Tor Open To Attack

An anonymous reader writes "A group of researchers have written a paper that lays out an attack against Tor (PDF) in enough detail to cause Roger Dingledine a fair amount of heartburn. The essential avenue of attack is that Tor doesn't verify claims of uptime or bandwidth, allowing an attacker to advertise more than it need deliver, and thus draw traffic. If the attacker controls the entry and exit node and has decent clocks, then the attacker can link these together and trace someone through the network."

Well, not just that.

If the attacker advertises absolutely massive values (and hey, it's only a string) they can time out all of the packets and DoS the network too.

This actually makes me wonder if there is a military/intel datacentre that does this already.

COMSEC, not SIGINT

This actually makes me wonder if there is a military/intel datacentre that does this already.

Probably, but not for the reasons you think. Tor is known to be used by the military (how much is anybody's guess) for the same reasons anybody else would use it.

Re:COMSEC, not SIGINT

Tor is known to be used by the military ... for the same reasons anybody else would use it.

Downloading pr0n?

Re:Well, not just that.

The military and secretive NSA operations do not care about you or your open source proxy software. Stop trying to make yourself feel special by writing convoluted conspiracy theories.

No, but the Chinese equivalent of the FBI probably cares a lot about what its citizens are doing on the net, and the ability of users living under hostile regimes to get unfettered network access is one of the goals of projects like Tor.

There are people with resources besides the NSA.

Re:Well, not just that.

The military and secretive NSA operations do not care about you or your open source proxy software. Stop trying to make yourself feel special by writing convoluted conspiracy theories.

If [dailykos.com] only [commondreams.org] that was true [sldn.org]...

Not quite so oblig SW reference..

"I felt a great disturbance in the Internet, as if millions of child-pornographers suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened."

Now now, I know Tor isn't just used for naughty stuff. I just thought it was funny. Sorta.

Re:Not quite so oblig SW reference..

Seriously, this is why Tor tells you at the start that you shouldn't rely on it for strong anonymity.

"Feb 25 16:16:02.628 [notice] Tor v0.1.1.xx. This is experimental software. Do not rely on it for strong anonymity."

Thus proving, once again, that Tor is only for the Quasi-anonymous group.

In Soviet Russia...

In Soviet Russia, Tor attacks YOU!

How Many Nodes Do You Need to Own?

"We show that even if an adversary can control a few malicious nodes -- 3 to 6 with a PlanetLab network of 60 honest servers -- the adversary can still compromise the identity of a significant fraction of the connections from new clients."

3 to 6 servers out of 60 is still 5 to 10 percent. That's fine for small networks, but for a network with hundreds or thousands of nodes, controlling 5 to 10 percent may become infeasible. Does this attack require the number of nodes to scale with network size?

Re:How Many Nodes Do You Need to Own?

It doesn't tell you anything meaningful unless it tells you what the requirements on the distribution of the nodes is. You could, hypothetically, run a few thousand tor nodes on a single machine. Would this allow you to compromise a network of a few tens of thousands of nodes?

Anonymity Vs Performance in Multi-Hop Networks...

...is really what the article is about. Granted, I only read the abstract, but someone here at /. seems too intent on making a dramatic headline out of this.

It has been known for some time that anyone with the resources to do so could launch an end-to-end attack on Tor. That someone with relatively few resources could launch the same attack is newsworthy, perhaps, but far more interesting is the observation that optimizing network traffic flow in order to improve performance is the direct cause of this weakness.

Could this be avoided?

From what I can tell, it sounds like an attack can be either minimized or avoided completely if there are enough "server" nodes in the network. The "server" nodes, or the nodes that are exposed to the potential naughtiness, are always in short supply due to people understandably not wanting the FBI to show up to their door, hauling them off to Guantanamo Bay for a round of government-sanctioned torture. The thing is, for the time being, we're seeing a proliferation of completely open (untraceable) wireless networks that could potentially solve this problem. If a relatively large number of geeks were to throw a machine at their local free wireless connections, then they could potentially help out the TOR network for people who don't have access to such an "open" network. Now, we will eventually see these wide open free-for-alls shut down once the feds get their heads out of their asses and start taking Net-based crime seriously. But for the time being, we should all pitch in and take advantage of these networks while we've got 'em. I'm working on putting together a few Frankenstein PC's now and they'll be sitting within range of my town's wireless network, and they'll be routing TOR traffic. If somebody does some truly nasty stuff, and it comes out via one of my TOR nodes, then all the federales will be able to see will be the MAC addresses of my network cards, and have no idea where to find said network cards on the wireless network.

Re:Could this be avoided?

Well, if they knew the access point you were using (based on the IP address, which they'd then take to the ISP and demand to know the customer address), they'd just go down there and sniff packets for your MAC address. It's fairly trivial at that point to determine the direction that the radio signals are coming from. (There are guys that do it as a hobby [aol.com].)

Probably your best bet would be to use a spoofed MAC address, and change both the AP you connect to, the MAC address you report, and the PC's physical location, on a regular and frequent basis. That would make it difficult to determine whether you were a single location that's moving a lot and using different MAC addresses, or were multiple computers each just using the AP periodically.

Still, there's no foolproof way to avoid discovery against an omnipotent adversary.

I'll bite

Who's Roger Dingledine?

Constant data stream

Some military broadband links send a constant stream of encrypted data, whether real data or filler. This "hiding in plain sight" reduces the ability of someone to perform traffic analysis on the network in precisely such a manner. This would be awful on the Net, of course, if everyone did it. But people should be aware that encryption is not the only facet of communications security that they need to worry about.

Even if you can't become both the entry/exit...

Even if you aren't able to become both the entry and exit mode, using the technique of faking your bandwidth/uptime can lead to more traffic for your exit node, which means more passwords to sniff. Not everyone seems to realize that just because the Tor protocol is encrypted doesn't mean the exit node can't sniff unencrypted traffic. Granted, the exit node has no idea where the traffic came from, but often information such as login information for a personal account can give that away. That's even better than having just an IP. All it takes is to set yourself up as a Tor node (the uptime/bandwidth faking helps) and run a tool like Cain or dsniff.

No love for Freenet?

Hmmm... I'm sure Freenet didn't get this much attention when they discovered that their encryption code was only actually encrypting half the data (128 bits out of every 256 bit word). Must be because no-one actually uses Freenet...

Pffft

I learned about these attacks on Tor in my computer security class last semester. And we're making a big deal now? Maybe my comp sci professor should get some sort of award for discovering it first.

Existing Research

There is already a lot of existing research in the area. I recently attended a security seminar by CERIAS at Purdue University. They have a video [purdue.edu] discussing this same topic. There is already research going into how to thwart these attacks. From the abstract:

n this work, we identify, demonstrate and mitigate insider attacks against measurement-based adaptation mechanisms in unstructured multicast overlay networks. The attacks target the overlay network construction, maintenance, and availability and allow malicious nodes to control significant traffic in the network, facilitating selective forwarding, traffic analysis, and overlay partitioning. We propose techniques to decrease the number of incorrect or unnecessary adaptations by using outlier detection.

About the speaker:

David Zage is a third year PhD student in the Computer Science Department at Purdue University under the supervision of Professor Cristina Nita-Rotaru.

Ok so...

I have just configured my Tor and know you guys says doesn't work? Does I take that long setting up everything? damn... :/

wonderful

Now people want to take a way to get around filters and FILTER it...

Official Tor response

Please check out http://blogs.law.harvard.edu/anonymous/2007/02/26/ the-rumors-of-our-demise/ [harvard.edu] for The Tor Project's official response to this paper.

Shava Nerad
executive director
The Tor Project

Re:fp troll

It's not really a troll, a troll is designed to draw a hostile reaction.

Re:I for one..

I for one cry for our new onion-sniffing overlords.

Re:WTFITOREH?

There are possibly more productive solutions [justfuckinggoogleit.com] to your problem than anonymous ranting on slashdot.

Re:WTFITOREH?

Come on, if you're going to troll, at least put some effort into it. Nowhere in the summary is it mentioned that Tor is an acronym. It's not written as TOR. Those ignorant of the project would assume that it was just a silly name.

Re:WTFITOREH?

If you don't know what tor is, and can't RTFG, you don't belong on slashdot.

Re:WTFITOREH?

I hate to point this out but to anyone not in the know. the Acronym TOR means absolutely NOTHING. why post a warning about something if you do not explain the acronym. WHAT THE HELL IS WITH THE EXCESSIVE ACRONYMS? You all afraid to speak a fully qualified language or are you all afraid someone might notice you have no idea what the hell you're talking about? How about expanding on the acronyms a bit eh?
Thanks.

To anyone not in the know, the fact that the TOR protocol has a weakness means absolutely NOTHING regardless of whether they know what TOR stands for or not.

Granted, there is such a thing as TLA-overload...but I don't think this is it. If you don't know that TOR stands for The Onion Router, then why the hell do you care whether it is vulnerable to attack or not? You obviously aren't using it... You don't care about the technology or implementation... You are apparently not even curious enough to Google it... So why bother clicking through to post such a rant?

Filtering?

Would it be possible for a tor exit node to apply automatic filters to requests and replies so that the usefulness for illegal porn and criminal activity is reduced ?