Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Privacy IT

Tor Open To Attack 109

Posted by kdawson from the peeling-the-onion dept.
An anonymous reader writes "A group of researchers have written a paper that lays out an attack against Tor (PDF) in enough detail to cause Roger Dingledine a fair amount of heartburn. The essential avenue of attack is that Tor doesn't verify claims of uptime or bandwidth, allowing an attacker to advertise more than it need deliver, and thus draw traffic. If the attacker controls the entry and exit node and has decent clocks, then the attacker can link these together and trace someone through the network."
This discussion has been archived. No new comments can be posted.

Tor Open To Attack More

Tor Open To Attack

Comments Filter:

  • Well, not just that. (Score:5, Interesting)

    by James_Duncan8181 ( 588316 ) on Sunday February 25, 2007 @04:02PM (#18145700) Homepage
    If the attacker advertises absolutely massive values (and hey, it's only a string) they can time out all of the packets and DoS the network too.

    This actually makes me wonder if there is a military/intel datacentre that does this already.

    • Re: (Score:3, Informative)

      by TubeSteak ( 669689 )

      If the attacker advertises absolutely massive values (and hey, it's only a string) they can time out all of the packets and DoS the network too.
      Wouldn't that only last as long as [max client timeout]?
      At which point the client seeks another route. Right?

      What I'm saying is that I don't think this would be effective with only one or two nodes.
      Though on a larger scale, I agree that this tactic could effectively DOS the network.
      • At which point the client would time out, and pick a new route at random, which could very well be through the node doing the DoSing, if the idea is implemented correctly.

    • COMSEC, not SIGINT (Score:5, Interesting)

      by dr.badass ( 25287 ) on Sunday February 25, 2007 @04:50PM (#18146138) Homepage
      This actually makes me wonder if there is a military/intel datacentre that does this already.

      Probably, but not for the reasons you think. Tor is known to be used by the military (how much is anybody's guess) for the same reasons anybody else would use it.
    • no need: see numerous guides on how-to use bitorrent through TOR that turn it into the internet superhighway equivalent of a milkfloat
      • Considering how large a strain TOR puts on the system vs. straight P2P, I'd only use it for very high risk stuff. In the current climate, your average illegal downloads/uploads just don't cut it ( 1 in 10M chance of getting caught, and the punishment is nowhere near what you get for things like political dissent in some places). Perhaps if the risk goes up it will be a worthwhile tradeoff though.

  • "I felt a great disturbance in the Internet, as if millions of child-pornographers suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened."

    Now now, I know Tor isn't just used for naughty stuff. I just thought it was funny. Sorta.

    • Re:Not quite so oblig SW reference.. (Score:4, Informative)

      by Ice Wewe ( 936718 ) on Sunday February 25, 2007 @04:19PM (#18145838)
      Seriously, this is why Tor tells you at the start that you shouldn't rely on it for strong anonymity.

      "Feb 25 16:16:02.628 [notice] Tor v0.1.1.xx. This is experimental software. Do not rely on it for strong anonymity."

      Thus proving, once again, that Tor is only for the Quasi-anonymous group.

      • Tor tells you at the start that you shouldn't rely on it for strong anonymity.

        Tor also tells you to not use it for BitTorrent, but clueless Diggers continue to do so.

    • So, ze kiddie porn is on vor mind, eh Social Engineer? Very interesting. Who besides grandstanding politicians, media whores and actual pedophiles actually thinks or talks about kiddie porn? You must be one of the bag guys. The FBI vill be watching everything you do for the next ten years.

      • Re: (Score:1)

        by Faylone ( 880739 )
        Can posting on slashdot count as being media whore? Damn I hope not.
    • Don't forget the Chinese Dissidents.

  • In Soviet Russia... (Score:2, Funny)

    by Anonymous Coward
    In Soviet Russia, Tor attacks YOU!

  • How Many Nodes Do You Need to Own? (Score:5, Insightful)

    by quanticle ( 843097 ) on Sunday February 25, 2007 @04:15PM (#18145808) Homepage
    "We show that even if an adversary can control a few malicious nodes -- 3 to 6 with a PlanetLab network of 60 honest servers -- the adversary can still compromise the identity of a significant fraction of the connections from new clients."

    3 to 6 servers out of 60 is still 5 to 10 percent. That's fine for small networks, but for a network with hundreds or thousands of nodes, controlling 5 to 10 percent may become infeasible. Does this attack require the number of nodes to scale with network size?
    • That's fine for small networks, but for a network with hundreds or thousands of nodes, controlling 5 to 10 percent may become infeasible.

      No amount of surveillance is infeasible for a determined government.

    • Re:How Many Nodes Do You Need to Own? (Score:4, Interesting)

      by TheRaven64 ( 641858 ) on Sunday February 25, 2007 @04:33PM (#18145960) Journal
      It doesn't tell you anything meaningful unless it tells you what the requirements on the distribution of the nodes is. You could, hypothetically, run a few thousand tor nodes on a single machine. Would this allow you to compromise a network of a few tens of thousands of nodes?

      • Re: (Score:2)

        by Splab ( 574204 )
        Except you need to convince the nodes to use the same IP for all hops. A TOR client should spread it's hops through out the available / advertised nodes. Also this attack isn't exactly new, timing weakness have been known for as long as the network has been around I should think (it's in the white paper). Granted their approach is somewhat new, but TOR has never claimed to provide strong anonymity, you need something like Herbivore for that.

        • Re: (Score:2, Interesting)

          by mrogers ( 85392 )

          TOR has never claimed to provide strong anonymity, you need something like Herbivore for that.

          Herbivore isn't vulnerable to traffic analysis but it's vulnerable to DoS: the attacker's nodes follow the secure entry protocol and get assigned to random cliques. Then they transmit in every round, jamming communication within their cliques. Jamming doesn't require any more bandwidth than normal participation in the protocol, and the source of the jamming can't be detected because communication within a clique

    • Re: (Score:2, Informative)

      by mrogers ( 85392 )

      That's fine for small networks, but for a network with hundreds or thousands of nodes, controlling 5 to 10 percent may become infeasible.

      Tor scales to a few hundred nodes [noreply.org], but it doesn't scale indefinitely - all the routers are listed in a central directory [seul.org] to ensure that all clients use the same set of routers and the same set of public keys.

      • "Tor scales to a few hundred nodes, but it doesn't scale indefinitely"

        Okay. I understand now. Because Tor can only scale up to a few hundred nodes, you only need ten or twenty compromised nodes to effectively monitor the entire network.

  • Anonymity Vs Performance in Multi-Hop Networks... (Score:5, Interesting)

    by Roger Wilcox ( 776904 ) on Sunday February 25, 2007 @04:22PM (#18145866)
    ...is really what the article is about. Granted, I only read the abstract, but someone here at /. seems too intent on making a dramatic headline out of this.

    It has been known for some time that anyone with the resources to do so could launch an end-to-end attack on Tor. That someone with relatively few resources could launch the same attack is newsworthy, perhaps, but far more interesting is the observation that optimizing network traffic flow in order to improve performance is the direct cause of this weakness.

  • Could this be avoided? (Score:4, Informative)

    by DogDude ( 805747 ) on Sunday February 25, 2007 @04:26PM (#18145914)
    From what I can tell, it sounds like an attack can be either minimized or avoided completely if there are enough "server" nodes in the network. The "server" nodes, or the nodes that are exposed to the potential naughtiness, are always in short supply due to people understandably not wanting the FBI to show up to their door, hauling them off to Guantanamo Bay for a round of government-sanctioned torture. The thing is, for the time being, we're seeing a proliferation of completely open (untraceable) wireless networks that could potentially solve this problem. If a relatively large number of geeks were to throw a machine at their local free wireless connections, then they could potentially help out the TOR network for people who don't have access to such an "open" network. Now, we will eventually see these wide open free-for-alls shut down once the feds get their heads out of their asses and start taking Net-based crime seriously. But for the time being, we should all pitch in and take advantage of these networks while we've got 'em. I'm working on putting together a few Frankenstein PC's now and they'll be sitting within range of my town's wireless network, and they'll be routing TOR traffic. If somebody does some truly nasty stuff, and it comes out via one of my TOR nodes, then all the federales will be able to see will be the MAC addresses of my network cards, and have no idea where to find said network cards on the wireless network.
    • Triangulation.

      • Re: (Score:1)

        by DogDude ( 805747 )
        Can you use triangulation if your PC can see only one node on the wireless network? I would think that all the feds would know is that the traffic is coming from MAC address xxx, and it's somewhere in the radius of NAP x. In a city, that could be any one of hundreds or thousands of private homes and businesses, not to mention cars just moving through the area...

        • Re:Could this be avoided? (Score:4, Interesting)

          by Kadin2048 ( 468275 ) <slashdot@kadin.xoxy@net> on Sunday February 25, 2007 @04:44PM (#18146072) Homepage Journal
          Well, if they knew the access point you were using (based on the IP address, which they'd then take to the ISP and demand to know the customer address), they'd just go down there and sniff packets for your MAC address. It's fairly trivial at that point to determine the direction that the radio signals are coming from. (There are guys that do it as a hobby [aol.com].)

          Probably your best bet would be to use a spoofed MAC address, and change both the AP you connect to, the MAC address you report, and the PC's physical location, on a regular and frequent basis. That would make it difficult to determine whether you were a single location that's moving a lot and using different MAC addresses, or were multiple computers each just using the AP periodically.

          Still, there's no foolproof way to avoid discovery against an omnipotent adversary.

          • Re: (Score:1)

            by DogDude ( 805747 )
            Still, there's no foolproof way to avoid discovery against an omnipotent adversary.

            Thanks for ruining my day.

            Obviously, I'm not doing anything illegal (otherwise, I'd be posting as an AC), but there's a lot to be said for people being able to be truly anonymous in a public space (such as no fear of retaliation by a potentially hostile/oppressive government).

            Oh well. I guess that if somebody has to do something online and be truly anonymous, they can still drive to one of these open networks that

          • Re: (Score:3, Insightful)

            by Kjella ( 173770 )
            Omnipotence is hardly required. "Moving it around" doesn't happen on the same timescale as tracking it down, I'm sure it'd only take a few minutes with pro gear and at least two listening posts to cross-reference. Generating a new MAC from time to time then reconnecting would probably work just fine though, so that when they come for the old MAC address it's no longer broadcasting. Basicly, if it's still active when they come looking, you've pretty much already lost.
        • Your PC is talking back and forth with access point A, but your signal is reaching B and C as well, which are just acting as listening posts. Now, your packets arrive at A, B, and C, which talk to each other and figure out the time differential of your packets reaching each point. B and C know what to listen for, because A is telling them.

          Based on the time differentials, your position is narrowed down.

          your PC can only see one, but that's because the others aren't talking to you.

          No, I don't know the detail

    • Re: (Score:2, Informative)

      by kennygraham ( 894697 )

      then all the federales will be able to see will be the MAC addresses of my network cards, and have no idea where to find said network cards on the wireless network.

      Unless you purchased your network card on a credit card at a place that scans the MAC address along with the UPC when they ring you up, like CompUSA does. (to make sure you don't return a different network card for a refund)

      • Re: (Score:2)

        by gsn ( 989808 )
        That old thing... I sold that on eBay years ago. And made a profit. (And then they set the IRS on you for not paying income tax on it).

        Also, try changing [google.com] your MAC address to something like 66-75-6B-6F-66-66.

      • You can change the MAC address on many (if not all) cards. My college has an automatic program running that blocks your MAC if you take up too much bandwidth. It didn't unban me automatically after a day like it should have so I changed my MAC address and hopped right back on the network.

        • Oh yeah, I should make it clear this is through driver software, and not just via a linux terminal.

          On Windows, right click Network [Neighborhood] and click Properties. Vista users need to click "Manage Network Connections" next. Then right click the network connection of the adapter you want to change the MAC address of, then continue past the UAC prompt if you use Vista. Click Configure to get to the network card settings. Go to the Advanced tab. If your card supports it there will be a Network Addr

          • But by the time you've booted and made that change, you've already sent out oodles of packets during the boot process. Might want to make those edits in a Faraday cage or something. Better yet, buy a used wireless NIC for cash and use that.

          • Re: (Score:1, Interesting)

            by Anonymous Coward

            Mine is 000C7609A2A9. You can't just put any number (I'm not sure of the rules, maybe the first four digits have to be 000C or something) but simply adding or subtracting a small value to that works.

            The first 6 digits are the manufacturer. (minus a bit or two) Your NIC was made by MSI.
    • Considering the US Navy supports Tor I don't think that is likely.
    • It's wireless, that means it's radio. You can find a radio transmitter, especially if it keeps transmitting. I expect it's doable, by the strength of the signal, possibly by the direction from which it comes (with a directional antenna), add triangulation. Surely the feds could do it if they care.

      There should be some ammendments to some crucial constitutions to guarantee that there should be no laws (and therefore state action) against anonymous and encrypted communication.

  • I'll bite (Score:1)

    by Anonymous Coward
    Who's Roger Dingledine?

  • Constant data stream (Score:4, Interesting)

    by ishmalius ( 153450 ) on Sunday February 25, 2007 @05:04PM (#18146252)
    Some military broadband links send a constant stream of encrypted data, whether real data or filler. This "hiding in plain sight" reduces the ability of someone to perform traffic analysis on the network in precisely such a manner. This would be awful on the Net, of course, if everyone did it. But people should be aware that encryption is not the only facet of communications security that they need to worry about.

  • Even if you can't become both the entry/exit... (Score:4, Interesting)

    by twistah ( 194990 ) on Sunday February 25, 2007 @05:08PM (#18146286)
    Even if you aren't able to become both the entry and exit mode, using the technique of faking your bandwidth/uptime can lead to more traffic for your exit node, which means more passwords to sniff. Not everyone seems to realize that just because the Tor protocol is encrypted doesn't mean the exit node can't sniff unencrypted traffic. Granted, the exit node has no idea where the traffic came from, but often information such as login information for a personal account can give that away. That's even better than having just an IP. All it takes is to set yourself up as a Tor node (the uptime/bandwidth faking helps) and run a tool like Cain or dsniff.

  • No love for Freenet? (Score:5, Funny)

    by makomk ( 752139 ) on Sunday February 25, 2007 @05:24PM (#18146410) Journal
    Hmmm... I'm sure Freenet didn't get this much attention when they discovered that their encryption code was only actually encrypting half the data (128 bits out of every 256 bit word). Must be because no-one actually uses Freenet...
    • That's interesting, do you have a link with details on that?

      A casual googling didn't reveal anything, and I'm feeling really curious about how that happened.

      • Re: (Score:3, Informative)

        by makomk ( 752139 )
        A casual googling didn't reveal anything, and I'm feeling really curious about how that happened.

        As the above AC said, a lot of the discussion was on Frost, which doesn't have any publicly-accessible archives. You can find the mailing list thread here [freenetproject.org], though. In particular this [freenetproject.org] and this [freenetproject.org]

        Of course, I'm not sure if this really matters that much; last I heard, Freenet was known to be vulnerable to man-in-the-middle attacks [freenetproject.org], and fixing it wasn't considered a priority...
  • I learned about these attacks on Tor in my computer security class last semester. And we're making a big deal now? Maybe my comp sci professor should get some sort of award for discovering it first.
  • There is already a lot of existing research in the area. I recently attended a security seminar by CERIAS at Purdue University. They have a video [purdue.edu] discussing this same topic. There is already research going into how to thwart these attacks. From the abstract:

    n this work, we identify, demonstrate and mitigate insider attacks against measurement-based adaptation mechanisms in unstructured multicast overlay networks. The attacks target the overlay network construction, maintenance, and availability and allo

  • I have just configured my Tor and know you guys says doesn't work? Does I take that long setting up everything? damn... :/
  • Now people want to take a way to get around filters and FILTER it...

  • Official Tor response (Score:2, Informative)

    by shava ( 56341 )
    Please check out http://blogs.law.harvard.edu/anonymous/2007/02/26/ the-rumors-of-our-demise/ [harvard.edu] for The Tor Project's official response to this paper.

    Shava Nerad
    executive director
    The Tor Project

Slashdot Top Deals

Don't get suckered in by the comments -- they can be terribly misleading. Debug only code. -- Dave Storer

Close