1

A normal tor chain is like this :

Client -> Tor Node -> Tor Node -> Tor Exit Node -> Server

Is it possible to have this schema ( two chains ) :

Client -> Tor Node -> Tor Node -> Tor Exit Node (Sniffer) -> Tor Node -> Tor Node -> Tor Exit Node -> Server ? Could you explain why is it a yes or a no ?

I know that there is a Tor Exit Node List, but is it exhaustive ? Is each exit node verified to be a real exit node ?

EDIT

My question is about exit nodes and not the chain length. Exit nodes see unecrypted data so it can send it to the server. Can an attacker who host the exit node at this step sniff the data, and not send it to the server directly but using a new tor chain in order to be totaly anonymous ?

Improve this question
4
  • 1
    read tor.stackexchange.com/questions/103/… and tor.stackexchange.com/questions/8666/… and torproject.org/docs/faq.html.en#ChoosePathLength
    – v7d8dpo4
    Apr 22, 2016 at 1:05
  • My question is about exit nodes and not the chain length. Exit nodes see unecrypted data so it can send it to the server. Can we at this step sniff the data, and not send it to the server directly but using a new tor chain in order to be totaly anonymous ?
    – yeska
    Apr 22, 2016 at 6:50
  • That doesn't gain you anything, and doubling the number of relays it passes through will just slow down your traffic. Why would the exit at the end of your longer path see anything different to the original exit?
    – Richard Horrocks
    Apr 22, 2016 at 9:01
  • It's not to be more anonymous, we all know that the exit node can sniff data, because data is unecrypted at this point, ok ? anyone can host an exit node and sniff all the data passing from it, ok ? Now the question is, can this attacker be anonymous ? Can he sniff the data, and instead of sending it to the server, injecting it in a new tor chain , so the victim will think that his data passes over just 3 nodes, but in fact it passes over 6 nodes because there is a Man in the middle attack ?
    – yeska
    Apr 22, 2016 at 9:15

1 Answer 1

Reset to default
2

There wouldn't really be any benefit to the attacker sniffing the exit traffic and then routing it over Tor again. Theoretically it would be possible. They can run an exit node, and configure their system to then tunnel all outbound traffic through another Tor client using SOCKS. This wouldn't make them more "anonymous" in this attack. If anything it'd potentially draw more attention to their exit because final exit IP address would be different from the exit node in your circuit.

When your Tor client builds a circuit, you can see the entry, middle, and exit nodes your traffic will pass through and get the IP addresses of each of them including the exit node.

Assuming that someone was doing this, you could easily test it by going to a website that tells you your IP address, and if it shows an address that doesn't belong to the exit node for your circuit, something weird is going on.

Keep in mind, the exit node can only see unencrypted traffic that passes through it. If you visit an HTTPS site over TLS, or connect to an encrypted service like SSH, the exit can only see encrypted traffic and will not be able to decrypt it.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .