Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1.

Now, this works for me, but I have some friends who need a SOCKS proxy for similar purposes. I can't give them my SSH access, for reasons beyond my control. The only alternative I can think of (besides those china tunneling sites) is Tor, because it sets up a SOCKS5 proxy on port 9150.

However, I'm not sure how safe Tor is from snooping and other MITM attacks. I don't care about the anonymity provided by tor — we're using it for the purpose of having a tunnel, not for the anonymity.

However, I wonder how secure it is to use Tor for normal traffic. Cookies/login information probably could be stolen by a snooper, and there could be other types of MITM attacks as well. I don't understand Tor well enough to figure this out myself.

How safe is Tor from these attacks? Is there any way (connecting to a trusted node/etc) to create a relatively safe Tor proxy?

1. For example the HTTP proxy eats websocket connections, while the SOCKS proxy lets them through unmolested.

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

Tor isn't safe from man-in-the-middle attacks.

The unsafe component are the Tor exit nodes. These make the actual, unencrypted request and therefore can read and modify your traffic. Tor provides anonymity by not letting them know where the request came from, but the actual traffic between the exit node and the Internet is not different from normal traffic, as you can see in this picture (via):

enter image description here

Regarding the second question: Yes, it is technically possible to choose exit nodes. I haven't done this before, but you should be able to read up on this topic by yourself. This should allow you to (if possible) run your own exit node, or choose one that you trust.

share|improve this answer
    
"run your own exit node" won't work as these guys don't have shell access outside. But yeah, I'll look up on the rest. –  Manishearth Apr 25 '13 at 7:45
    
Probably best to assume your tor exit node is run by a TLA. There was a well publicised attack on diplomatic emails of some governments who used TOR without understanding that the exit nodes presented a vulnerability. They used POP or IMAP without SSL, relying on TOR to protect them. But the exit nodes were run by a TLA... Also see this: security.stackexchange.com/questions/31589/… –  Ben Apr 25 '13 at 14:53
add comment

Actually, Moxie Marlinspike created a tool called SSLStrip. He actually tested it on his TOR-node, and found that a lot of people didn't notice that the encryption was gone. His talk is worth a watch: Tricks on defeating SSL

//M00kaw

share|improve this answer
    
+1 for the DefCon link. Hadn't watched it before. –  Lex Apr 25 '13 at 14:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.