1

I know a little about the FBI unmasking TOR users (e.g. Freedom Hosting by javascript 0-day exploit) but presumably there are rules limiting what the Feds can do. But could a website trick you - e.g. into downloading an executable file that connects to the internet outside of TOR and gives away your ip address?

For example: Assume the user has sensible settings (Adobe flash player disabled in the TOR browser). Can the website get you to (unwittingly) download a small Flash file that sends back information directly without going through TOR?

1

But could a website trick you - e.g. into downloading an executable file that connects to the internet outside of TOR and gives away your ip address?

Technically? Of course it could. It looks like that is pretty much exactly what the FBI did in the Playpen case. If you really care, you have to make sure that there is no way for any of your traffic to not go through Tor.

There was actually a DEF CON talk in 2014 that went into this at some length. That's Zoz - Don't Fuck It Up!, which is available on Youtube. The discussion on Tor starts at 21 minutes, and several parts of it are highly relevant to your question:

  • At about 23 minutes 30 seconds, a real-life example of a traffic correlation attack based on local (in that case wireless) network traffic to Tor nodes corresponding to participating in illegal actions. That kind of attack does not require attacking Tor at all.
  • At about 24 minutes, the moral of the real-life story being don't fail unsafe with Tor. If you are doing something where you are relying on the anonymization provided by Tor, make certain that if you fail to use Tor then traffic cannot leave your computer or LAN. This includes software other than your web browser.
  • At about 27 minutes 50 seconds, the presenter starts discussing Tor deanonymization attacks. Bottom line there: even for NSA and GCHQ, at least in 2012, large-scale Tor deanonymization was not possible, but specific cases of Tor deanonymization were possible (that specific claim is made 28 minutes 30 seconds into the video).

However, the bigger question remains: Why on Earth are you downloading and running untrusted software? That's the attack vector in the case you are describing, and the fact that you are doing that over Tor is largely inconsequential. Don't run untrusted software or open untrusted documents on a trusted system.

Especially if you have reason to believe that the government has an interest in you, be extremely vigilant about what you download, install and run on your system. Force all your web traffic to use HTTPS (Tor doesn't protect your "base traffic", nor does a VPN); use NoScript with a restrictive policy; or even turn Javascript off entirely in your browser (there are plugins to make that easy) if you don't absolutely need it. Put your entire computer behind a Tor gateway, such that it cannot communicate with the outside world without going through Tor.

  • "Why on Earth are you downloading and running untrusted software?" - if you're doing it you're probably doing it because your browser did it by default. That's what the question asked. – immibis Dec 4 '16 at 21:03
  • 1
    I think in the Playpen case, its not clear/ wasn't disclosed how the information was sent from the suspect's computer back to the FBI. THe article your comment is drawn from is a misapprehension, confusing this operation with a previous FBI operation which used and required Flash ('metasploit decloaking engine') – snailmail Dec 4 '16 at 21:05
  • @snailmail is correct. It's more likely they used a JavaScript exploit or even just social engineering. – forest Jul 17 '18 at 0:27
0

But could a website trick you - e.g. into downloading an executable file that connects to the internet outside of TOR and gives away your ip address?

Yes, that's a common attack against Tor browser users. Although your browser routes all traffic through the Tor network, any application that operates outside of the browser may bypass Tor when it autonomously connects to the Internet, thus revealing your IP address. For example, this has been a well-known problem with Adobe Flash and WebRTC.

Even audio or video files you downloaded through Tor might request additional remote resources (e.g. items of a playlist, subtitles, etc.) when you play them in your local media player. Likewise, your document reader could automatically load embedded images when viewing a downloaded PDF file.

  • "Even audio or video files you downloaded through Tor .." Does that also include e.g. viewing a video on a webpage as 'downloading'? – snailmail Dec 4 '16 at 21:20
  • @snailmail If you're using the built-in HTML5 player instead of a plugin, then the traffic is routed through Tor. – Arminius Dec 4 '16 at 21:40
  • true... i more was thinking in terms of clicking on the video triggering some other sneaky action. – snailmail Dec 4 '16 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.