Skip to main content
Share Your Experience: Take the 2024 Developer Survey
3 votes
Accepted

What prevents directory server from being attacked?

What prevents a directory server from being dishonest and give malicious data to the user? The information served by the directories is generated by reaching a consensus between the authorities. You ...
Peter Gerber's user avatar
  • 1,342
3 votes

Does facebook's hidden service url mean that collisions are feasible?

No, and yes. Facebook, hidden services, and https certs had talked on this. Facebook in fact brute forced only the first 40 bits and then made a backronym. Their hidden service name is "...
nobody's user avatar
  • 725
2 votes
Accepted

List of attacks on Tor

I don't think anyone will do your research for you but here are some links with a lot of good information. Paul Syverson's home page Roger Dingledine's home page 2012 Tor Specification Selected ...
elmerjfudd's user avatar
  • 2,274
2 votes

Whonix Workstation Country Code

Packets won't carry your local time information, application data will though. You probably want to make your timezone UTC since this is the most "generic" timezone and the easiest to calculate your ...
cacahuatl's user avatar
  • 11k
2 votes

Are low bandwidth DoS attacks performed over the Tor network a problem to be considered?

Is there any other serious obstacle for such attacks over Tor? Many services will automatically block exit nodes, or will be more strict with detecting possible attacks from exit nodes. Even if they ...
forest's user avatar
  • 21
2 votes

Tor safe when taking future in to account?

Quantum threat is a real thing, especially in context of Shor's algorithm for a possible attack vector, for example. But there're a lot of quantum-resistant things like LWE and some EC's, so - using a ...
Alexey Vesnin's user avatar
  • 6,225
2 votes
Accepted

Can Tor connection be intercepted/tampered by exit nodes?

Yes, the exit node can inspect and tamper with the TCP traffic as it leaves the network. It's impossible for Tor to provide integrity for this traffic. You should always use secure protocols like TLS/...
Steve's user avatar
  • 3,142
1 vote

Tor 100% CPU usage - DoS attack

First, I highly recommend upgrading your Tor version as it no longer receives bug fixes or security patches (or new v3 onion addresses). If you're running Debian or Ubuntu, you can check if your ...
Steve's user avatar
  • 3,142
1 vote

How can Tor users and Tor Network protect themselves from an exit node that is actively logging or manipulating exit traffic?

There is procedure in Tor for reporting bad relays: https://trac.torproject.org/projects/tor/wiki/doc/ReportingBadRelays Send email to address [email protected] and describe the ...
Suncatcher's user avatar
1 vote
Accepted

Is Tor traffic using the TAP handshake vulnerable to retroactive decryption?

To answer my own question after rereading the spec, it is not. There are two things that make it difficult to attack broken DH groups in the old TAP protocol: the RSA hybrid handshake, and link ...
forest's user avatar
  • 225
1 vote

I got effected by GANDCRAB ransomeware and all my files & documents got encrypted and .WRCOR file extension got added orginal file name

Check out https://www.nomoreransom.org, maybe there's no way to pay anything. BDGandCrabDecryptTool Decryptor is designed to decrypt files encrypted by GandCrab (includes v5 Syrian victims) Ransom.
Debtor's user avatar
  • 11
1 vote

Protect against pseudonymous identity activity on a forum and traffic correlation?

Assuming the observer is watching all the traffic from your computer and also that specific server, I think your best bet to help mask your activity is to make sure you use Tor for more than just ...
BHydden's user avatar
  • 83
1 vote

Why does TOR not intentionally choose nodes from different countries?

Tor relays ARE chosen from random different countries. You are correct that the relays are chosen at random; tor uses three relays for every connection - the guard (node 1), middle (node 2), exit (...
theoneandonnly's user avatar
1 vote

Are the LinkWidth attacks still a threat?

Yes, it's possible for attacks of that kind to succeed. No, it doesn't seem to be currently practical. As of around 2011 (3 years after this paper was published) even the NSA was reporting difficulty ...
cacahuatl's user avatar
  • 11k
1 vote

Stopping a DDoS attack on Tor daemon

As mentioned by the kind comment I realised Tor on my Whonix Gateway was out of date when talking to some people in IRC. I deleted the Gateway and reinstalled with the newest version of Tor to remove ...
private's user avatar
  • 11
1 vote

How can one avoid Tor correlation attacks?

As boring as it may sound, I think the most you can do is to use as much default torrc settings as possible. Don't manually pick relays for example. Oh, and use TorBrowser instead of setting up ...
merge's user avatar
  • 66
1 vote

public key not found

You should read the Tor Project website on it's sigining keys, where it clearly states: Roger Dingledine (0x28988BF5 and 0x19F78451) or Nick Mathewson (0xFE43009C4607B1FB with signing key ...
cacahuatl's user avatar
  • 11k
1 vote
Accepted

public key not found

Well, it seems that it is signed by a different key from Tor developers keys - they should defenately update the scripts and manuals! It seems to be fixed: root@orangepipc:/usr/work# gpg --verify tor-...
Alexey Vesnin's user avatar
  • 6,225
1 vote

Why do entry nodes not know the originator?

It could certainly reason about it, as you stated, by checking a list of Tor relays and checking to see if the originator was a known Tor relay or not but it can't be certain of it. False negative: A ...
cacahuatl's user avatar
  • 11k
1 vote

Was I attacked or my identity found out?

It's a captcha glitch, quite a common one. It's OK - some sites are using overreaching protection, it does backfire like that even without using Tor. Tor Browser and Chrome by themselves are two ...
Alexey Vesnin's user avatar
  • 6,225
1 vote

Malicious Exit Nodes in network sensor

These aren't scanning your ports, these are your connections to the Tor network. This is your Pi recording that it is connecting to them. I think this should serve as an example of why blacklisting, ...
cacahuatl's user avatar
  • 11k
1 vote

List of attacks that try to trick browser to not use SOCKS/Tor

adding to the types you've mentioned there're two other kinds of them: Zero-Day exploits Tor browser is a Firefox by roots, so some Firefox zero-day exploits are affecting it too. It's OK for any ...
Alexey Vesnin's user avatar
  • 6,225
1 vote

Is there a way to defend oneself against a timing attack?

Based on this paper (which was written in 2015 so it may be a bit outdated), the suggested mitigations to thwart a traffic analysis neural network given the most useful parameters (duration of access ...
belkarx's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible