How can Tor users and Tor Network protect themselves from an exit node that is actively logging or manipulating exit traffic?

Question

Tor Exit nodes are the last hop in the circuit a Tor client establishes to reach a service in the Internet. Exit nodes handle the actual traffic of the client, either it's encrypted or not.

That means that exit nodes are able to perform logging or various traffic manipulation attacks, harming client's anonymity. An attacker could intercept data or swap them. Even if the client uses SSL to the destination an attacker could try to bypass that using a known attack on SSL.

Is the client able to detect a malicious bevaviour from an exit node? If the client does detect it is there a way to report and possibly block that particular exit node? Has Tor Network found a way to protect itself by such attacks in an automatic way without user's intervention ?

Answer 1

Is the client able to detect a malicious bevaviour from an exit node?

Not really. If a malicious exit relay operator conducts a man-in-the-middle (MitM) attack by using a self-signed certificate, TorBrowser will display a certificate error page. That's what everybody already knows from an ordinary Firefox. Right now, there is no easy way to distinguish between an actual MitM attack and a web site handing out self-signed certificates.

If the client does detect it is there a way to report and possibly block that particular exit node?

Yes. If you suspect that an exit relay is interfering with your network traffic, you should report it to the Tor Project by creating a new ticket in the bug tracker. If the Tor Project is then able to verify that the reported exit relay is interfering with network traffic, some directory authorities will vote to assign it the BadExit flag which will prevent Tor clients from using it as an exit relay. It remains part of the network, though, because it can still be useful as a non-exit relay.

Note that network traffic interference does not have to be a MitM attack. Some exit relays were found to use an OpenDNS configuration which blocks certain web site categories. Upon visiting such a blocked site, you would see an OpenDNS error page. While there is no malicious intent, it certainly represents an undesired interference with user's browsing activity and also results in getting the BadExit flag.

After all, part of the current approach to deal with malicious exit relays is crowdsourcing. Users are greatly encouraged to report suspicious activity. It makes the network more secure for everybody.

Has Tor Network found a way to protect itself by such attacks in an automatic way without user's intervention?

Not yet but there are some concept which are being played with. There was also some interesting research in the past. In particular, researchers exploited the fact that traffic sniffers might be configured to conduct a reverse DNS lookup for IP addresses and others set up decoy hosts to attract attackers.

Answer 2

I don't think the Tor client itself can detect malicious behaviour carried out by an exit node nor should it.

If you're browsing a site over http:// then as you say, the exit node can view and manipulate your traffic like any MiTM could. The solution is TLS but as you pointed out there are MiTM attacks that can be launched against sites using TLS such as those put forward by Moxie Marlinspike and SSLstrip. The final link in the chain is HSTS. HSTS is a policy issued by a server, sent as a HTTP response header, that will force compliant browsers to only ever use https:// on the website. This effectively mitigates the risk of current MiTM attacks against TLS.

Answer 3

There is procedure in Tor for reporting bad relays:

https://trac.torproject.org/projects/tor/wiki/doc/ReportingBadRelays

Send email to address [email protected] and describe the behavior you observed (the suspicious criteria are in the wiki).

There is no automatic way of detecting such nodes, only manually.