Tor

Special thanks to Nachash for this lesson.

Tor is, to put it simply, the world's largest anonymity service. Relied on by many, the onion has developed into a staple of tech-security culture. With the immense popularity of Tor, several rumors have circulated regarding its security and effectiveness. This article serves to answer said speculations, and provide further insight into the workings of the Tor service.

How It Works

One takes a big chance using tor. Privacy isn't assured in any way; anonymity however is, given that one changes their habits.

Tor originally stood for "The Onion Router". How Tor essentially works is, traffic gets wrapped in multiple layers of encryption, passes from the initial box to the first node in the chain where traffic gets decrypted once, and passed to the next node. It then gets decrypted again and passed to the exit node from where decryption occurs the last time, and routes traffic in the clear.

Tor bridges are basically unofficial entry points into the tor network which are utilized by users in locations such as China in order to access Tor because a vast majority of the official nodes are banned. Such was the case during the Middle East protests, in which online activists were creating exit bridges with haste.

Common Pitfalls

The onion structure undoubtedly has issues. Such problems can be read in a comical form here.

Without clicking links, exit node operators can sniff the traffic that passes through. Some operators do this and for this reason, you should assume tor traffic is being monitored and therefore, always use some form of end to end encryption. If you're sshing into a box over tor, you've got end to end crypto covered.

Now, another thing you can do to help protect yourself somewhat is to exclude shitty nodes. A nice list of shitty nodes to exclude can be found here. For linux users, add that line to your /etc/tor/torrc file and restart tor.

If you're running a tor service (its very easy, just add one line to your tor config), you should be running it as a tor node for security reasons. Services not on a node are vulnerable to certain attacks.

Getting Tor and Extra Uses

For more practical stuff, most people are just going to grab the browser bundle off torproject.org. It's probably the easiest way. A nice little trick for those who have tor installed/running is to use it as a socks5 proxy. You set your proxy address to 127.0.0.1, and the port to 9050. Bam, instant socksified tor. For running command-line programs over tor, torify is recommended Which looks something like torify ssh [email protected].

Proxychains and Tor-Resolve

Proxychains and tor-resolve work better than torify usually as torify leaks DNS. Proxychains adds a library to LD_Preload, which basically wraps all DNS and connect calls to proxified ones and tor-resolve simply resolves a domain name to an ip using tor.

Also make note you can torify a whole box or shell session by adding "libproxychains.so.5" to /etc/ld.so.preload.

Hidden services

When connecting to "normal" websites, the connection looks roughly like:

you -> tor node 1 -> tor node 2 -> exit node -> internet

Hidden services appear as:

you -> arbitrary # nodes -> rendezvous <- arbitrary # nodes <- hs box

Hidden service is also very slow but ssl is basically moot. So literally, 7 proxies and someimes more than 7 proxies.

There was an article in 2600 a couple of years back about using the control port to change the length of tor circuits, and other things.

Hidden services are fairly badass. One of the pitfalls with them is a correlation attack. If someone controls enough nodes, they can send enough traffic to the hidden service to find its location. The best way to help prevent this is to make your hidden service a tor node, as well. Then it passes non-hs traffic and keeps anonymous.

About hidden services, they use .onion as a pseudo-tld. Example: hidden wiki is here: http://kpvz7ki2v5agwt35.onion/wiki/index.php/Main_Page. .onion is a way of describing a hidden service without giving away its location. The string before the .onion is actually a key fingerprint. This ensures a few different things, the service cant be found and it has the private key you expect it to have (it's what it claims to be).

The Silk Road

One of the more well known .onions is The Silk Road. For those who missed out, it's a venue for buying and selling drugs. Also, the gawker article on Silk Road: http://gawker.com/5805928/the-underground-website-where-you-can-buy-any-drug-imaginable You can buy drugs with bitcoins now. Welcome to the future.

Conclusion

Remember when I said you don't really have privacy, but you have anonymity? As long as youre careful about what info you disclose. However if youre buying goods you at least have to disclose your address. A lot of vendors on SR have PGP keys for this reason. This is not the biggest problem. While sellers are pretty much in the clear, assuming tor or SR itself arent compromised, buyers are vulnerable to stings. Either from sloppy sellers getting busted (maybe they werent so careful about erasing/storing your address) or from stings where the buyer is a fed/informant.

Tor is part of a series on Anonymity Visit the Anonymity Portal for complete coverage. Tweet