6

If an attacker manages to infect my router with malware and sets up an entry node, can they force my computer to connect to their entry node?

If my computer does connect to their entry node, can they modify traffic before it is passed on to the rest of the network?

Also, if I were to use Tor over mobile broadband and an attacker had set up a femtocell or rogue cell tower, would they be able to do any of the same mentioned above? Would it be more or less secure to use Tor over mobile broadband?

1
  • 2
    Tor prevents any middle man to modify your Tor traffic. It doesn't matter where he is sitting at.
    – defalt
    Commented Dec 14, 2017 at 4:28

1 Answer 1

4

I'm reading this as Can an active attacker on my network force me to use their guard?.

No. Tor has hardcoded in it a list of trusted relays called Directory Authorities. These relays release a signed list of Tor network metadata called the consensus, which contains such things as relay identities. Because the list is signed, and because the source is hardcoded in the Tor binary, your client will only connect to valid relays. But let's say they did create a valid relay. They still couldn't force you to connect to it, as your client picks a relay randomly and pins it. This makes it extremely difficult for an attacker to force you to connect to another relay.

An attack exists where someone runs a denial of service attack on a guard you use, in hopes that you will then choose their guard. This is called a path bias attack. Fortunately, this attack is woefully ineffective on guard nodes, as the Tor process will warn you if this is occurring too often.

Additionally, an attacker could not MITM the connection, as the Tor protocol specifies SHA-256 for an HMAC. This ensures that messages cannot be changed en route to their destination. Tor provides a guarantee that, starting at your computer and ending at the exit, traffic cannot be read or modified.

See also How does Tor protect against fake entry nodes / total redirection?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .