Detect Tor from a LAN proxy

Question

I have a quick question I hope has not been asked yet.

Let's assume there is a network such this: there is a pc (let's call it X) which is part of a wide LAN; to connect to the internet, it must go through a proxy which blocks (and logs) connections to forbidden IPs. Now, on the pc X there is Tor; it must use the proxy to work as well, but when it tries to connect the proxy blocks Tor IP; therefore it is set up with bridge relays (got by email, not the public ones). In such a way, the connection to any of the forbidden IPs is successful (the proxy doesn't block the relays IPs).

The question is: even though the PC X is reaching an IP which shouldn't be reached, since the proxy logs ALL traffic, is there a way to know from logs that the PC X is using Tor? What kind of traffic does the proxy see actually? Is the traffic encrypted or something?

Thank you in advance.

Answer 1

In general, there are several ways how the proxy could figure out that PC X was using Tor. Note that not all of these attacks are straightforward to implement so it depends on how determined the proxy is. In particular, the proxy could do the following.

• It could monitor to which IP addresses you are connecting to and actively probe them, i.e., opportunistically establish Tor connections to your destinations and see if they succeed. The Great Firewall of China is known to do this.

• While Tor's traffic is indeed encrypted, it could look at the TLS handshake between PC X and a bridge and see if it could be Tor. The TLS handshake has several unique aspects such as Tor's randomly chosen SNIs and the client cipher list. You can use pluggable transports to avoid that.

• In theory, it could also do traffic analysis, i.e., look at things such as packet lengths, timings etc. In practice, that takes some effort to implement.

If the proxy is just a random off-the-shelf router, I wouldn't worry too much. Using pluggable transports with bridges is probably good enough.