Academic papers on possible Tor vulns & de-cloaks

To stay ahead of new and evolving threats, cryptostorm has always looked out past standard network security tools. Here, we discuss and fine-tune our work in bringing newly-created capabilities and newly-discovered knowledge to bear as we keep cryptostorm in the forefront of tomorrow's network security landscape.
User avatar
Posts: 612
Joined: Sun Dec 16, 2012 6:34 am

Academic papers on possible Tor vulns & de-cloaks

Post by Pattern_Juggled » Sun Jul 28, 2013 4:09 pm

'Tortilla' Spices Up Active Defense Ops
New free Tor tool, due out at Black Hat USA, aims to make the Tor anonymizing network easier to use for all types of intel-gathering
Kelly Jackson Higgins | July 16, 2013 | Dark Reading

A researcher later this month at Black Hat USA will release a free tool that simplifies the use of Tor and makes it more approachable for all types of security researchers, not just malware analysts.

CrowdStrike researcher Jason Geffner says the new tool, called Tortilla, routes all TCP/IP and DNS traffic anonymously via the Tor Project's network, but unlike existing Tor tools, it operates with Windows and works with all types of browsers.

Geffner says he got the idea for Tortilla after realizing that no other Tor tools provided all of the elements he needed to anonymize his Internet access while he researched bad cyberactors. The new tool also supports Flash and other plug-ins, and doesn't require additional hardware or virtual machines, he says.

But perhaps one of the more attractive features for enterprises is that it plays nicely with Windows, which isn't traditionally the case with other Tor tools, many of which require Linux, for example, Geffner says. "It doesn't require that users work with OSes that are unfamiliar to them," he says. "One of the requirements for Tortilla was that it would require it to be as easy as possible for users to use."

It also prevents malware from circumventing the Tor tunnel, he says -- something that wily hackers can do today via the Tor's browser, the Tor Browser Bundle tool, which is based on Firefox. "While it's great in concept, the downside [with Tor Browser Bundle] is if you're visiting a website with Tor Browser Bundle and the browser gets exploited, it's possible that the exploit could use code executed in the browser to circumvent that Tor tunnel," say Geffner, who is providing only limited details on Tortilla prior to its release.

Tortilla is the latest of a series of free active defense tools becoming available in the public domain. Security experts John Strand, Paul Asadoorian, Ethan Robish, and Benjamin Donnelly offer a Linux distro set of tools called Active Defense Harbinger Distribution (ADHD) for active defense measures, including feeding the attacker phony information about the targeted network.

Active defense, not to be confused with pure "hacking back," is about frustrating, identifying, and, in some cases, physically locating the bad guys behind the keyboard. The goal is to raise the bar and make it more expensive for the attacker, and it's a constant game of one-upsmanship.

"We want to see companies start doing ... [these] nontraditional defense tactics," Strand says. "We're trying to get as much of this open source" and generate other ideas as well for it, he says.

CrowdStrike's Geffner says Tortilla was designed with security researchers in mind, including those who aren't necessarily downloading malware for analysis or communicating with command-and-control servers. "[CrowdStrike has] a large intel team that seeks to capture actionable information on ... adversaries. Some of us do very technical work, and others research the actors themselves, reading their blogs and Web forum posts," he says. "They are using Tortilla with whatever browser they like to have."

For enterprises investing in threat intel efforts, it allows their researchers to investigate malicious actors without revealing their identities, he says. "If Company XYZ gets hit and the attacker sees connections to its server with probes from Company XYZ, that's going to tip off the attacker. If the company can anonymize their research through Tor, it keeps the attacker in the dark and raises the cost to the attacker."

Geffner plans to post both the source code for Tortilla and a working executable during his July 31 presentation at Black Hat in Las Vegas.
...just a scatterbrained network topologist & crypto systems architect……… ҉҉҉

[list]✨ ✨ ✨[/list]
pj@ðëëþ.bekeybase pgpmit pgpðørkßöt-on-consolegit 'er github


Identifying Proxy Nodes in a Tor Anonymization Circuit (pdf)

Post by cryptostorm_admin » Sun Aug 04, 2013 9:08 pm

Identifying Proxy Nodes in a Tor Anonymization Circuit

Sambuddho Chakravarty
Columbia University, NY

Angelos Stavrou
George Mason University, VA

Angelos D. Keromytis
Columbia University, NY


We present a novel, practical, and effective mechanism that exposes the identity of Tor relays participating in a
given circuit. Such an attack can be used by malicious or compromised nodes to identify the rest of the circuit, or as
the first step in a follow-on trace-back attack. Our intuition is that by modulating the bandwidth of an anonymous
connection (e.g., when the destination server, its router, or an entry point is under our control), we create observable
fluctuations that propagate through the Tor network and the Internet to the end-user’s host. To that end, we em-
ploy LinkWidth, a novel bandwidth-estimation technique. LinkWidth enables network edge-attached entities to esti-
mate the available bandwidth in an arbitrary Internet link without a cooperating peer host, router, or ISP. Our ap-
proach also does not require compromise of any Tor nodes. In a series of experiments against the Tor network, we show that we can accurately identify the network location of most participating Tor relays.
(371.7 KiB) Downloaded 969 times


Trawling for Tor Hidden Services: Detection & Deanonymizatio

Post by cryptostorm_admin » Sun Aug 04, 2013 9:16 pm

Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization
2013 IEEE Symposium on Security and Privacy

Alex Biryukov, Ivan Pustogarov, Ralf-Philipp Weinmann
University of Luxembourg


Tor is the most popular volunteer-based anonymity network consisting of over 3000 volunteer-operated relays. Apart from making connections to servers hard to trace to their origin it can also provide receiver privacy for Internet services through a feature called “hidden services”.

In this paper we expose flaws both in the design and implementation of Tor’s hidden services that allow an attacker to measure the popularity of arbitrary hidden services, take down hidden services and deanonymize hidden services. We give a practical evaluation of our techniques by studying: (1) a recent case of a botnet using Tor hidden services for command and control channels; (2) Silk Road, a hidden service used to sell drugs and other contraband; (3) the the hidden service of the DuckDuckGo search engine.

Tor; anonymity network; privacy; hidden services
(469.54 KiB) Downloaded 1522 times


Characterization of Tor Exit-Nodes (pdf)

Post by cryptostorm_team » Sun Aug 04, 2013 9:21 pm

Characterization of Tor Exit-Nodes
Alexander Schaap
University of Twente
P.O. Box 217, 7500AE Enschede
The Netherlands


Tor is popular open-source software that provides anonymity to its users. However, it is possible to monitor plain-text trac coming from exit-nodes. Additionally, when one has control over an exit-node, many attacks exist to expose the original source of the trac, negating the users' anonymity. This allows for potentially disastrous consequences. Yet no work specically about Tor exit-nodes has been published. In this work, we present a characterization of Tor exit-nodes, in which the following questions will be examined: Who provides exit nodes? Where are they located? And are these nodes used for malicious activities? The results indicate that there are many countries in which exit-nodes are located and many organizations to whom the IP addresses belong. The malicious activity detected from these exit-nodes is low.
(376.99 KiB) Downloaded 1022 times

Posts: 1
Joined: Fri Apr 17, 2015 8:42 am

Re: Academic papers on possible Tor vulns & de-cloaks

Post by group » Fri Apr 17, 2015 8:57 am

We present fast and cheap attacks that reveal the location of a hidden server. Using a single hostile Tor node we have located deployed hidden servers in a matter of minutes. Although we examine hidden services over Tor, our results apply to any client us-
ing a variety of anonymity networks. In fact, these are the first actual intersection attacks on any deployed public network: thus confirming general expectations from prior theory and simulation.????