Tor fingerprinting on NSA Egotisticalgiraffe document

Question

On page 11 and 12 of this document: http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document

they say it's easy to dinstinguish Tor users from non-Tor users because of Torbutton. They are probably using some user-agent+javascript stuff. But still, if someone wants to distinguish Tor users from non-Tor users, why not look up their IP address? If the IP is from an exit node, then we have a Tor user! Why do you think they aren't looking at the problem that way? Or I'm missing something..

Answer 1

I think those slides aren't about distinguishing tor users from non-tor users, they're about detecting Tor Browser Bundle users... so that they can serve the versions of their Firefox exploits that are tailored for that specific build of Firefox.

Lots of people probably don't heed Tor Project's advice and use other browsers with tor, and maybe serving the wrong firefox exploit to someone might just crash their browser but not pwn them. Presumably they also have non-TBB FF exploits, and chrome exploits, etc... though they probably wouldn't risk exposing them by using them widely, they could easily target them at specific logged-in website users to deanonymize them.

It's also likely that some people are using TBB via other proxies or unlisted Tor exits, and of course the spooky goons want to be able to pwn them too.

Answer 2

While it is definitely very possible to see that the traffic is coming from an IP that is an exit node, regular traffic could possibly be coming out of the exit node as well.

Despite the fact that the Tor Project suggests that you use a dedicated IP address (https://blog.torproject.org/running-exit-node #2) for your exit node, it is possible for the operator to try to hide their traffic in the exit node's traffic which explains the need to fingerprint the Tor traffic as well.

Answer 3

The NSA / GCHQ are in a position where they don't have to only look at requests arriving at their servers, or even requests arriving at compromised servers - they intercept traffic in bulk on the internet, not just at end points.

From an intelligence agency perspective then, being able to identify Tor traffic whilst it's in transit (i.e. still going between hops in the Tor network) is useful, to allow enumeration of Tor users and potentially direct future surveillance efforts against them.