4

So an interesting thought popped into my head as I was thinking over the Cryptowall malware. If you don't already know, Cryptowall utilizes the Tor service to make the back-end service it uses untraceable.

While thinking over this, I thought of one of the few attacks Tor is susceptible to, the Man in the Middle attack. This got me thinking what if you could rig the jumps to where you have control of the exit node?

So, Tor has a public list of nodes stating what nodes are available for a client to route through and which are exit nodes. So let's say I spoof my default DNS/IP to redirect to to my own list of nodes within my own network (As Tor is open sourced one could reverse engineer the request format).

Make a few assumptions here such as, There is only one node configured as an exit, and only the exit node has internet access. (Just to make the spoofing easier)

My question is, could one, using a similar method as above,essentially redirect and control Tor traffic from an UNMODIFIED Tor Client in a network by providing spoofed nodes, and then perform a Man in the Middle attack on the exit node, and monitor the traffic of say the Tor Browser or something else sending data over Tor?

NOTE: If I got something wrong, an you feel tempted to push that pretty little red down-vote button, at the very least add something to the comments about why you did so. I would appreciate it.

Improve this question
2
  • 1
    Are you thinking this would be of use to law enforcement?
    – Neil Smithline
    Jan 30, 2016 at 5:01
  • That could be one use. Other's I was thinking of was an effective way to cancel out Tor at schools and businesses. But mostly, seeing exactly what data malware could be sending over it.
    – Lektonic
    Jan 30, 2016 at 5:04

1 Answer 1

Reset to default
3

The list of nodes provided by the authorities is signed by all 8 authorities, the public keys of which are embedded in the tor client.

You could prevent the client from booting, but it won't accept your list of nodes.

(https://www.torproject.org/docs/faq#KeyManagement) :

Coordination: How do clients know what the relays are, and how do they know that they have the right keys for them? Each relay has a long-term public signing key called the "identity key". Each directory authority additionally has a "directory signing key". The directory authorities provide a signed list of all the known relays, and in that list are a set of certificates from each relay (self-signed by their identity key) specifying their keys, locations, exit policies, and so on. So unless the adversary can control a majority of the directory authorities (as of 2012 there are 8 directory authorities), he can't trick the Tor client into using other Tor relays.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .