HowDay ! Today we are going to see one of the most controversial Yet one important Onion Routing Popularly known as “TOR”.Tor is a non profitable Project and Hosted in torproject.com.It is popularly known for Resistance to CENSORSHIP and Anonymous Movements are deeply involved with the TOR.The Onion Routing is known for Several layers of Encrypted Traffic. Various Reports stated that Many Whisleblowers have under the impression of the tor network and transferred various strong files.
Before We get Started with all the Anonymous and Privacy Stuffs,Lets Look at the Inner Working of the TOR network.
The Tor Network Has 3 Layers.
1.Entry Node.
2. Bridge
3.Exit Node
If you are Familiar with Infosec you could have known that Alice and Bob are the 2 persons in the internet who are trying to connect with each other using tor network. When Alice sens a connection handshake the tor network routes directly to the onion network in the random direction in a encrypted manner using fingerprints(will explained in later part). It first Reaches the Entry node,Bridge and exit node. The connection from the Exit node relay to the BOB is clear un encrypted but the claim was that we know that someone is communicating to BOB but we don’t know who or where.
Setting Up TOR lab.
Requirements:.
1.Ubuntu or Debian B0x.
2. Good bandwidth (Average Bandwidth in your respective country).
i am from india since the average home connection is 2 mbps i will show how to setup Tor Relay and get Everything working.Beware running a Exit Relay will cause lot of abuse such as Bandwidth Leeching,Child Pornography,FBI on your DoorStep.So when running it in full time run it in a server away from your HOME.After All it is better to raid the server place than your Home place.
1.Install Debain/Ubuntu on Vmware or VirutalBox.
2.Start By adding Following in your sources list /etc/apt/sources.list
#TOR
deb http //deb.torproject.org/torproject.org <distroname> main
Add the PGP key .
gpg –keyserver keys.gnupg.net –recv 886DDD89
gpg –export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add
3.Sudo apt-get update.
sudo apt-get install tor tor-arm
This will Install the entire Tor Bundle and ARM which is useful when it comes to monitoring what is really going on between the relays and observing each and every traffic passing through the relays.the incoming and outbound traffic.
4. Edit the configure file /etc/tor/torric to set the Orport to 9001(default), set the nickname,contact address etc entire process is outlined here.
5. Start the Service and now the tor relay(exist is preferred in this tutorial since it was best when compared to pure studying the TOR structure.
Lets Think from Attacker Point of View.Running a Relay Exit Node always has the Various Advantages for the attacker.
SSLSTRIP:
There are Various Ways which ways which a exit node could kill the privacy. After Going through the Site Map we found that that either the exit node can be a rogue or Destination can be a decoy. i have installed SSLSTRIP in the exit Node and Able to Access outside the network using that exit node. The Firefox was able to turn HTTPS to http but the site which i accessed was a HTTPS enforce so it stopped me there with this
Sybil Attack is also one way to deanonmlyze Tor.It can be done when configuring more than one Relay Node and without Setting myfamily parameter and Re Routing the traffic from the Entry Node to the Bridge Node. such a way the path taken by the tor network was only on the newly configured relay nodes. BH 2014 Witness a cancelled talk known where the attackers were able to inject malicious signal to the protocol. This was termed when the attackers have control of the both sides nodes such as the entry as well as the exit. The Injected Nodes get HsDir And Guard Flag which is established when the signal reaches the other end of the tor layer.Relay_early was a Flag Setup back in 2008 when identifying Evil Nodes But then the attack is made more sophisticated with Sending a Encoded Message inside Relay_early Protocol when could allow the Exit node to get the handshake and assign both the consesus flag. You can have the entire Documentation on the TOR protocol Here .
The Exit Node Takes Minimum of 24 Hrs to get the full traffic and support from the Tor Network. So if you are setting up a node for research it is very important to remain Patient. The Packet Analysis During the period of 3 Hrs can be Found Here.
Conclusion:
While the TOR may Have little concerns relating to the Privacy features.it is still not good to try these techniques on the Real Users. As stated by the Freedom Press Foundation Many Whistle Blowers Network such as SecureDrop relies fully on the TOR network.
One word of caution while running tor as the exit relay be prepared to face any kind of traffic.blocking up of torrents could also be a effective way to control for new relay. I have to run further more time as Exit Relay to study it more. You may Expect a part two son.
Wall Security 