For example, if I go to google.com can they send back fakegoogle.com?


An exit node (no matter if Tor or VPN) has full control what data are sent and where they get sent to. This means it can modify the data from client to server, from server to client or send the data from the client to a different server. If you want to protect yourself against this then you should use end-to-end encryption and authentication, i.e. HTTPS.

  • Even with HTTPS the webserver's address is still in plain text right ? Then can they modify it too ? – IT-Fan Apr 1 '18 at 12:53
  • @IT-Fan: While the attacker at the exit node could modify the bytes of HTTPS traffic the transmitted data are protected so that such modifications will be detected by client and server and the connection will be aborted. This includes modifications at the TLS handshake, like changing the the server name given in the ClientHello. – Steffen Ullrich Apr 1 '18 at 14:17
  • 1
    If they modify the domain name in an HTTPS request, you'll get a Your connection is not secure warning. – Neil Smithline Apr 1 '18 at 14:49
  • 1
    @NeilSmithline: If just the server_name extension in the TLS handshake is changed then the handshake will fail since the modification is detected. If the attacker instead does real TLS interception by being a TLS server to the client and a TLS client to the server then the client will detect that the certificate from the new server (i.e. the attacker) is either untrusted or the subject does not match the URL which will both result in a warning in the browser. In any case - fiddling with HTTPS will be detected while fiddling with plain HTTP will not. – Steffen Ullrich Apr 1 '18 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.