115

I came across this article saying that after the November 2015 Paris attacks, some French police officers proposed to ban Tor.

Tor is used to circumvent censorship! What security techniques would governments use to block Tor?

  • 17
    Your ISP can see traffic going through Tor as it passes through the network of your ISP, also Tor relays are often public and there is a list which can be easily checked against. See here for some infographic: eff.org/pages/tor-and-https You can use bridges to prevent this, there are non-public entry-points.. – Daniel Ruf Dec 7 '15 at 18:14
  • 4
    Sure, when you use one of the public exit nodes linked in the answer. It is best to use a VPN when using Tor and a bridge for Tor. You can find more informaion on deepdotweb.com/jolly-rogers-security-guide-for-beginners/… – Daniel Ruf Dec 7 '15 at 18:18
  • 3
    Nit-pick. Your ISP cannot tell whether you are using Tor by looking at the exit nodes. I don't know whether there is a similar list of entry nodes. – WGroleau Dec 7 '15 at 22:44
  • 1
    @AnonymousP - that is not exactly correct. An ISP (or many Countries) can easily record when a client entry-router is accessing the first TOR entry node or public & known TOR entry bridge. If there is only one computer "behind" that entry-router, then the identification is rather specific. If that entry-router is NATing a subnet of say a coffee shop, university, company, provider, or VPN, then the ISP will not know the true Source IP address. However, all providers and many VPNs, universities, and companies keep logs, can record a Source IP accessing a known TOR entry, and be subpoena'd. – cybermike Dec 8 '15 at 7:07
  • 3
    This is a political, not practical statement. It is almost impossible to really block anything, but it is necessary to make statements that make the average media consumer feel like something is being done. It is particularly funny in this case considering the mountain of evidence that shows the encryption+terrorism link is tenuous at best. In any case, it will only hurt normal citizens and they know it -- which is why it will be a half-measure at best, but a very necessary to publicize halfmeasure. Unless the government has other goals, of course... – zxq9 Dec 9 '15 at 12:41
108

In order to block Tor all that has to be done is have the current list of Tor nodes which can be found at the following link:

http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv

and then block them bidirectionally via the Routers or Firewalls.

That said there will be numerous ways around such efforts, people can still use VPN's to connect outside of a given area and then run the Tor traffic from another location or tunnel the traffic through, but this will effectively block many of the less technical people from accessing Tor.

Similarly the following list of Tor exit nodes could be useful for blocking Tor traffic from connecting to any given websites: https://check.torproject.org/exit-addresses

I would say it's easy to make Tor hard to use but that it's extremely hard to make it impossible to use.

Keep in mind that governments with large financial resources can spend money to run tools like ZMAP.io to find potential Tor servers, including Tor Bridges, minutes after they are started. Continuously scanning the entire IPv4 address space has become trivial for those with even a small budget so a campaign to find and block Tor nodes could easily be very effective, but it will never be absolute.

Finally keep in mind that once Tor users have been identified the government would likely monitor future connections by that user to locate new Tor bridges, or similar connections.

Note: The task of scanning IPv4 has become trivial but the process for scanning all of the public IPv6 address space would be radically unmanageable due to the scale. That said a large government project correlating other types of data such as netflow, some type of traffic signatures, or some other form of identification would be required to identify and block Tor traffic on IPv6 networks.

Again governments can make Tor hard to use but that it's extremely hard to make it impossible to use.

It should be further noted that governments also leverage additional tactics to identify anonymous users. To protect end users from risks related to cookies or other signatures which may give away additional information about Tor users it may be wise to use an anonymous live CD such as the following:

https://www.whonix.org/

https://tails.boum.org/

Torflow visualization may also be of interest:

https://torflow.uncharted.software

Related article: 81% of Tor Users Can be Easily Unmasked By Analyzing Router Information

http://thehackernews.com/2014/11/81-of-tor-users-can-be-easily-unmasked_18.html

Another related article about a much more dangerous but related issue: Tor Browser Exposed

https://hackernoon.com/tor-browser-exposed-anti-privacy-implantation-at-mass-scale-bd68e9eb1e95

  • 72
    I would say it's easy to make Tor hard to use but that it's extremely hard to make it impossible to use. – Trey Blalock Dec 7 '15 at 19:03
  • 15
    A side note: France might also go for the honeypot strategy by strategically setting up high-throughput exit nodes. – mınxomaτ Dec 7 '15 at 20:34
  • 9
    Blocking only exit nodes would block servers from being reachable through Tor, but it wouldn't block clients that use Tor. You'd have to block all Tor relays. – Gilles Dec 7 '15 at 20:36
  • 7
    This is wrong: having the list of exit nodes will allow websites to stop Tor from visiting them. That won't stop anyone from using Tor. To prevent people from using Tor you will need to block the entry nodes. And due to Tor bridges that is much harder. – dave Dec 7 '15 at 22:38
  • 1
    @Rathinam It would be best to seek advice from a local attorney or an expert familiar with the laws and issues in your country/city/jurisdiction. Do know that Tor is very easy to detect and it is illegal in some areas. – Trey Blalock May 24 '18 at 7:48
112

Tor is used to circumvent censorship!

No, not directly. Tor is about anonymity, not about availability. Tor alone does not help its users access blocked content. Tor helps by making it hard to link clients with site visits, so that people can publish or read content without being identified. It's used to avoid being caught in relation to banned content, not directly to spread banned content.

A government that controls all the network equipment of ISPs in the country can decide which websites and services residents are allowed to access, and can know who is accessing what. If someone is using Tor, their computer makes connections to hosts that offer Tor services (Tor relays). The ISP-level filter can detect whether the target of the connection is a Tor relay and deny it if it is.

A tool that directly helps circumvent censorship is a VPN. The ISP-level filter can block connections to a VPN, but only if it knows that the service is a VPN. Tor relays are for the most part public and have to be part of a heavy infrastructure (they have to be known from other Tor known). On the contrary, a VPN operates on its own, so it's very easy to create new ones: blocking VPN altogether is practically impossible (blocking all encrypted protocols does block most common VPN, but it's still possible to make a low-bandwidth VPN using steganography if nothing else).

VPN and Tor can of course be combined (and frequently are). An ISP can block direct use of Tor, but cannot block the use of Tor through VPNs. There even exist VPN-like services specialized to use Tor: Tor bridges. There's an arms race here where the ISP/government can block Tor bridges as they discover them, but new bridges can pop up easily.


France is going to ban Tor

No, that's not what the original article says and that's not what the THN article says either. The original article says that the police administration (not the goverment) has requested a huge array of measures of varying realism, including banning Tor. Even the article you cite claims that this request is a legislation proposal (which it isn't yet), not a law about to take effect.

37

Tor will be actually quite hard to block because of tor bridges:

Bridge relays (or "bridges" for short) are Tor relays that aren't listed in the main Tor directory. Since there is no complete public list of them, even if your ISP is filtering connections to all the known Tor relays, they probably won't be able to block all the bridges.

To ban Tor altogether, France will need to perform deep packet inspection (similar to Chinese firewall), but even such measures could be defeated by specialized tools like Obfsproxy. What effectively keeps people in China from using Tor is the threat of a prison sentence; I hope France will not go this way.

Also, I don't quite understand how banning Tor would hurt the terrorists, since there are countless options which allow them to stay under the radar. They could happily switch to OwnCloud or a similar service which cannot be blocked as a whole. Or they could communicate via GMail by sending encrypted 7zip attachments. Etc.

Keep in mind that France has just been through regional polls, and announcements like this one spawn in election time like mushrooms after a summer rain.

5

A Censorship Arms Race

Attempts to censor the Tor network have taken place in different countries. China has, thus far, been the most successful. But, other countries/governments have had successes as well. Regardless of these successes, censorship is a technological arms race and each side is continuing to make improvements on their attacks and defenses.

An excellent resource that is particularly relevant to your question is a presentation by Jacob Appelbaum and Roger Dingledine titled How Governments Have Tried to Block Tor. (This talk is also available on YouTube.) As Tor developers, they provide a quick overview of the Tor network before moving on to show the evolution of attacks against it. The attacks covered range from simple port and DNS blocking to modern techniques including deep packet inspection and active probing.

I will be summarizing the material of that presentation below before briefly addressing the future technologies that are likely to be used in this arms race.


Attacks Taking Place Now

Here is a summary of the blocking methods discussed in the presentation mentioned above, along with some additional commentary and information about the limitations of each method:

  • Block the directory authorities: the Tor binaries have a hard-coded list of IP addresses they use for bootstrapping (the process of finding other nodes on the Tor network). Normally, the Tor client will connect to one of these servers on startup to download the list of relays. Blocking this connection will prevent the exchange from taken place. The limitation is that bridges can be used to route your directory connections through an alternate IP address.
  • Download the network directory: also known as the network consensus, this is the list of all relays on the network (bridges excluded). Blocking the IP addresses of all relays will prevent the Tor client from being able to route traffic through them. Again, the limitation is that bridges can bypass this as they use IP addresses that are not published on one list.
  • Blocking bridges: if you can obtain all the bridge IP addresses, you can block connections to them as well. The Tor Project divides their pool of bridge addresses across different distribution strategies to prevent one person from obtaining all bridge addresses, even if there is a weakness in one of the distribution mechanisms. In addition to those mechanisms, you can obtain bridges by communicating with a friend or other organization who may run their own unlisted bridges.
  • Deep packet inspection: this method, also known as DPI, relys on distinguishing minute differences between the Tor protocol and the SSL/TLS handshake that Tor attempts to mimic. In the presentation, Roger mentions that there are numerous protocol distinguishers that the Tor Project is already aware of and that it is an open question whether they should be preemptively fixed or left as low-handing fruit for future attacks.
  • Block the Tor website: if people cannot download the Tor software, they cannot connect to the network. The limitation is that people can obtain software via other mechanisms, including different mirrors or by sending an email to gettor@torproject.org.
  • Active probing of bridges: in China, when someone connects to a Tor bridge or SSH server, another IP address makes a follow-up connection attempting to speak the Tor protocol.. If this attempt is successful, the original Tor connection is dropped. This is the latest step in the arms race, and there are a few possible approaches that could be used to address it. One method mentioned in the video is to password protect bridges, but that has its own trade-offs.
  • Bandwidth limitations: in Iran, the government reduced the bandwidth allocated to encrypted connections. With the rising use of encryption on websites, this method will increasingly limit access to commonly used websites including Google, Wikipedia, etc. Furthermore, as discussed below, protocols need not appear to be encrypted with the use of format transforming encryption.

The Future of the Arms Race

As was mentioned, censorship technology is an arms race, and it is still ongoing. This implies that innovations will continue to occur.

A lot of development effort has been put into pluggable transports, which are essentially a layer of protocol obfuscation that can be applied on Tor bridge nodes. This makes it more difficult to distinguish Tor traffic from non-Tor traffic and forces the blocking of additional services/protocols that are not Tor-related.

To select a few examples of pluggable transports:

  • Meek: the Meek transport uses a method called "domain fronting" to falsify the final destination of the traffic. By changing the HTTP header on a request to google.com, it becomes possible to cause Google's infrastructure to re-route your packets to their App Engine service. The same is true for Amazon's CloudFront and Microsoft's Azure platform, among others.
  • Flashproxy: started as a project at Stanford University, this project uses JavaScript and Web Sockets to turn ordinary web browsers into Tor bridges, allowing for extreme diversity and churn of bridge addresses that are difficult to block in real time.

Finally, I would like to mention format transforming encryption (FTE). This encryption technology allows one to manipulate data such that it appears like another protocol to a DPI engine. In this paper, the researchers apply the technology to the Tor network to create protocol misidentification by DPI engines.

  • I don't think you are using the term "censorship" correctly. – schroeder Dec 12 '15 at 23:31
  • @schroeder Could you explain what you think is incorrect? I'll attempt to elaborate here: There are multiple reasons one might block Tor, but they are essentially related to communication: your right to free speech and your right to read. Attempts to block Tor are often attempts to prevent circumvention of preexisting censorship and are rarely, if ever, attempts to technologically separate anonymity from speech. – Austin Hartzheim Dec 12 '15 at 23:47
  • Censorship is about content, not communication channels – schroeder Dec 13 '15 at 2:19
  • @schroeder But yet we have terms for censorship of entire mediums, including music censorship and internet censorship in general. I would also argue that the ability to censor specific content is allowable by only certain mediums. Tor itself resists partial censorship and thus must be censored as a whole. – Austin Hartzheim Dec 13 '15 at 4:03
  • Music and Internet censorship is also about the content, not the medium. – schroeder Dec 13 '15 at 5:35

protected by Rory Alsop Dec 11 '15 at 15:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.