On 19/10/2012 04:12, Lee Whitney wrote:
I was reading a paper on discovering hidden service locations, and couldn't find any reason it shouldn't work in principle.
However being that I'm a Tor novice, I wanted ask here.
In a nutshell they propose throwing some modified Tor nodes out there that modify the protocol enough to track down the location. It does take some time, but it doesn't seem like years.
My experience is that there s already an easy method of identifying Tor hidden service nodes and this takes little time to do. Let me explain why I come to that opinion. Having a static IP net connection, I set up a test web site as a Tor service on a Tor middleman server. That server had been a middleman server for about a year, no problems, no attempts to hack it in all that time. Within 24hrs of making that Tor hidden service live I could see, in my firewall logs, hundreds of repeated attempts trying to hack my server, directly from the internet, not via my hidden Tot service. All were attempting to access various types of services/permissions which were mainly focused on attempting to gain control of a "web page server". All attacks were from US based places of higher education (colleges and universities), most from establishments where Tor servers were situated but not from Tor servers themselves. Now bearing in mind that I had only EVER requested 1 web page (a blank test page - requested about 4 times) from my own Torrified web browser (out and back so to speak), and no OTHER (external) page requests were EVER received via the Tor hidden service, as shown by its log. Then someone must have been able to immediately see the service enter and track its source, who then attempted to hack the web server itself and it appeared to be a group of about 3 or 4 persons, each trying different attack strategy over a 12 hour period. Hundreds of commands were sent, many in quick succession as if they were in some sort of script file, but some were live, at one point I even watched them live as they were coming in as I countered their hack attempts. As a result of this I did some serious thinking about Tor and came to the conclusion that someone out there and I believe it is THE global adversary (USA mil/sec) is able see with perfect transparency all Tor traffic. Consider.: Most Tor users see the Tor connections as merely a set of 3 or 4 connected nodes over which their traffic is routed, e.g. Tor1 - US, Tor 2 - Germany, Tor 3 France - EXIT. But in reality then internet is not like that, this is only the UPPER structure level. At the lower level the packets are routed over many dozens of sub-nodes, these nodes are invisible to the Tor map of your traffic. You can find out this info yourself if you wish to test out a single ROUTE to another IP address just by doing a traceroute url (tracert url for windows) command from a command line prompt window. As you will see this is about a dozen hops to the average local url. But this is not the end of the problem, as some hops are hidden and they report only a virtual hop back to you. e.g. lets say a node is in a server in an IBM/US telecoms company based in France, then that server will almost certainly be routing ALL its traffic through the USA and back to itself (or another node in the same company) before sending it on to the next external node. This diversion is NEVER reported as ONLY a single "virtual node ip" is quoted. The only way you can ever tell its been done is by looking at the time delay, however this is also often difficult/impossible to spot because these routes are often the fastest on the internet. OK - I know this goes on for certain because there are internal tools used within these companies to trace the TRUE route and I have seen such servers send their traffic in this manner 24/7 - 365. Having discussed this as "wasted effort" with a network engineer I was told there is a "payment" made somewhere to compensate. At the same time all of this is camouflaged in apparently nice and legitimate reasons for it being that way, but when you pull it apart you see the lie, but you can't PROVE it. As about 70% of Europe's internet traffic passes through an IBM/US telco's servers then it almost certain that in any one of these Tor node to Tor node connections there is at least one sub-nodes that passes the traffic through the USA, who is the global adversary using Total Traffic Timing Tracking. You should be able to work the rest out for yourself.
Any comment appreciated, here's a link to the paper:
http://www.cs.uml.edu/~xinwenfu/paper/HiddenServer.pdf
_______________________________________________ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
_______________________________________________ tor-talk mailing list tor-talk@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE