2

This is my understanding around how Tor may be used to circumvent a country's censorship of particular sites:

John lives in a country that has blocked traffic to a particular server (via DNS, I assume?).

John jumps onto Tor, and now his traffic is sent to a different DNS server since his exit node is quite possibly outside of his overly-strict country.

He can have access to the site, great.

The question is, I don't live in a country that has this kind of block in place. But supposing it was me logging onto Tor, is it not possible I could hit an exit node that was from John's country? Thus being subject to the DNS server that blocks traffic to the server to which I'm making a request?

Improve this question

2 Answers 2

Reset to default
3

Yes, that's possible.

Note that no serious censorship is done through DNS (alone) though, it's trivially easy to defeat, even without Tor.

Exit relays should be censorship free, so people shouldn't be setting up exits inside of censored countries. If they are they should maybe try excluding censored sites or locations from their Exit Policy so that people won't use them for accessing censored content.

An relay which is censoring exited traffic is considered "bad", from the Reporting Bad Relays wiki article:

Tampering with exit traffic in any way. This might be accidental (such as an anti-virus filter) or malicious (commonly SSLStrip, which replaces https:// links with http:// to snoop on traffic).

If you encounter one which is applying censorship, you should report it to [email protected] to be investigated.

Improve this answer
1

Tor is - basically - a network path censorship circumverting tool, and it does it's job quite well! Tor works on OSI Layer 3 and 4. The question you're asking is about a service layer, a Layer 7. Tor can not help you here, and it's OK. It's your task to set up a proper DNS resolver for yourself: Tor physically can't fix DNS protocols bugs and abuse, it does not inspect packets, it just helps them to pass from point A to point B in the great-harder-to-censor-or-mess-with way.

Improve this answer
5
  • Tor does address some DNS attacks by using 0x20 encoding.
    – cacahuatl
    Jan 14, 2017 at 1:14
  • As far as I know that is done in DNS port specifically, no IPS/IDS functionality of filtering the request transported, if it's not made to Tor resolving handler
    – Alexey Vesnin ♦
    Jan 14, 2017 at 1:34
  • It's done for all resolves that are performed over Tor, either something the exit resolves for you automatically (over SOCKS) or something you request through the DNSPort. It perform a transform (0x20 encoding) on the hostname being looked up to prevent some attacks on DNS, so Tor does fix some DNS protocol issues.
    – cacahuatl
    Jan 14, 2017 at 2:04
  • yes, but if you will tunnel on OSI Level 4 a DNS request from an external service, for example - from a standalone Bind DNS server - it will be delivered intact and so the reply for it, and if it contains an exploit - it will pass through. That was my point about Tor not dealing wit DNS bugs and abuses
    – Alexey Vesnin ♦
    Jan 14, 2017 at 2:37
  • 1
    Not all of them, no. But the exploit would only affect the exit, not the client. If you did use a standalone DNS and tunnel it over Tor, it would affect the client.
    – cacahuatl
    Jan 14, 2017 at 2:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .