems too intent on making a dramatic headline out of this.

    It has been known for some time that anyone with the resources to do so could launch an end-to-end attack on Tor. That someone with relatively few resources could launch the same attack is newsworthy, perhaps, but far more interesting is the observation that optimizing network traffic flow in order to improve performance is the direct cause of this weakness.

  • Could this be avoided? (Score:4, Informative)

    by DogDude (805747) on Sunday February 25 2007, @04:26PM (#18145914) Homepage
    From what I can tell, it sounds like an attack can be either minimized or avoided completely if there are enough "server" nodes in the network. The "server" nodes, or the nodes that are exposed to the potential naughtiness, are always in short supply due to people understandably not wanting the FBI to show up to their door, hauling them off to Guantanamo Bay for a round of government-sanctioned torture. The thing is, for the time being, we're seeing a proliferation of completely open (untraceable) wireless networks that could potentially solve this problem. If a relatively large number of geeks were to throw a machine at their local free wireless connections, then they could potentially help out the TOR network for people who don't have access to such an "open" network. Now, we will eventually see these wide open free-for-alls shut down once the feds get their heads out of their asses and start taking Net-based crime seriously. But for the time being, we should all pitch in and take advantage of these networks while we've got 'em. I'm working on putting together a few Frankenstein PC's now and they'll be sitting within range of my town's wireless network, and they'll be routing TOR traffic. If somebody does some truly nasty stuff, and it comes out via one of my TOR nodes, then all the federales will be able to see will be the MAC addresses of my network cards, and have no idea where to find said network cards on the wireless network.
    • Triangulation.
        • Well, if they knew the access point you were using (based on the IP address, which they'd then take to the ISP and demand to know the customer address), they'd just go down there and sniff packets for your MAC address. It's fairly trivial at that point to determine the direction that the radio signals are coming from. (There are guys that do it as a hobby [aol.com].)

          Probably your best bet would be to use a spoofed MAC address, and change both the AP you connect to, the MAC address you report, and the PC's physical location, on a regular and frequent basis. That would make it difficult to determine whether you were a single location that's moving a lot and using different MAC addresses, or were multiple computers each just using the AP periodically.

          Still, there's no foolproof way to avoid discovery against an omnipotent adversary.

          • Re: (Score:3, Insightful)

            by Kjella (173770)
            Omnipotence is hardly required. "Moving it around" doesn't happen on the same timescale as tracking it down, I'm sure it'd only take a few minutes with pro gear and at least two listening posts to cross-reference. Generating a new MAC from time to time then reconnecting would probably work just fine though, so that when they come for the old MAC address it's no longer broadcasting. Basicly, if it's still active when they come looking, you've pretty much already lost.
        • Your PC is talking back and forth with access point A, but your signal is reaching B and C as well, which are just acting as listening posts. Now, your packets arrive at A, B, and C, which talk to each other and figure out the time differential of your packets reaching each point. B and C know what to listen for, because A is telling them.

          Based on the time differentials, your position is narrowed down.

          your PC can only see one, but that's because the others aren't talking to you.

          No, I don't know the detail

    • Re: (Score:2, Informative)

      by kennygraham (894697)

      then all the federales will be able to see will be the MAC addresses of my network cards, and have no idea where to find said network cards on the wireless network.

      Unless you purchased your network card on a credit card at a place that scans the MAC address along with the UPC when they ring you up, like CompUSA does. (to make sure you don't return a different network card for a refund)

      • That old thing... I sold that on eBay years ago. And made a profit. (And then they set the IRS on you for not paying income tax on it).

        Also, try changing [google.com] your MAC address to something like 66-75-6B-6F-66-66.

      • You can change the MAC address on many (if not all) cards. My college has an automatic program running that blocks your MAC if you take up too much bandwidth. It didn't unban me automatically after a day like it should have so I changed my MAC address and hopped right back on the network.

        • Oh yeah, I should make it clear this is through driver software, and not just via a linux terminal.

          On Windows, right click Network [Neighborhood] and click Properties. Vista users need to click "Manage Network Connections" next. Then right click the network connection of the adapter you want to change the MAC address of, then continue past the UAC prompt if you use Vista. Click Configure to get to the network card settings. Go to the Advanced tab. If your card supports it there will be a Network Addr

    • Considering the US Navy supports Tor I don't think that is likely.
    • It's wireless, that means it's radio. You can find a radio transmitter, especially if it keeps transmitting. I expect it's doable, by the strength of the signal, possibly by the direction from which it comes (with a directional antenna), add triangulation. Surely the feds could do it if they care.

      There should be some ammendments to some crucial constitutions to guarantee that there should be no laws (and therefore state action) against anonymous and encrypted communication.

  • Constant data stream (Score:4, Interesting)

    by ishmalius (153450) on Sunday February 25 2007, @05:04PM (#18146252)
    Some military broadband links send a constant stream of encrypted data, whether real data or filler. This "hiding in plain sight" reduces the ability of someone to perform traffic analysis on the network in precisely such a manner. This would be awful on the Net, of course, if everyone did it. But people should be aware that encryption is not the only facet of communications security that they need to worry about.

  • Even if you can't become both the entry/exit... (Score:4, Interesting)

    by twistah (194990) on Sunday February 25 2007, @05:08PM (#18146286)
    Even if you aren't able to become both the entry and exit mode, using the technique of faking your bandwidth/uptime can lead to more traffic for your exit node, which means more passwords to sniff. Not everyone seems to realize that just because the Tor protocol is encrypted doesn't mean the exit node can't sniff unencrypted traffic. Granted, the exit node has no idea where the traffic came from, but often information such as login information for a personal account can give that away. That's even better than having just an IP. All it takes is to set yourself up as a Tor node (the uptime/bandwidth faking helps) and run a tool like Cain or dsniff.

  • No love for Freenet? (Score:5, Funny)

    by makomk (752139) on Sunday February 25 2007, @05:24PM (#18146410) Journal
    Hmmm... I'm sure Freenet didn't get this much attention when they discovered that their encryption code was only actually encrypting half the data (128 bits out of every 256 bit word). Must be because no-one actually uses Freenet...

      • Re: (Score:3, Informative)

        by makomk (752139)
        A casual googling didn't reveal anything, and I'm feeling really curious about how that happened.

        As the above AC said, a lot of the discussion was on Frost, which doesn't have any publicly-accessible archives. You can find the mailing list thread here [freenetproject.org], though. In particular this [freenetproject.org] and this [freenetproject.org]

        Of course, I'm not sure if this really matters that much; last I heard, Freenet was known to be vulnerable to man-in-the-middle attacks [freenetproject.org], and fixing it wasn't considered a priority...
  • Please check out http://blogs.law.harvard.edu/anonymous/2007/02/26/ the-rumors-of-our-demise/ [harvard.edu] for The Tor Project's official response to this paper.

    Shava Nerad
    executive director
    The Tor Project

    • Re: (Score:3, Insightful)

      by Nasarius (593729)
      Come on, if you're going to troll, at least put some effort into it. Nowhere in the summary is it mentioned that Tor is an acronym. It's not written as TOR. Those ignorant of the project would assume that it was just a silly name.
    • If you don't know what tor is, and can't RTFG, you don't belong on slashdot.

    • Re:WTFITOREH? (Score:4, Insightful)

      by Ephemeriis (315124) on Sunday February 25 2007, @05:21PM (#18146388) Homepage

      I hate to point this out but to anyone not in the know. the Acronym TOR means absolutely NOTHING. why post a warning about something if you do not explain the acronym. WHAT THE HELL IS WITH THE EXCESSIVE ACRONYMS? You all afraid to speak a fully qualified language or are you all afraid someone might notice you have no idea what the hell you're talking about? How about expanding on the acronyms a bit eh?
      Thanks.

      To anyone not in the know, the fact that the TOR protocol has a weakness means absolutely NOTHING regardless of whether they know what TOR stands for or not.

      Granted, there is such a thing as TLA-overload...but I don't think this is it. If you don't know that TOR stands for The Onion Router, then why the hell do you care whether it is vulnerable to attack or not? You obviously aren't using it... You don't care about the technology or implementation... You are apparently not even curious enough to Google it... So why bother clicking through to post such a rant?
      • Why not filter queries with the words 'democracy' and 'human rights' while we're at it? I'm sure that the Chinese government would agree with me.
      • Would it be possible for a tor exit node to apply automatic filters to requests and replies

        It's absolutely a technical possibility, but doing it is discouraged for a few reasons.

        First, it's likely to be extremely ineffective. What are you gonna do, keep a list of all IPs, urls, etc that host child porn? Even commercials apps that filter the internet are unable to do this effectively. This is even more so for criminal activity - how do you automatically know whether a bitstream is being used for crim

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.