Hot answers tagged

16

From the criminal complaint, it is fairly clear that this isn't an issue with de-anonymizing Tor. If you look under Volume of Business Activity Reflected on Silk Road Servers, on page 14 it states that on or about July 23, 2013 an image of the SR web server was made and provided to the FBI (presumably by the hosting company.) They don't mention how they ...


10

Tor's announcement over the matter states: So far, nothing about this case makes us think that there are new ways to compromise Tor (the software or the network). The FBI says that their suspect made mistakes in operational security, and was found through actual detective work. So in answer to your question, no, deanonymization did not play a role.


6

Based on the case reports they were able to trace the SR to him. That does not mean that he was initially found out because of a tor compromise. If such a compromise existed, they would have had to create a parallel construction to hide the fact the compromise existed, which would had been trival once they found their target. Yes, he may have gotten sloppy, ...


6

I do not believe there are any other methods you could use that wouldn't ultimately harm the Tor network in some way. Limiting the Bandwidth, and setting an Exit Policy are the only tools that Tor provides to configure your exit. Any other policy would have to either Use some form of traffic inspection, to determine if the traffic is "malicious", for ...


4

I haven't heard about any exit node operator being convicted in child pornography charges (but my backlog on tor-relays@lists.torproject.org is huge). However, it is likely that you will get contacted, at some point, by your local Law Enforcement Agency. Here, in France, I didn't run into any trouble (of that kind) when running an exit node on my own, but I ...


2

Is there any other serious obstacle for such attacks over Tor? Many services will automatically block exit nodes, or will be more strict with detecting possible attacks from exit nodes. Even if they are not blocked now, they will be blocked in the future once an attack occurs, screwing over both the attacker and innocent Tor users. Are there known cases ...


1

Tor Network's goal is to provide anonymity and circumvention for the users in need of them. Deploying any kind of attack, is simply abusing the Tor Network. Targets of the attack, or even network providers of the targets, probably will block the exit or all Tor nodes. This would mean seriously degrading the Tor user experience, since they will not be able to ...


1

Google and Facebook run commercial services. They can block whoever they want to for whatever reason. If they wanted to block all Tor users, for no reason whatsoever, then that would be their prerogative. All the Tor community can do is to lobby them - through organisations such as the EFF - and ask them kindly not to. My question: Are you actively ...


1

One thing to consider is that if the owners of the site realise what you're doing, and see lots of requests coming from lots of different Tor exit nodes in quick succession, they may decide to block Tor traffic completely. This may have an adverse effect on other Tor users who are using the site in more legitimate ways. (Note that currently there are ~1000 ...


1

it seems to be a normal Tor usage, of course if you're not violating law or cheating by doing this


1

There are 2 kinds of malicious traffic: Traffic that is the same as 'normal' traffic, but the amount/volume makes it malicious. [D]DoS. (I don't really have an answer for this one.) Traffic that has been crafted to trigger and exploit bugs in the server software or host OS. For the 2nd kind, now that the easy semi-fix of blocking IPs doesn't work anymore,...


1

This isn't a bug in Tor, it's a feature. It doesn't reduce Tor users' security, but rather is evidence of it. If there were an update that "cured" it, it would make Tor less safe for you to use. Paul Syverson observed on tor-talk: Back in the ancient pre-Tor days, at the height of the crypto wars, Ian Goldberg asked me at Financial Crypto in 1998 why we ...


1

A couple of times, I've recieved a mail from the security staff of the VPS service where my exit relay is running, and the solution was to reduce the exit policy. For the beginning, I'd use only 80 and 443 as exits ports, and later, if no one complains, add more ports to the exit policy. Running an exit tor relay it's not as "dangerous" as it's seem :) (*...


Only top voted, non community-wiki answers of a minimum length are eligible