Silk Road forums
Discussion => Security => Topic started by: gestaltassault2 on December 17, 2012, 12:58 am
-
Ok...so anybody using Vidalia can set it so that their computer becomes a relay for the TOR network right?
So what keeps a federal agency like the DEA from setting up a computer as a relay and parsing the data that runs through it? Wouldn't it be possible for them to gather sensitive data this way or trace routes this way?
-
Of course they can do that, but they wouldn't do it with the Browser Bundle running on their DEA office computer.
There is a command line version of Tor with no Vidalia, which is what most Tor relays are running. It's possible that LEA in various countries are operating some of these relays. The easiest attack is simple timing / traffic analysis. If LE controls your entry guard and exit node, they can see who you are and what site you are accessing. The probability of picking two malicious nodes like that is (c/n)^2, where c = number of malicious relays, n = total number of relays. It's more complicated than that, because your client picks relays with a probability weighted by bandwidth, but lets go with that as a first approximation.
If the DEA operated 50 relays, the chances that you pick 2 of them for your entry and exits is (50/3000)^2 = 1/3600. That's a relatively small chance for a rather large number of relays that they would have to operate, however, if you picked different entry nodes every ten minutes (when you build a new circuit), you would quickly get pwned (on the order of weeks). But that's why entry guards exist. You stick with three of them for a few months at a time, so it would take years to cycle through them until you picked from the DEA nodes.
That's on average. Some people would get pwned faster than others. It's the luck of the draw. But the point is that the entry guards greatly improve your safety, which is why you should not follow the advice of some "improve your Tor performance" guides that say to increase the entry guards to 8. That can potentially get you pwned faster.
All of this only applies to visiting clearnet sites. There are no exit nodes with hidden services. LE can't do a traffic confirmation attack because they don't know where the other end of the circuit is (although there are some well known attacks for identifying hidden services).
-
1. LE probably has been doing just that for a long time. I think all connections in TOR are encrypted but
when they exit out of an exit node it becomes unencrypted. If LE has an exit node then they can see the traffic
in clear text as it exits.
This is an image that may help you understand
https://www.torproject.org/images/htw3.png
I read about some researchers a few months ago who were able to trace locations of tor nodes and possibly
other TOR users. I think they exploited a security flaw in TOR. This has probably been fixed though as new updates
for the browser package come out all the time.
If I am wrong in any of this please correct me.
-
Ok...so anybody using Vidalia can set it so that their computer becomes a relay for the TOR network right?
So what keeps a federal agency like the DEA from setting up a computer as a relay and parsing the data that runs through it? Wouldn't it be possible for them to gather sensitive data this way or trace routes this way?
The "onion" sense of onion routing is why this is useless. Each layer of the onion is another layer of encryption. Each node can only encrypt the outermost layer and pass on the encrypted packet to the next node. There is no unencrypted data to parse. (Exit nodes are another story, but that doesn't apply to hidden services).
Here's an excellent primer on onion routing from Scientific American [clearweb, etc]:
http://www.scientificamerican.com/article.cfm?id=hiding-your-connection