Just as a hypothetical attack, assume Eve is using TOR. But Eve wishes to take control of the TOR nodes, and so injects a malicious package into the packets she sends to her TOR relay that takes over the servers. She creates several different relays in order to infect multiple machines. Then, if Eve wishes to eavesdrop on TOR traffic, she can monitor exit nodes if any of the servers she infected is acting as one for other clients, and she can intercept unencrypted data.

I have a few questions regarding this...

  1. How feasible are client-side attacks in TOR?
  2. Is it feasible to inject such malicious packages into the packets?
  3. How feasible is the above attack?
  4. What kind of protections does TOR offer to the nodes against attacks from the client?

It doesn't seem to be addressed elsewhere, and the attack seems like it could potentially be carried out by organisations intent on monitoring the encrypted traffic.


I assume you're new to information security.

  1. It's an exposed service, if there is a bug in the software then there's potential to exploit it.
  2. Not in the way you describe, I'd be more concerned about libssl and friends.
  3. Not hugely, getting a memory corruption exploit working, especially cross-platform, can be a big challenge. It'd be cheaper to just run lots of relays yourself.
  4. Well tested and written code and fortified binaries, and an attempt to make the tor process operate with least authority where possible.

So, you're talking about an exploit worth $30-$50k (Tor Browser RCE is ~$30k, OpenSSL RCE is ~$50k so it's probably somewhere in between), putting the time and effort into weaponizing it for various platforms (probably requiring finding and chaining at least one other bug, mem disclosure, etc) all the while running the risk of being caught, having your exploit discovered and burned and then even if you do succeed you may eventually go to jail.

Or you could just sell the exploit or collect a bug bounty and buy relays legally.

Writing actually reliable (because if it crashes tor the sysadmin might come investigate that coredump) exploits for modern operating systems is actually a lot more difficult than the tech journalists make out and the experts make it look. 0days don't grow on trees, if you mess it up once and crash someones server there's a potential the whole thing will be lost and you'll be back to square one.

Consider also that a lot of Tor relays are operating on Linux and BSD systems, which means that even if you managed to compromise the Tor process, your compromise would only work until the next time the service was restarted. To actually gain persistence you'd need to write a local privilege escalation exploit for all the various platforms you'd weaponised your exploit against, another ~$30k for each platform.

So while it's not impossible it's really not a very economic approach and more likely to be the work of (skilled, bored) chaotic actors rather than someone with an agenda, there are much easier ways to yeild similar results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.