Questions tagged [attacks]
Attacks against the tor network or its participants, or attacks from it.
82 questions
0
votes
1
answer
95
views
And if DDoS attacks could enhance the anonymity of the Tor network?
The most effective approach for an attacker would be to establish Tor routing and send packets to trigger a chain reaction across 3 or more relays.
Now, couldn’t these attacks potentially be an ...
- 1
2
votes
2
answers
277
views
Tor safe when taking future in to account?
With quantum computing becoming better by the day I have a few questions.
How viable and likely is it that an adversary to saves all tor traffic in order to decrypt it at a later date?
When ...
- 21
0
votes
1
answer
47
views
Gap - Counting number of packages to determine client?
I read a lot about onion routing and I am confused about the following fact on Wikipedia:
Only the final node, the "exit node", is able to determine its own location in the chain.
In my eyes ...
- 5
0
votes
2
answers
230
views
Can Tor connection be intercepted/tampered by exit nodes?
Can exit node tamper traffic before sending it to endpoint? I know it can see it, but the question is, can connection be spoofed, if non-encrypted protocol is used, for example usual HTTP or even TCP ...
- 105
1
vote
1
answer
145
views
Could I avoid traffic confirmation attacks by setting up my own guard node?
If I set up my own guard node and always use it when connecting through the Tor network, would I be fully protected from confirmation attacks?
Also, how would my anonymity be affected with such a ...
- 984
4
votes
0
answers
121
views
Tor hiden service ratelimits
While we are building a denial of service protection using and onionbalance for our HSv3 resources was discovered an interesting thing: during testing with simulated DDoS (launched 1000 tor client ...
- 41
0
votes
0
answers
90
views
Disconnect after X minutes inactivity?
I read somewhere its not a good idea to remain connected to TOR network for long periods of time because it gives an attackers more opportunity to de-anonymize.
The machine I am using is unatttended ...
0
votes
1
answer
959
views
Tor 100% CPU usage - DoS attack
I run a very small non-profit website and sometimes there are people that attack the website for unknown reasons to me, I use a dedicated server but the TOR Process itself uses only one core when ...
0
votes
1
answer
245
views
protecting against end to end confirmation attacks, are there any possible solutions that is theoretically feasible?
as i understand it, it requires the amount of information sent by the user and received by the server as well as the time of the information sent and received to be known for the attacker. is it ...
4
votes
2
answers
273
views
Can Tor be relied on as a trustless service? And more
My question is going to be a bit amateurish (bear with me please) but I have read a fair bit of this:
https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt [1]
And it didn't answer it. My ...
- 41
1
vote
1
answer
352
views
is tor still vulnerable to replay attack?
I'm doing a project to my University that consist studiyng vulnerabilities on TOR network. One attack I came across on Intenet is the "replay attack". This type of attack allows a adversary, that ...
- 11
1
vote
1
answer
232
views
List of attacks on Tor
I'm studying Tor for educational purposes and I haven't been able to find many resources about attacks on Tor (even the once that have been patched). Most of the articles are too general or don't ...
- 25
1
vote
2
answers
236
views
Increasing number of middle relays weakens the anonymity?
Tor nodes build encrypted TLS sessions between neighbors to multiplex circuits of users. Multiplexing helps to anonymize users (?).
With an increasing number of middle relays multiplexing becomes ...
- 31
0
votes
0
answers
190
views
Track Tor circuit via ISP logs
I have some question about the very basics of tor, as this keeps bugging me now for some time:
As far as I know every tor node is only aware of the ip address of the following node. For example the ...
- 51
6
votes
1
answer
281
views
Is Tor traffic using the TAP handshake vulnerable to retroactive decryption?
Assume an attacker with a record of Tor traffic between a client and guard has precomputed the 1024-bit Oakley group for Diffie-Hellman used in the TAP protocol. This would allow them to rapidly ...
- 225
0
votes
1
answer
353
views
I got effected by GANDCRAB ransomeware and all my files & documents got encrypted and .WRCOR file extension got added orginal file name
All my files & documents got encrypted and appended with file extension .wrcor. I was accessing a file from Tor browser. Suddenly I saw my files got converted and encrypted.
Al the original file ...
0
votes
1
answer
89
views
Protect against pseudonymous identity activity on a forum and traffic correlation?
I use Tor when I need to use a pseudonymous account on a forum. A observer can see when I connect to Tor and correlate with activity of the account from the forum
How I can protect against this ?
2
votes
0
answers
143
views
What kinds of attack can a bridge carry out?
I have been recently doing some research on anonymity implications of using a bridge, and wrote a tool (not very well written though) for setting up a malicious bridge node. However, I am not clear ...
- 725
5
votes
1
answer
1k
views
Why does TOR not intentionally choose nodes from different countries?
I've read than if an attacker could control both entry and exit node into the tor network he could easily de-anonymize TOR users. I have also read that TOR chooses nodes at random. So my question is ...
- 101
1
vote
1
answer
113
views
Are the LinkWidth attacks still a threat?
Recently i have found a pdf talking about an attack using so-called “LinkWidth” against tor network, here it is https://pdfs.semanticscholar.org/aa31/f6e8676e6c1a531854e4337649f0556e9280.pdf
The ...
0
votes
1
answer
1k
views
Stopping a DDoS attack on Tor daemon
I've already check How to protect a hidden service against DDOS attack? and How to deal with DDOS attacks? and How to mitigate layer 7 attacks on hidden services?. The problem is not DDoS of web ...
- 11
0
votes
1
answer
269
views
Simulating Correlation attacks on Tor using Shadow
Is it possible to simulate correlation attacks on Tor using Shadow? If it's possible what's the easiest way to implement it? If it's not possible, then is there any other simulators that can be used ...
- 101
0
votes
1
answer
1k
views
Prevent traffic correlation/timing attack
When running a hidden service, should the operator run own entry guard?
Logic be that if the entry guard run by operator, no possible way for traffic correlation by malicious people. Traffic ...
- 1
1
vote
0
answers
84
views
Noise sender function in TOR?
Does TOR have the service of contacting me with x bytes of noise and ignore the garbage I return?
Background
I recently heard a talk about a company that is privacy aware. They run smart ...
- 341
2
votes
2
answers
2k
views
How can one avoid Tor correlation attacks?
People usually recommend either using a VPN or hosting an entry or exit node in a remote server. But what about proxies and bridges, for example? And are there any other way to avoid correlation ...
- 23
3
votes
1
answer
452
views
Does facebook's hidden service url mean that collisions are feasible?
https://facebookcorewwwi.onion/
The idea is that the Facebook onion address connects you to Facebook's Core WWW Infrastructure - check the URL again, you'll see what we did there - and it ...
1
vote
2
answers
2k
views
public key not found
Good time of the day! I downloaded Tor source code and the signature on a new board, started to check it - and it does not verify! OS is Armbian, no GPG-stuff was ever performed on the installation, i....
- 6,275
2
votes
1
answer
558
views
Why do entry nodes not know the originator?
I stumbled upon the following text in the article about onion routing on Wikipedia:
In this example onion, the source of the data sends the onion to
Router A, which removes a layer of encryption ...
- 21
1
vote
0
answers
69
views
Can someone explain this?
Can someone please explain this? still unfamiliar i mean this ip's looks suspicious is this a ddos attack?m new to relay operating so please explain thank you.
2
votes
1
answer
166
views
Whonix Workstation Country Code
Should I be concerned about the timezones in my custom whonix workstations (arch, ubuntu, kali)? Installation mediums always ask for my country code. I usually pick a random one. When building ...
- 21
2
votes
1
answer
174
views
What prevents directory server from being attacked?
I understand that the first thing a Tor user do is connect to a directory server to obtain a list of tor nodes, which can be found here:
https://atlas.torproject.org/#search/flag:authority
What ...
- 157
1
vote
0
answers
79
views
Tor Brower Compromised?
My firewall is configured to warn me of any changes to my tor browser when I'm on line. It also lists the ip address and the originating website. Recently, it detected a change which was initiated ...
0
votes
1
answer
194
views
Was I attacked or my identity found out?
I am new to TOR and not very tech savvy. While using TOR to set up an email account, I found that I had to constantly to solve puzzles for verification. Sometimes websites would not allow me access, ...
- 1
1
vote
0
answers
243
views
How does selecting new guard relays work?
I've been told guards are selected when a client first connects to the Tor network and used until they disappear.
What constitutes disappearing?
Do all guards need to disappear (and then the whole ...
user194
1
vote
1
answer
70
views
Malicious Exit Nodes in network sensor [closed]
I run an onion pi (a wireless router that redirects all of my traffic over tor, here's a how to)
Anyways I installed maltrail on my onion pi to see what's going on; found these exit nodes scanning my ...
0
votes
1
answer
49
views
Does a tor message keep track of number of nodes it's gone through?
Let's say you have a message. Does it include the number of hops it has passed through? If no, what is stopping it from just being passed around indefinitely and never reaching an exit node? If yes, ...
- 125
3
votes
1
answer
499
views
How to mitigate layer 7 attacks on hidden services?
I've observed the following:
The Tor client establishes reverse connections to random relays and any further hidden service traffic is tunneled trough these connections.
This means:
There are no ...
- 31
1
vote
1
answer
229
views
Security for relay on Home network
I want to host a relay to help out the network. I am looking into the possibility of doing it on my home network. Two concerns have come up during my research. The first is I would potentially be ...
- 283
1
vote
1
answer
727
views
TOR traffic correlation: how quickly can you be de-anonymized?
I know that statistical analysis of the data entering and leaving the TOR network can be used to de-anonymise users given enough time. http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf
How ...
- 21
8
votes
1
answer
411
views
List of attacks that try to trick browser to not use SOCKS/Tor
I've heard it called "disbanding" attacks where the attacker induces a client into not routing a connection over Tor. Basically all of the things that the TBB protects against.
Examples might be ...
- 1,274
1
vote
1
answer
355
views
Hidden Service as client or relay?
Take a look, what is the difference between Tor-Browser in onion encrypted traffic and Apache service responses in onion encrypted traffic?
Tor-Browser: sent 1% / receive 99%.
It is simply,
...
- 11
1
vote
1
answer
163
views
How do bridges defend themselves against targeted scans?
Running a Tor Bridge recommends using port 443 and even when running a bridge using a pluggable transport an open (non-transport) bridge port seems to be required.
Assuming someone runs obfs4 and a ...
- 1,202
1
vote
1
answer
1k
views
How can I randomize the entry guard?
Tor is moving to a single entry node implementation (#11480). I think that's because it's statistically feasible for an adversary to deploy entry and exit nodes and perform a correlation attack by ...
- 193
3
votes
1
answer
1k
views
How does Tor defend against Sybil attacks?
Sybil attacks target the weaknesses in the reputation system. How does Tor deal with such attacks? Recently, the Lizard Squad tried to take control of the Tor network by creating a large number of ...
- 1,133
6
votes
2
answers
552
views
Tor dying on Raspberry Pi (circuit creation storm, out of memory)
UPD: this question was regarding an older version of Tor (0.2.4.24). With a newer version (which was 0.2.7.2-alpha for me) the problem disappeared.
I am running Tor (0.2.4.24) relay on Raspberry Pi (...
- 105
3
votes
2
answers
93
views
Is exit node able to modify / add packets to a stream?
Is it possible for an exit node to modify the data stream of a circuit, for example could a cell such as a padding cell be send down the stream after the data have been transmitted ?
I am thinking ...
- 447
1
vote
0
answers
23
views
Final relay able to encrypt data to the client? [duplicate]
Have been reading the one cell is enough to break anonymity paper, and just have a question.
Once a circuit has been successfully created, can the final node of the circuit encrypt a piece of data ...
- 447
3
votes
1
answer
1k
views
Ready-made Tor relay on virtual machine
I was looking for a virtual machine that has Tor relay pre-configured. This came to my mind while thinking about the the amount of security which can be provided by having thousands of similar Tor ...
- 131
1
vote
2
answers
128
views
On Dec 26 2014 the number of relays have increased from 6700 range to 10000 range overnight. What is going on?
The number of relays have suddenly increased from 6700 range to 10000 range in a very short period of time. What is going on?
- 3,220
3
votes
1
answer
2k
views
Launching a Distributed Denial of Service attack on a hidden service
Recently, I have seen more and more forums, image boards, and market places that are shifting to Tor for the safety of their users. This undoubtedly brings the many attackers that dislike these ...
- 189