I am wondering about the security with TOR, if an end node setup a proxy like Burp Suite and replaced the certificate, does it mean the end node can still see all the packets that had passed through even the site has SSL cert?
2 Answers
Tor only protects the traffic up to the exit node.
If there is some man in the middle at the exit node or after the exit node then he can intercept and modify the traffic. Since https is end-to-end encryption it will detect such attack. But if you simply accept any certificates even if the browser explicitly warns against it or if the attacker has access to a trusted certificate for the target host (due to hack of target host or CA) then the man in the middle attack would succeed and the attacker will be able to see the decrypted data.
Tor does not care about the traffic that passes over it. Anyone running skiddy/"whitehat" tools on the exit traffic can tamper with it in any way. However these tools cannot break TLS.
The exit can see and could tamper with any data leaving the Tor network, but it's visibility would be of TLS. If the security properties of TLS hold, they will not be able to see the actual plaintext of the traffic you send to the site while using https.
While Tor is agnostic of the traffic that passes over it, Tor Browser uses HTTPS Everywhere to enforce TLS on websites, where it is supported. This defeats sslstrip for any sites configured in HTTPS Everywhere, since sslstrip (and similar tools) depend on stopping you from upgrading to TLS in the first place.
Furthermore, things like sslstrip, tampering with certificates or even tampering with plaintext traffic is something that tor project volunteers run regular scans for against all exit nodes. Any relays that are found to be tampering with traffic are investigated and potentially blacklisted from the tor network.
If you see any tampering taking place, sslstrip or similar activity you should report it to: [email protected]
Helpful information to provide would include the IP address or fingerprint of the relay that you were exiting over (on Tor Browser you can find this under the green onion menu), and the website or service you were trying to access at the time.
