7

I am running a Tor relay on a remote server that is hosted in a professional server farm about 1000 km away from my home. I am absolutely sure, that this Tor relay is secure because I am root on this server (which is a virtual root server), because I did install the Tor relay, and because there is no other user on that machine than me.

There are many scenarios for attacks against anonymity of Tor users, and many of them include a modified software running a Tor relay that records traffic of this node and compares it with traffic from other nodes.

So I think I could lower the risk of being victim of such an attack by telling my local Tor browser to use my own Tor relay as my entry point.

Here are my questions:

  1. Is it true that I can avoid some attack scenarios with my strategy without being target for new ones? Even if my server is a virtual root-server in a remote server farm?
  2. Where can I find the settings to tell my local Tor Browser Bundle to always use only the IP-address of my own relay as entry point?
  • see torproject.org/docs/faq.html.en#ChooseEntryExit – user66 Nov 19 '14 at 8:10
  • Thanks, Lutz. This answeres my 2nd question. My first question (Is this really a good idea?) is left unanswered. – Hubert Schölnast Nov 19 '14 at 9:08
  • That's why it is only a comment, not an answer :) – user66 Nov 19 '14 at 9:23
4
+50

While I don't have an expert answer, I can draft some thoughts on your first question.

To estimate one's security level you have to define what your adversaries' capabilities are (technical skills, financial power, time and number of men), plus other factors (why would they spend their resources on targeting you, ...). That will form your threat model.

Your set up does protect you from one specific attack configuration you mentioned : interception is made at compromised entry node and compromised exit node. But that's not the only way to do traffic correlation. What if the attacker monitors your traffic when it is between your computer and your ISP? And bear in mind that correlation doesn't need to be perfect (extent knowledge of every packet content you sent and to whom) to be fatal : just knowing the fact that you're using Tor at a particular time can be enough (c.f. Bomb threats on a US campus to escape exams, only one guy connected to Tor at the time an email came from Tor. Fail). So yes you're protected from some current attacks but not from lots of other. Although of course, for someone to make all the investigation efforts, you would need to be valuable enough of a target.

Now, what about new attacks possibilities this set up would create ? Once again it depends on your threat model.

If someone deems it to be worth it, he can compromise your server, either remotely or physically. If you're not an expert at computer security, then sadly so your server will be hackable. Secure data centers can do a little more to prevent physical intrusions but everyone has a price and/or employees can be tricked. And even if they couldn't compromise your server, the fact that you are alone on your machine doesn't guarantee its confidentiality, as analysing the power consumption of the host computer could leak information. OK, I reckon I added this one to freak you out, but this is truly possible and at least it shows that, provided someone is determined enough, you can't even imagine to what length they will go to beat you.

So in the end, it all comes down to your threat level. From who you want to conceal your activities and why ? You have to work with assumptions because technical facts are overwhelmingly unlimited.

What I wrote until now is objective, verifiable and commonly accepted facts, to the best of my knowledge. But as no practical solution seem to emerge from these, I will now give my personal opinion which is to take with maximum precaution. I don't have enough cryptographic knowledge to assess the correctness of what I propose.

From all the threats I mentioned, the one that would worry me the most (because it is very likely to happen as it is cheap though most effective) is your ISP eavesdropping. Weather it is legal or not, weather they even know about it or not doesn't matter. (You could even enlarges this threat zone to the whole path between your computer and your server input). This is serious because it is a single point of failure.

What I would do is obscuring the traffic that you send to your entry node. The fact that it is encrypted conceal the content but not its shape because Tor does not randomize traffic (a variable amount of junk bytes added to each packet). I think that using a VPN to connect to your server would address this issue. As the data would be decrypted on the server right before going into the node, the traffic you sent to the entry node does not leak anymore, and the extra layer of encryption makes statistical analysis harder.

Once again this is an hypothesis that need to be reviewed by cryptographers and confronted by security experts to assess its strength.

But I think that if there is a solution to statistical analysis of the Tor network, it may ressembles something like that. It does lack this extra twist that cryptographers add to a protocol, an elegant trick of which no regular people would have thought to, that turns a seemingly good idea into a piece of art.

  • I am a bachelor in computer science and I did set up that tor relay because almost 2 year ago I did rent and pre-pay a server that I now don't need any longer for the next 4 month (then my contract will end and the server is no loner mine). I have nothing to hide, I use tor mainly because of academic interest, so I am not afraid of any attack agains my anonymity at all, and I don't think, that anybody has an interest to target just me. I only had that scenario in my head, that a powerful organization might control a big number of nodes and break anonymity of random users. – Hubert Schölnast Nov 27 '14 at 13:15
  • That may very well happen : CCC talk – Irving Poe Nov 27 '14 at 13:22
3

To manually set an entry node see the following FAQ entry:

Can I control which nodes (or country) are used for entry/exit?

Yes. You can set preferred entry and exit nodes as well as inform Tor which nodes you do not want to use. The following options can be added to your config file "torrc" or specified on the command line:

EntryNodes $fingerprint,$fingerprint,...

A list of preferred nodes to use for the first hop in the circuit, if possible.

As for whether or not this is a good idea, the answer is almost certainly no. The chance that an attacker can control both your entry and exit node to perform traffic correlation is relatively small. If they want to perform this correlation, they're more likely to attempt to control the exit node, and sit between you and your ISP watching your traffic in some other way. You haven't prevented this attack, but in the mean time you've also ensured that they KNOW which entry node you are using, meaning that if they can't get between you and your ISP you've added the threat vector where they compromise your server or force your VPS or colocation provider to cooperate.

Giving an attacker more information (what entry node you're using at all times) is almost always a bad idea.

0

Tor will automatically select a certain entry point. When you first start Tor it will decide on which entry node to use and stick to it, even writing that information to disk. These nodes are called guard nodes. This is to prevent the attacks you mentioned.

More information on this can be found in the FAQ.

Choosing them yourself might in some cases be counter-productive. Research on this is constantly ongoing so the default settings should be really good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.