Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does Tor have any protection against an adversary simply running a very large number of nodes?

Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If they were an organization like the NSA, they could also make the major hosting companies running nodes turn over the private keys, or install backdoors, without the "owner" of the node noticing.

I know tor employs entry guards as a protection - a client chooses a set of entry guards at random, and only ever connects to those as entry nodes. If the entry guards are uncompromised, the user is safe. This gives the user at least the chance of not being profiled; without entry guards the user would eventually be caught.

However, what if the adversary is not interested in busting all users that access a certain site, or targeting a specific user. if they just want to identify some random portion of users that access that site, couldn't they do this by running a few thousand nodes and waiting?

I can imagine they could even target specific users, and force them to use only compromised nodes. Compromise one guard node of the user (wiretap his line, observe what server he connects to and send them a court order or some thugs, or just be lucky and control the right nodes by chance). Then run thousands of modified clients. Once the targeted user goes online, flood the network momentarily. In cooperation with your compromised nodes, keep the compromised paths free, so that the client will eventually build a circuit only on your nodes. Voila, you can eavesdrop on the user.

Are there any protections against this in Tor? Can you give an estimation on how many nodes the attacker would have to run? Are there any non-technical countermeasures, e.g. would someone intervene if 3000 new suspicious nodes would pop up on AWS?

(Note this is different from other questions on this site. For example my previous question asks about the case where the attacker can completely control your line; he fakes the whole network. Tor guards against this by using a list of known good nodes, and using signatures.)

share|improve this question

2 Answers 2

Tor provides privacy only under the assumption that at least one node in the randomly selected chain is not attacker-controlled (since we are talking about traffic analysis, simply eavesdropping on traffic entering and exiting this node, without trying to decrypt it, counts as "control"). This is probabilistic. If the attacker controls, say, 50% of all nodes, and your browser uses a chain of length 5, then the attacker wins with probability 0.55 = 1/32.

To mitigate such attacks, you can configure your client to choose chains non-uniformly, but instead to enforce a "global spread" so that the chain will go through nodes in several countries who don't like each other.

share|improve this answer
2  
Unless GeoIP can be somehow faked. –  Deer Hunter Aug 30 '13 at 15:55

It doesn't, running a large number of nodes is one of the main weaknesses of TOR. It's important to choose your nodes well and to try to avoid misbehaving ones as a path routed entirely through colluding nodes is not secure and each colluding node reduces the effective security some.

Delays on transmissions would help, but would increase latency and aren't currently supported by TOR.

share|improve this answer
    
Too many statements about TOR lately have been faith based. When one of the major creators starts off what should be a statement of fact with "I believe that...", I start to worry a bit about the underlying peer review. –  Fiasco Labs Sep 1 '13 at 3:38
    
@FiascoLabs - that's always the case with Cryptography though. There are simply too many possible attack vectors. A mathematical proof of security isn't possible, so the security provided by any mechanism is always based on what we believe to be true. It seems like AES should be hard to break, but we can't know for sure that it is. In TOR however, we know of some critical weaknesses, though it's still one of the best options available for anonymity. –  AJ Henderson Sep 1 '13 at 18:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.