Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After I read this link, I tried to understand how they manage detect TOR traffic

The most understandable source for me was this paper

He is saying TOR trafic can be detected by port, cipher suite length , extensions and validity duration of certificate can be use. I tried to implement that and I saw TOR corrected all their weaknesses which are pointed in the document.

According to my experiences it is not possible to detect TOR users in network, but how are companies able to detect TOR? I am extremely curious. Does TOR have any TLS abnormalities?

share|improve this question
2  
Our company uses what it calls 'Next Gen Firewalls' which do DPI and 'know' the signature of TOR traffic as well as maintaining a list of TOR end-points. As a result, i've never been able to get TOR traffic through it no matter what options i use. –  NULLZ May 22 '13 at 8:12
    
@D3C4FF Even with obfsproxy? –  Adnan May 22 '13 at 8:49
    
@Adnan obfsproxy = bridges? Then yes. That gets blocked as well. –  NULLZ May 22 '13 at 9:04
    
@D3C4FF do you have any idea have to get list f TOR end-points –  Kadir Erdem Demir Jun 18 '13 at 8:09
    
@KadirErdemDemir what? I don't understand. –  NULLZ Jun 18 '13 at 9:22
show 1 more comment

1 Answer

Blocking TOR at a network level is difficult, and anyone trying to do so will face a constant battle with the TOR developers. It's similar to the red queen effect between malware developers and AV researchers; every time an improved technique comes out to block TOR the developers will change the way it works.

I see TOR use as more of an endpoint control issue, and a user behavior issue rather than a network blocking issue. If you want to stop TOR then prevent it from being installed, and let users know the penalties for using it (providing you have an applicable AUP which says so).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.