Interesting article on a vulnerability found in Tor

Question

This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out with a "malicious Tor exit node" so there's a lot you can do at that point. Isn't that kind of like saying "when your firewall is down your system is vulnerable".

One thing I don't understand is

BitTorrent's DHT uses the less-common UDP protocol, forcing some of the traffic to be sent in the clear.

How come data sent over UDP can't be encrypted?

Answer 1

Its talking about bittorrent clients not protecting itself properly. Also the article got this wrong the vulnerability is NOT in tor itself but the client using it.

This quote is too vague

The user's BitTorrent client then attempts to make a data connection directly to the honeypot without using Tor, thus revealing the user's IP address to the honeypot.

But the DHT part is something done over UDP which isn't protected yet the client still tries to make a connection to it. I skimmed the paper the article linked. It mentions clients connect to peers directly which sounds like nonsense or clients completely ignoring proxy settings. It then talks about analyzing traffic through tor so i believe clients do get some of it right.

A malice exit node isn't the same as turning off a firewall. Its more like visiting a site thats trying to use an exploit in your browser or phish you. The exit node adds extra peers to your connection and those peers are trying to figure out who you are. I didn't read it all so i cant break it down but thats the jist of it. Adding extra peers, hoping your client isn't implemented properly and it appears clients may leak information about other users/peers. The paper also mentions its not as easy when clients encrypt their data.

Answer 2

Tor acts as a SOCKS 5 proxy and SOCKS 5 proxies can only proxy TCP data. Now DNS has similar issues so tor has a built in TCP encapsulation for DNS data, however such encapsulation is protocol dependent to work well.

Now, it is possible to do this with the DHT protocol (which one? there are two different ones). It's a lot of work and has not been done for DHT.

Now the attack works something like this:

1. Exit node sees BitTorrent traffic for torrent with particular hash.
2. Exit node looks up DHT for given hash and builds a list of IP addresses outside the Tor network using that torrent including the leaked data from the target client.
3. Exit node connects to each DHT client and gets full data on which blocks each is downloading and correlates this with the original BitTorrent traffic it saw to identify the particular host.

This is the problem with any protocol that has information leakage somewhere, and a known issue tor can not do anything about. One can stop this with BitTorrent by turning off DHT, however one should not be torrenting on the tor network anyway: https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea.