This article describes how French researchers compromised users using Tor. I'm not sure I fully understand or agree with it. I don't see what Bit Torrent has to do with anything? I mean they start out with a "malicious Tor exit node" so there's a lot you can do at that point. Isn't that kind of like saying "when your firewall is down your system is vulnerable".

One thing I don't understand is

BitTorrent's DHT uses the less-common UDP protocol, forcing some of the traffic to be sent in the clear.

How come data sent over UDP can't be encrypted?

  • 1
    If it's the issue I remember it's caused by torrent applications not tunneling all data through TOR, allowing an attacker to match up the data sent in the clear and through TOR. Jul 10 '12 at 19:54
  • Actually I presented this in a blog post as well, if you can setup a tor exit node, it's not really that hard to compromise people. Jul 10 '12 at 21:46
  • 2
    This is a reminder that only protocols that can run on top of just TCP and DNS can be torified. This is a reminder that it takes one data leak to bust you. This is a reminder that you shall not use Tor for huge illegal downloads, but for free speech and censorship issues. There are many hide-you-ass services for huge illegal downloads.
    – curiousguy
    Jul 11 '12 at 0:57
  • "How come data sent over UDP can't be encrypted?" who said UDP cannot be encrypted? Tor does not carry UDP packet is all.
    – curiousguy
    Jul 11 '12 at 6:16

Its talking about bittorrent clients not protecting itself properly. Also the article got this wrong the vulnerability is NOT in tor itself but the client using it.

This quote is too vague

The user's BitTorrent client then attempts to make a data connection directly to the honeypot without using Tor, thus revealing the user's IP address to the honeypot.

But the DHT part is something done over UDP which isn't protected yet the client still tries to make a connection to it. I skimmed the paper the article linked. It mentions clients connect to peers directly which sounds like nonsense or clients completely ignoring proxy settings. It then talks about analyzing traffic through tor so i believe clients do get some of it right.

A malice exit node isn't the same as turning off a firewall. Its more like visiting a site thats trying to use an exploit in your browser or phish you. The exit node adds extra peers to your connection and those peers are trying to figure out who you are. I didn't read it all so i cant break it down but thats the jist of it. Adding extra peers, hoping your client isn't implemented properly and it appears clients may leak information about other users/peers. The paper also mentions its not as easy when clients encrypt their data.

  • I still don't get why Bit Torrent is necessary. If a malicious exit node adds an IP address for a peer that will find out the ip address connecting to it, can't the malicious exit node know the ip address itself?
    – Celeritas
    Jul 10 '12 at 22:15
  • @Celeritas "I still don't get why Bit Torrent is necessary" what do you mean? Can you explain in details this attack? (maybe in chat if this is going to generate many exchanges)
    – curiousguy
    Jul 11 '12 at 3:47
  • @Celeritas: The malicious exit node can find out the IP address connecting to it, but that will just be the IP address of another Tor node. Unless that Tor node is also compromised, they cannot follow the trail back any further. Jul 11 '12 at 5:55
  • @curiousguy tor works by connecting to a 'relay'. Chooses 3 other relays and i dont know if the last relay is an exit node or not. But except for the first no one has any idea who is connecting to it. Also i believe the first doesn't know 100% if he is first. Anyways the exploit gets the IP address bc it gets the application itself to reveal the IP address via bypassing/ignoring the tor proxy. Tor also suggest browsers disable flash and other plugins bc they may ignore proxy settings as well which would reveal the users ip address.
    – user5575
    Jul 11 '12 at 6:56
  • I believe an exit node isn't required for some of the attacks. The exit node just generically see ANY bittorrent tracker data and modifies it by adding peers to the list.
    – user5575
    Jul 11 '12 at 6:56

Tor acts as a SOCKS 5 proxy and SOCKS 5 proxies can only proxy TCP data. Now DNS has similar issues so tor has a built in TCP encapsulation for DNS data, however such encapsulation is protocol dependent to work well.

Now, it is possible to do this with the DHT protocol (which one? there are two different ones). It's a lot of work and has not been done for DHT.

Now the attack works something like this:

  1. Exit node sees BitTorrent traffic for torrent with particular hash.
  2. Exit node looks up DHT for given hash and builds a list of IP addresses outside the Tor network using that torrent including the leaked data from the target client.
  3. Exit node connects to each DHT client and gets full data on which blocks each is downloading and correlates this with the original BitTorrent traffic it saw to identify the particular host.

This is the problem with any protocol that has information leakage somewhere, and a known issue tor can not do anything about. One can stop this with BitTorrent by turning off DHT, however one should not be torrenting on the tor network anyway: https://blog.torproject.org/blog/bittorrent-over-tor-isnt-good-idea.

  • yes tor + bittorrent has been bad for a long time.
    – ewanm89
    Jul 10 '12 at 23:50
  • 1
    "Tor acts as a SOCKS 5 proxy and SOCKS 5 proxies can only proxy TCP data." The fundamental reason Tor cannot tunnel UDP or IP packets is not because of a technical limitation of a particular interface of the Tor client (SOCKS), but because Tor designers preferred not to. If they wanted to tunnel IP packets, they not would not use SOCKS but a virtual network interface, as a VPN. But Tor does not tunnel packets, only octet streams and DNS exchanges.
    – curiousguy
    Jul 11 '12 at 1:02
  • there are technical reasons it was implemented as a socks 5 proxy. It's not just a preference but a technical choice.
    – ewanm89
    Jul 11 '12 at 1:18
  • Tor emulates a circuit switched network, not a packet switched network, as does TCP, this makes it easier to implement it on the basis of TCP and SOCKS not at the IP level.
    – ewanm89
    Jul 11 '12 at 1:23
  • Finally, implementing at the IP level requires hooking into the OS at the network interface level requiring root/admin privileges on most OSs. SOCKS just needs a socket entirely in userland as long as the port is not below 1023.
    – ewanm89
    Jul 11 '12 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.