Scientists Detect Two Dozen Computers Trying To Sabotage Tor Privacy Network 94
New submitter fynbar writes "Computer scientists have identified almost two dozen computers that were actively working to sabotage the Tor privacy network by carrying out attacks that can degrade encrypted connections between end users and the websites or servers they visit (PDF). 'Two of the 25 servers appeared to redirect traffic when end users attempted to visit pornography sites, leading the researchers to suspect they were carrying out censorship regimes required by the countries in which they operated. A third server suffered from what researchers said was a configuration error in the OpenDNS server. The remainder carried out so-called man-in-the-middle (MitM) attacks designed to degrade encrypted Web or SSH traffic to plaintext traffic. The servers did this by using the well-known sslstrip attack designed by researcher Moxie Marlinspike or another common MitM technique that converts unreadable HTTPS traffic into plaintext HTTP.'"
Only 24? (Score:4, Insightful)
If only 24 "bad" computers can cause that big of an issue then the TOR network clearly has bigger problems.
I'm surprised that there was so few detected doing it.
Who owns the "bad" servers ? (Score:3)
Reading TFA (yes, I did) revealed next to nothing. Other than a brief mention of "From Russia with love" and that their IPs were assigned to Russia, I can't glean any useful info on who owns those servers.
Re:Only 24? (Score:4, Informative)
The "issue" is that an exit node can monitor or intercept outgoing connections.
This is inherent to the design, and probably can't be fixed at this level.
It's also a "feature" because it provides an incentive to run an exit node.
The solution is that end users need to be extra paranoid. TOR isn't magic security dust - it anonymizes traffic, but it also increases your exposure to attacks. It should only be used for encrypted connections, with authentication of the end point.
For "casual" users that means to always use https, always verify the certificate, and disable any root certificates you don't need.
Re: (Score:1)
It depends on the use case. Somebody browsing porn on Tor (porn isn't illegal in many cases, just restricted, think academic institutions, etc) doesn't care if you can see everything they are looking at because they are still anonymous. That might be a bad example. Lets use a better one. A user posting a video of police corruption (taken from afar) doesn't care if the middle-man can see what hes doing. He only cares that the middle-man can't identify him.
What is best practice for non-tor browsing? (Score:2)
With regards to the SSL stuff? Should I disable all SSL certs in the browser and then enable only the ones that my https sites ask for? Or is it safe to leave them alone. Or will it break everything if I disable them since I won't know which to turn back on? And what about non-browser ssl traffic? Does the update service use ssl libraries too? Isnt there a separate certs list for ssl programs that are not browsers?
Re: (Score:2)
Re: (Score:2)
Well, you get the NSA endpoints whether you use TOR or not, so...
How many is "almost two dozen" exactly? (Score:5, Funny)
"... almost two dozen computers that were actively...", "Two of the 25 servers... ".
Oh, they clear that up nicely - "Almost two dozen" is actually 25. Perhaps dozen is like gallon: different sizes in different countries.
Re:How many is "almost two dozen" exactly? (Score:5, Informative)
Apparently the "almost two dozen" refers to the 22 that were doing MiTM attacks.
Re: (Score:1)
Pft...decimals...why to you hate accuracy...
Better solution is to start adding denominator to the ehm denomination.
Re: (Score:1)
Well, it always is a good idea to read the complete text. Here's a bigger quote with all the relevant parts:
"[...] almost two dozen computers that were actively [...] by carrying out attacks that can degrade encrypted connections [...]",
"Two of the 25 servers [did something different]. A third server [was apparently misconfigured]. The remainder carried out so-called man-in-the-middle (MitM) attacks designed to degrade encrypted Web or SSH traffic to plaintext traffic."
So it was 22 servers which were "carry
Re: (Score:1)
Yeah...well...maybe /. sucks at LaTeX..
Ever think of that?
Re: (Score:1)
Re: (Score:2)
Since the results clearly show that Tor is a half-baked solution the story authors felt it appropriate to use 13 as the reference value for a dozen.
Re: (Score:2, Informative)
yes, EFF's HTTPS Everywhere
Re:HTTP/HTTPS Issues? (Score:5, Informative)
HTTPS Everywhere doesn't stop you browsing HTTP sites it just tries to redirect you to the HTTPS version of a HTTP site if it's available. Not saying it's not useful (just not quite what the OP was suggesting). There is a spin off of HTTPS Everywhere - HTTP Nowhere that might get the job done for Firefox. Not sure what happens with embedded crap like flash etc. though and AFAIK it's a global thing - there is no 'secure only' browsing window or anything like that.
https://addons.mozilla.org/En-us/firefox/addon/http-nowhere/
Another option might be squid (or another transparent proxy) which is configured to only allow HTTPS?
Re: (Score:2)
Except said bad exit node already compromises HTTPS by doing a MITM attack. because it literally IS a MITM. Just like an exit node can compromise SSH as well.
Basically the exit nodes see that you're trying to establish an HTTPS connection and return you a self-signed cert to encrypt data with that they decrypt, and the re-encrypt with the real key to the site.
Your browser will detect the fault since the certificate doesn't have a path to a known root CA. The question is, will the
Re:HTTP/HTTPS Issues? (Score:5, Informative)
Not sure if joking...
http://noscript.net/features#o... [noscript.net]
https://www.eff.org/https-ever... [eff.org]
A lot of the sslstrip stuff is based off of people not noticing the page has changed to insecure, modern browsers try to address that by making it more visible than it was in the pre-FF3 era, e.g.:
https://support.mozilla.org/en... [mozilla.org]
Re: (Score:1)
Neither of these options will stop your browser from making a http connection!
HTTPS Everywhere does not force HTTPS, it tries to use it where it's available through URL rewriting rules.
The NoScript option prevents scripts from running on insecured sites, it does not stop your browser from loading the page in the first place.
Consider using a proxy that specifically blocks HTTP traffic or maybe a plugin like HTTP Nowhere mentioned in the post above.
Re: (Score:2)
I guess another option would be to use FoxyProxy and configure a nonexistent proxy "running" on 127.0.0.1 for all http traffic. If you already use FoxyProxy for other purposes, it means you don't even need to install additional software/extensions.
Re:HTTP/HTTPS Issues? (Score:5, Informative)
Sorry, but modern browsers don't really address that. The problem with the browser warnings is their definition of insecure. You only get warnings if there is something wrong with an encrypted https site like an invalid certificate. Using an unencrypted site is NOT seen as insecure as it would annoy users during most of their normal browsing sessions. The Blackhat presentation about sslstrip from Moxie explains very clearly what the problems are. You can view it at http://www.thoughtcrime.org/so... [thoughtcrime.org]
Re: (Score:2)
Sorry, but modern browsers don't really address that. The problem with the browser warnings is their definition of insecure. You only get warnings if there is something wrong with an encrypted https site like an invalid certificate. Using an unencrypted site is NOT seen as insecure as it would annoy users during most of their normal browsing sessions.
Indeed, it drives me nuts that a self-signed SSL cert makes users jump through about 47 hoops to bypass, but right now I'm posting this form on Slashdot without any authentication or encryption at all and the browser is just fine with that. I have no idea if this session is being intercepted or tampered with.
Re:HTTP/HTTPS Issues? (Score:4, Informative)
>Sorry, but modern browsers don't really address that.
Yes, they do, but so few servers use it yet that it's still a problem.
http://en.wikipedia.org/wiki/H... [wikipedia.org]
Re: (Score:1)
Just set non-existant proxies, e.g 127.0.0.1:12345, for all non-HTTPS protocols.
Re:scientists? (Score:5, Insightful)
Every time you see a headline in the form of "Scientists discover new foo" you can pretty much stop reading right there. The author is most likely the sort of person that confuses science with wizardry and isn't very likely to produce an article of any real substance. You could actually just replace every instance of scientist with wizard and impart the same level of information.
Re:scientists? (Score:4, Funny)
Any sufficiently analysed magic is indistinguishable from technology.
PR exercise ? (Score:1)
Repeated attempts to destroy Tor's image to deter troublesome future widepread-adoption of this privacy tool?
just a thousand exit nodes (Score:4, Interesting)
The mention in the article that there are only 1000 exit nodes generally available on TOR is kinda stunning.
That's 20 nodes per US state.
If that is it.... Then what is left of Freedom is in deep trouble.
Re: (Score:3)
That was my first thought to. On further reflection it's not actually that bad.
Most tor traffic doesn't exit to the internet (it's being routed to .onion sites), and 1,000 - 25 nasty, unfiltered, uncensored exits is actually quite good e.g. there's only a few cables leaveing the UK, not sure exactly how many, but I'd guess it's a few hundred at most. However the number of "unfiltered, uncensored" exits leaving the UK is precisely zero.
Re:just a thousand exit nodes (Score:4, Insightful)
Even if you get a great TOR connection, sent that message around the world, your message in and out can always be re joined no matter the entry or exit point.
The low count of all exit nodes per month as an average is telling, chilling and unexpected.
Re: (Score:2)
how does it have any impact on the 99% of tor traffic which never touches an exit node?
Re: (Score:2)
My arse of course, where else can you get figures like that from? But it was a rough guess based on most tor usage being to access hidden services (such as bitorrent clients) rather than using tor as a simple proxy to access the internet.
But guard/entry/exit node layout and number tells you nothing about the traffic flowing through the network, or the source/desitnation of that traffic - that's the whole point of tor.
Re: (Score:2)
and from that link
Traffic history 3Gbps
exit traffic 100Mbps
Re: (Score:2)
Yes I'm sure.
Reading the data out of an exit node tells you nothing about the requester of that data, and nothing about traffic destined for hidden services.
And given they are sat watching the data coming out of every non tor service anyway, you can assume every tor exit node is already being passively monitered by the NSA...
Oh wait, no you can't, because only a tiny fraction all of those exit nodes are actually in the US.
Re: (Score:1)
That's 20 nodes per US state.
Or 53 nodes per Finnish Region.
Re: (Score:2)
Re: (Score:2)
Re:Slashdot does this... (Score:5, Insightful)
Slashdot does this automatically
$ echo QUIT | openssl s_client -connect slashdot.org:443 | openssl x509 -text
Yeah, that's just sad. You'd think a popular technology news website such as Slashdot, of all places, would be on the ball and at least support TLS traffic... but it's actually worse than that. They're not lazy (they have a GeoTrust wildcard certificate issued back in April last year) but deliberately don't want people securing their connections, hence the 302 redirection the have in place. :(
That's because they're busy with "beta" (Score:1)
beta.slashdot.org, to improve our web experience and push interactive, rich client technology to the 21st century!
Wanking on useless bling instead of doing the important. Sigh.
Re: (Score:1)
X509v3 Authority Key Identifier:
keyid:42:79:54:1B:61:CD:55:2B:3E:63:D5:3C:48:57:F5:9F:FB:45:CE:4A
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Subject Alternative Name:
DNS:*.slashdot.org, DNS:slashdot.org
Re: (Score:2)
How does any of that help the fact HTTPS://slashdot.org/ returns a 302 redirection back to HTTP://slashdot.org/ ???
Setting up a special "secure" website with SSL certificate is pretty useless if you only redirect to a single non-encrypted URL.
Unless of course you are claiming HTTP(no S) is encrypted with magic or something, which seems to be what you are implying by pointing out the TLS server/client auth lines in that certificate that won't even apply.....
Re: (Score:2)
Bah, it's double-ROT13, that should be secure enough for anybody, right?
Re: (Score:2)
Subscribers get HTTPS.
Proof of Concept.... (Score:2)
.... if we make it, we can break it.
Re: Ah c'mon (Score:2, Interesting)
I've seen lots of people using Tor - I run a relay - but I have no idea what they're using it for, or how legal that use is in my or their jurisdiction. Which is kind of the point.
Re: (Score:3)
Have anybody ever in here seen anyone using Tor for legal purposes?
Yes, all the time.
People even visit Slashdot using Tor.
Some folks use it all the time -- so all their ordinary daily browsing activity might go through tor.
SSL Warning (Score:2)
Even if this were to occur and you are on a bad exit node, wouldn't you still get a warning from the browser about the certificate being bad?
Re: (Score:1)
sslstrip doesn't replace the certificate, it takes HTTPS traffic and turns it into HTTP at your end. It requires that you go to a HTTP page first, at which point it rewrites any HTTPS links or redirects to the corresponding HTTP ones. If you block your browser from using HTTP at all the attack doesn't work, but nobody does that.
Ummmm ... duh? (Score:2)
Isn't it kind of obvious that Tor would be a target to be attacked?
Between government agencies and other shady characters, I should think that as soon as you announce you've got something which provides anonymity, someone would be trying to break it.
Sure, they've identified some specific things, but did anybody actually believe Tor and things like it wouldn't be targets?
Writing is on the wall: (Score:2)
People have to stop hanging their hopes for privacy on HTTPS/PKI and also a network (Tor) built on the premise of accessing an insecure web.
If there is going to be any real privacy on the Internet going forward, it will have to be based on a new layer like the Invisible Internet Project (I2P). [geti2p.net] People should start using it now in a P2P fashion -- securing emails, chats, torrents and such -- and in time there is a chance the momentum will attract larger and larger web services, too. Make a habbit of telling p