Tor exit nodes attempt to spy on encrypted traffic, researchers find
19 Tor exit relays used self-signed certificates to launch man-in-the-middle attacks against HTTPS and SSH connections
IDG News Service - Computer scientists found almost 20 exit relays in the Tor anonymity network that attempted to spy on users' encrypted traffic using man-in-the-middle techniques.
The research was carried out over a period of four months by Philipp Winter and Stefan Lindskog, researchers in the PriSec (Privacy and Security) group at Karlstad University in Sweden, who recently published a paper with their findings.
The Tor network is designed to provide anonymity for users and bypass Internet censorship attempts. This is achieved by encrypting user traffic and routing it through a series of computers that act as relays and are run by volunteers before sending it to its intended destination on the Internet.
Computers that handle the final hop in the Tor network are known as exit relays. According to statistics from the Tor Project, there are about 1,000 such relays as of this month.
Even though connections between Tor relays are encrypted, traffic is returned to its original state when it leaves the network. This means that if it's not using SSL or another secure transport protocol, Tor exit relays can inspect it. That's why the Tor Project recommends the use of HTTPS -- HTTP with SSL encryption -- with all websites that support it, even if using Tor.
However, their man-in-the-middle (MitM) position allows Tor exit relays to tamper with HTTPS connections, using techniques like SSL stripping or impersonating the destination website using a rogue certificate.
The researchers built a scanning tool called exitmap that can identify exit relays behaving maliciously or abnormally and ran it on the Tor network. Over a four-month period they identified 25 bad relays that were subsequently reported to the Tor Project and blacklisted.
Fourteen relays engaged in man-in-the-middle HTTPS traffic sniffing using fake certificates, four relays did both HTTPS and SSH sniffing and one attempted only SSH sniffing. Two other relays used the sslstrip tool to force HTTPS connections over plain HTTP, one relay injected HTML code in HTTP traffic and three relays engaged in Internet censorship by blocking access to certain websites at the DNS level, intentionally or because of misconfiguration.
The relays engaged in HTTPS sniffing used self-signed certificates which lowered the attack's success rate because this triggered browser certificate errors that users would have had to manually dismiss. The Tor Project maintains and distributes a software package called the Tor Browser Bundle that contains a browser based on Mozilla Firefox and other components needed to access the Web over Tor.
The researchers believe the relays doing HTTPS or SSH traffic interception were operated by the same individual or group of individuals because they used very similar self-signed certificates, almost all of them were located in Russia on the network of a virtual private server (VPS) hosting provider and all of them ran an old version of Tor -- 0.2.2.37 -- that's uncommon among relays. Only two benign relays that used this same Tor version were identified during the scans.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Encryption White Papers | Webcasts