7

If I've download a Tor binary from an unofficial source is there a way to verify that the binaries haven't been tampered with?

  • You can just git diff the source/ folder of the package. – Amelia Sep 27 '13 at 13:10
  • 1
    @Hiroto Only if it's in Git, and only if source is provided (and you then build that source yourself). This is about binaries, not source :) – Sam Whited Sep 27 '13 at 13:14
  • You should be building from source regardless, or using offical sources. – Amelia Sep 27 '13 at 13:16
  • @Hiroto I don't disagree with you, but for the purpose of this question assume the user is not, or cannot, for some reason. – Sam Whited Sep 27 '13 at 13:17
  • What do you mean by "tempered with"? Do you mean the distro maintainer injecting a backdoor prior to uploading the binary to the repository? Or do you mean the evil hacker changing the binary on the way from the repository to your machine? Or even the evil twin who booted your machine off an USB drive and replaced the single executable on your disk? – zhenech Oct 2 '13 at 21:02
5

If you're using your distro's binaries to install Tor then you have to trust the package maintainer of your distro as you do with every other package of your operating system. If you don't trust maintainers and/or developers of your distro then I guess there is a bigger problem since that means you can't trust the operating system in which you run Tor.

Mind that Tor project suggests using its own repositories since most Linux distro's repositories have an outdated version of Tor.

If you're installing Tor from Tor project's repositories (e.g. https://www.torproject.org/docs/debian.html.en for Debian and Ubuntu machines) then you will also have to add and trust the GPG key which was used to sign the packages.

So the question is how can you trust that the GPG key mentioned in torproject.org is owned by Tor developers. One could say that as long as you trust the HTTPS connection and certificate of torproject.org you can trust that you're getting the correct GPG key.

Another way GPG key trust is established is through the Web Of Trust. That means you have to check the key's signatures recursively and find a signature of a person you know.

When you're sure it is the correct GPG signing key, then trust is passed to Tor developers, who we do trust (or not) from the beginning.

  • 1
    As accurate as this answer is for its situation, it doesn't really answer the question which specifically specifies that they're using OS repositories, as opposed to Tor Project repositories. – Megan Walker Sep 26 '13 at 17:10
2

As you asked for every possible way of tampering, the list is going to be kinda long, but let's start anyway.

The package maintainer adds strange patches...

...or uses a weird build system.

I would say this kind of tampering happens all the time a package is being built (or prepared in case of a source distribution!) for you by a third party. However this is usually not harmful tampering.

On Debian (sorry, I am kind of biased here), you can observe what happens to a certain package in various ways:

  • the patches are listed on the patch-tracker, if they can be easily extracted
  • the build-logs are archived for later inspection
  • there is a general overview of the happenings in the package at the package tracking system
  • you can view the source used for the build via git or by calling apt-get source tor on your machine (comparing it to the pristine upstream source is up to you then)

These measures however do not prevent an evil build-machine from injecting malicious code into the binary without logging it. Or the maintainer injecting something bad into the binary he uploads together with a pristine source (maintainer uploaded binaries are not rebuilt in Debian [at least at the moment]).

The evil hacker changing the binary on it's way from the repository to your machine

This is something that should not happen in today's distributions, as the whole chain from the maintainers machine to yours is guarded by signatures (and the maintainer of course checked the signature of the tarball he/she got on the internet ;)).

[ example is again heavily Debian biased, sorry ]

[ on a side note: break PGP and the whole world is fucked :) ]

The evil twin/government who pokes around your disk

This is probably the most effective and targeted way in my list.

Start with encrypting your disk (the whole disk, yes, that includes /boot or they will poke your kernel/initrd). An encrypted disk does not only save your kinky pictures, it also prevents strangers from writing to it. Using a read-only medium for the super-secure stuff is an alternative (did I mention Tails already?).

After you think your system is secure, check it on a regular basis. debsums and aide could help you here. So would a backup suite like bacula which can verify disk contents (that should never change).

  • This doesn't have much to do with the question; I've tried to modify it to make it clearer and less distro focused. It doesn't matter where the binary gets modified, just the fact that it is. It's also not about trying to prevent a binary from being modified. Hope that helps, and thanks for the answer anyways! – Sam Whited Oct 2 '13 at 22:43
  • That sounded different in this comment: tor.stackexchange.com/questions/111/… Sorry. But then the answer is easy: you cannot :) – zhenech Oct 2 '13 at 22:50
  • That very well may be until the deterministic build process graduates from alpha. That comment was made by someone not-me. It does apply though; it can be from repos (my initial intent) or downloaded from somewhere online; it's the same thing. Just a binary from a non-official source. – Sam Whited Oct 2 '13 at 22:52
  • Oh, Sam vs Samuel, sorry. – zhenech Oct 2 '13 at 22:54
1

Recently, Tor's build process was rewritten to be deterministic (currently only available in alpha builds). This means that builds produce byte-for-byte identical binaries for each OS/architecture combination that the build targets regardless of what OS/architecture you're currently running on.

Because of this you will (eventually) be able to take a hash of the official binaries and make sure that it matches those provided by your distro (eg. sha1sum tor).

For more information on deterministic builds, see this blog post.

  • As I understand it the build would be identical byte-for-byte with any build targeting the same architecture/OS. Naturally a binary built targeting x86-64 on Windows would be different from one targeting x86 (32 bit) on Linux. It's simply that you should be able to produce that build on any os or architecture – Megan Walker Sep 26 '13 at 17:14
  • Heh, correct; I worded that poorly. Obviously an EXE for Windows is going to be different from the binary for Linux. No idea if you can cross compile. Reworded. – Sam Whited Sep 26 '13 at 17:18
  • It looks like you can cross compile. gitweb.torproject.org/builders/tor-browser-bundle.git/… - A readme for the 3.0.0 alpha build which introduces this system says that it will "then start the build process to produce localized Linux bundles, followed by Windows bundles, followed by Mac bundles." – Megan Walker Sep 26 '13 at 17:23
  • This doesn't actually work yet on distributions. No distro creates a deterministic build, and sha1sums are not posted for the tor client itself (only TBB). – Tom Ritter Sep 26 '13 at 20:24
  • Oops, thought I said that this was an upcoming feature. Will correct; thanks. You can still just download a binary from the Tor site and compare checksums. – Sam Whited Sep 26 '13 at 20:40
0

This issue is not specific to Tor packages. RPM can verify integrity of installed files. For systems that use APT, the debsums utility works similarly.

  • The question is about checking if the binaries match the original Tor source or have other things added. This answer doesn't really answer the question. – Sam Whited Sep 30 '13 at 6:07
  • 1
    Your question said nothing of source code. You asked how to determine if binaries have been tampered with. – pmocek Oct 6 '13 at 3:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.