In the wake of the PRISM revelations, the question of internet communication privacy has come to the fore. Many are looking toward the Tor Project for anonymity. Tor protects against network surveillance and traffic analysis.
The Tor network has to date had about 36 million users. In the UK alone, there are 15,000 users every day. It has been popular amongst political activists such as in Iran and Egypt. Whistleblowers wanting to remain incognito, the military wanting to prevent eavesdropping, and journalists for their safety, all use Tor. NSA whistleblower Edward Snowden used Tor in his communications with the Guardian and Washington Post. Now, there are an increasing number of businesses wanting to keep proprietary information secret, as well as individuals who simply value their privacy.
There are some dark alleys in the Tor network. Criminals use the network as their gateway to the Silk Road marketplace for illegal drugs and weapons. Paedophile networks use it to hide illicit activities. Ananalysis of 25,000 Tor websites found that over half (51%) deal with cybercrime and hacking, 17% are political, 4% are porno/pedo. These hacking websites include malicious code sales, hacking services, DDoS services, exploit writing services and sales. The number of Tor sites accepting Bitcoin has escalated considerably in recent months – it is used as an anonymous currency on an anonymous network.
How does Tor maintain anonymity? Consider the problem of person A wanting to remain anonymous when sending a message to person B. Person A can write the message on a piece of paper, seal it in an envelope, then seal that envelope in a second and then again in a third envelope. Person A then sends the package to person C, who sends it to D, who sends it to E. At each stage, each person is only able to open the outer envelope before passing it on – like pealing off the outer layer of an onion. Intermediate persons C and D do not know who gave them the package, or what it contains, or where it is going to. Finally, E opens the last envelope and delivers the message to its destination – person B, who does not know who sent it originally.
Tor was originally developed for the US Navy. The name Tor stems from the acronym of “The Onion Router” as it employs a process of triple-encrypting messages. An internet message is routed through three Tor nodes (proxies), each of which removes the top layer of encryption, like the layers of an onion. As the message travels through the Tor network, the contents of the message as well as its origin and final destination, remain hidden to the intermediate nodes. The three Tor nodes through which a message passes are chosen at random so that the path through the Tor network does not shed light on its origin.
The third and final Tor node is the exit node. The destination site of the message is only able to identify this exit node, and not the intermediary nodes or the IP address of the message originator. To the destination site, it appears the message originator is the exit node. In this way, Tor thus retains the secrecy of the IP address of the message originator, and the identity of the original message sender is kept anonymous.
On http sites, the message delivered to the destination site is revealed to the exit node. If the destination site employs https encryption, the message contents are hidden even from the exit node.
A further aspect of the Tor network is hidden services which enables a Tor website to hide its IP address. Hidden servers are those configured to receive traffic through Tor. Traffic to the server is directed to its onion address rather than its IP address. Tor hidden servers protect the anonymity of server hosts. However, there are vulnerabilities in hidden services whereby IP addresses can be revealed.
There are over 3,000 Tor exit nodes. It is likely that many of these are controlled by governments. Web servers can be configured to block users from Tor exit nodes.
IT security expert Bruce Schneier recently encouraged his readers to operate Tor nodes as a “goodness for the world”. I would agree, but I caution readers to only operate intermediary nodes and not exit nodes. Exit nodes are seen by websites as the originator, and operators of exit nodes can expect visits from police authorities enquiring about traffic in child pornography and the purchase of drugs and weapons.
Can you trust the privacy of Tor? There are some privacy vulnerabilities. BitTorrent users can have their IP addresses revealed. For best results, use the Tor browser, which is Firefox-based. It is easy to setup and can be downloaded from here. To maximise privacy, retain all default settings and do not permit JavaScript or any other browser extension such as Adobe Flash or Adobe Reader. Privacy is also increased on https encrypted sites, as this shields the message content even from the exit node. Used in this way, even governments have recently admitted they have difficulty identifying Tor users. However, use of Tor is likely to itself trigger the attention of agencies such as the NSA.
No comments:
Post a Comment