Tor 0day: Stopping Tor Connections
hackerfactor.com
Tor 0day: Stopping Tor Connections
1–10 of 92 posts
Re: Tor 0day: Stopping Tor Connections
#2Browsing over Tor, I cannot read the article. Instead the entire page source is:
Banned
Re: Tor 0day: Stopping Tor Connections
#3Browsing over Tor, I cannot read the article. Instead the entire page source is: Banned ...
I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet.
0Day #1: Blocking Tor Connections the Smart Way
There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well for high-volume networks. Second, the list of nodes changes often. This creates a race condition, where there may be a new Tor node that is seen by Tor users but isn't in your block list yet.
However, what if there was a distinct packet signature provided by every Tor node that can be used to detect a Tor network connection? Then you could set the filter to look for the signature and stop all Tor connections. As it turns out, this packet signature is not theoretical.Re: Tor 0day: Stopping Tor Connections
#4Could someone in the know inform me as to whether or not my knee jerk reaction of "couldn't this individual possibly contribute to the Tor project instead?" is warranted?
Re: Tor 0day: Stopping Tor Connections
#5Browsing over Tor, I cannot read the article. Instead the entire page source is: Banned ...
I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet. 0Day #1: Blocking Tor Connections the Smart Way There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well…
The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy:
#!/bin/bash
addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d')
if [ -n "$addresses" ]; then
/sbin/ipset flush tor
echo "$addresses" | while read address; do
/sbin/ipset -q -A tor "$address"
done
fi
Re: Tor 0day: Stopping Tor Connections
#6Could someone in the know inform me as to whether or not my knee jerk reaction of "couldn't this individual possibly contribute to the Tor project instead?" is warranted?
They are contributing to the Tor project by sending detailed vulnerability reports. As for demanding that they fix/upstream changes themselves, then yes, that's likely too big of an ask, as even these reports are a gift. Tor has paid employees. "PRs welcome, wontfix" is not acceptable for security vulnerabilities in a security product.
Re: Tor 0day: Stopping Tor Connections
#7As a person who has, over the years, been recommending Tor and defending it against people claiming it's backdoored and useless, I'm disappointed. Can anybody here on HN give information on how some Tor alternatives and projects with similar goals are holding up?
Re: Tor 0day: Stopping Tor Connections
#8> The bug is simple enough: using JavaScript, you can identify the scrollbar width.
I thought it was accepted and strongly emphasized that running JavaScript in a Tor environment was insecure and could leak information in all sorts of ways, which is why Tor Browser came with NoScript enabled by default.
Is that no longer the case? Is there now an expectation that you should be able to safely run JS in Tor Browser without risk?
Re: Tor 0day: Stopping Tor Connections
#9Earlier quoted context omitted.
I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet. 0Day #1: Blocking Tor Connections the Smart Way There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well…
The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy: #!/bin/bash addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d') if [ -n "$addresses" ]; then /sbin/ipset flush tor echo "$addresses" | while read address; do /sbin/ipset -q -A tor "$address" done fi Add that to a cron job and your form abuse traffic falls…
The article also mentions banning ip ranges and it's disadvantages. The described detection of Tor traffic seems to be more bullet proof and performant.
Hopefully the Tor devs consider the proposed enhancements to make the traffic less vulnerable to identification. As he already digged into the source code, maybe it's easier when he submits a PR for a higher chance to fix the issue.
Re: Tor 0day: Stopping Tor Connections
#10Earlier quoted context omitted.
I believe they are demonstrating one of their 0days. Easily identifying tor traffic based on the packet. 0Day #1: Blocking Tor Connections the Smart Way There are two problems with the "block them all" approach. First, there are thousands of Tor nodes. Checking every network connection against every possible Tor node takes time. This is fine if you have a slow network or low traffic volume, but it doesn't scale well…
The packet signature thing is maybe sort of interesting, but it's not hard to block Tor exit nodes; Tor themselves makes this easy: #!/bin/bash addresses=$(curl -s https://check.torproject.org/torbulkexitlist?ip= | sed '/^#/d') if [ -n "$addresses" ]; then /sbin/ipset flush tor echo "$addresses" | while read address; do /sbin/ipset -q -A tor "$address" done fi Add that to a cron job and your form abuse traffic falls…
I believe the article mentions that, but also notes your method works for low-traffic situations. The 0day is a high-performance alternative.