Tor Hidden Services How Hidden is 'Hidden'?

Size: px

Start display at page:

Download "Tor Hidden Services How Hidden is 'Hidden'?"

Norah Osborne
6 years ago
Views:

1 Tor Hidden Services How Hidden is 'Hidden'? - ICTR Network Expl This information is exempt under the Freedom of Information Act 2000 {FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to GCHQ on n

Tor is an implementation of 2 nd generation onion routing Originally sponsored by the US Naval Research Laboratory Later became an Electronic Frontier Foundation project Helps to prevent network

2 Tor is an implementation of 2 nd generation onion routing Originally sponsored by the US Naval Research Laboratory Later became an Electronic Frontier Foundation project Helps to prevent network traffic analysis & surveillance Open network with over 2000 nodes Anonymity tool Uses multiple layers of encryption Multi-hop proxy Slide 2 throughout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

General Tor research HOMING TROLL - Bridge discovery capability Hidden Services Helped with a few deanonymisation techniques Worked with JTRIG & MCR (Maths & Crypt research) Provided support to OP

3 General Tor research HOMING TROLL - Bridge discovery capability Hidden Services Helped with a few deanonymisation techniques Worked with JTRIG & MCR (Maths & Crypt research) Provided support to OP SUPERIORITY 2000 and may be subject to exerrmtion under other UK information leaislation. Refer disclosure requests to GCHQ on Slide 3 throughout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

4 m TOR Copyright. All rights reserved. This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemntion under other UK information leoislation. Refer disclosure requests to GCHQ on

5 is ah Ltn S^^B Slide 5 throughout the recipient organisation, bi^^cljtgjp^^jsr^or;must ^fjffc^^jflftflvjff dissemination outside the

The Good - People living in oppressive countries (circumvent firewalls) - Access to free media instead of state propaganda - People can say what they want without it being linked to their public

6 The Good - People living in oppressive countries (circumvent firewalls) - Access to free media instead of state propaganda - People can say what they want without it being linked to their public profile The Bad - Bot herders use Tor to give instructions to their bots - Allows paedophiles access content without linking themselves to it - State actors can launch attacks without being attributable - "Anonymous" & LULZSec throughout the recipient organisation, bi^^cygpagç^s.^or; must^^t^tj^i^^r dissemination outside the

7 Any traffic between the client & tor is heavily encrypted. We can only really see traffic from an exit node to a website - But we don't know where this traffic originated from Still could link up aliases though ^^^m - 'Somebody' could still visit a dodgy forum and log in with an alias, or even send an using a known target address (Assuming they don't use SSL). ^ ^ ^ ^ ^ ^ ^ Phew... at least there is some intelligence gain... Right? throughout the recipient organisation, bi^^cygpafj^^or; must^^t^tj^i^^r dissemination outside the

8 . Hides the IP address of a web service. Protects content providers by anonymously hosting content. Publication of undesirable content. Both client and server are anonymous to an observer and to each other User Normal Tor Hidden Services Website User Website Clear text Encrypted throughout the recipient organisation, bi^^cljtgjpermis^'or; must j^j^t^tj^i^^r dissemination outside the g olluë O rti-rt-i rt ic-irt n

9 Not much... All Hidden Service traffic is heavily encrypted. Most we can gather is that one Tor node talks to another (IP level) Hiding in the crowd at its best! 2000 and may be subject to exerrmtion under other UK information leaislation. Refer disclosure requests to GCHQ on Slide 9 throughout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

What's this.onion business? - TLD Tor uses to initiate a connection to a hidden service Example onion domain w - 16 characters in base32 (few characters are actually missing) - oqznfi3tdo6nwg3f.

10 What's this.onion business? - TLD Tor uses to initiate a connection to a hidden service Example onion domain w - 16 characters in base32 (few characters are actually missing) - oqznfi3tdo6nwg3f.onion DNS? ^ ^ ^ L - Tor uses something similar to DNS to resolve an onion domain - Onion domains 'resolve' to 3+ IP addresses called Introduction Points (IPT) throughout the recipient organisation, bi^^cygpagç^s.^or; must^^t^tj^i^^r dissemination outside the

Service Introduction Point (IPT) - Hidden Service's 'front door' / relay j Rendezvous Point (RP) - Client's 'front door' /

11 Pieces of the Jig-Saw The actual Hidden Service (HS) - Where the service actually originates from User - The user who wishes to access the Hidden Service Hidden Service Directory (HSDir) - A directory server that hold information on a Hidden Service Introduction Point (IPT) - Hidden Service's 'front door' / relay j Rendezvous Point (RP) - Client's 'front door' / relay Sp&tl Slide 11 throughout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

12 1. HS selects random IPTs 2. HS uploads descriptor to HSDir 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP 6. Client contacts one IPT 7. HS replies to RP 8. RP relays between client and HS Slide 12 throu ghout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

13 1. HS selects random IPTs 2. HS uploads descriptor to HSDir 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP 6. Client contacts one IPT 7. HS replies to RP 8. RP relays between client and HS HSDir t IPT HS Slide 13 throu ghout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

14 Fitting it together 1. HS selects random IPTs 2. HS uploads descriptor to HSDir 3. Client finds out about HS Client ^nj^gr 4. Client requests descriptor from HSDir 5. Client selects a random RP 6. Client contacts one IPT HSDir IPT 7. HS replies to RP 8. RP relays between client and HS HS Slide 14 throu hout the g recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

15 Fitting it together 1. HS selects random IPTs 2. HS uploads descriptor to HSDir Client 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP IPT 6. Client contacts one IPT 7. HS replies to RP 8. RP relays between client and HS HS Slide 15 throu g hout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

16 Fitting it together 1. HS selects random IPTs 2. HS uploads descriptor to HSDir 3. Client finds out about HS Client l 3 l 4. Client requests descriptor from HSDir 5. Client selects a random RP IPT 6. Client contacts one IPT 7. HS replies to RP 8. RP relays between client and HS HS SjO 2000 and may be subject to exemdtion under other UK information leaislation. Refer disclosure requests to GCHQ on Slide 16 throu hout the g recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

17 Fitting it together 1. HS selects random IPTs 2. HS uploads descriptor to HSDir Client «HP 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP 6. Client contacts one IPT IPT RP 7. HS replies to RP 8. RP relays between client and HS HS 2000 and may be subject to expmn1"inn Iinrlpr nfhpr UK infnrmatinn Ipriklatinn Rpfpr riidrlosure requests to GCHQ on I Contains Intellectual Property ownea ana/or managea oy uwnersnip uui-ig. i ne material may be disseminated Slide 17 throu hout the 9 recipient organisation, bi^^c^@ perm:5'-/on mus^^t^tj^^l^r dissemination outside the

Fitting it together 1. HS selects random I PTs 2. HS uploads descriptor to HSDir Client HI 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP 6.

18 Fitting it together 1. HS selects random I PTs 2. HS uploads descriptor to HSDir Client HI 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP 6. Client contacts one IPT HSDir IPT 7. HS replies to RP 8. RP relays between client and HS HS 2000 and may be subject to exemdtion under other UK information leaislation. Refer disclosure requests to GCHQ on Slide 18 throu g hout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

19 1. HS selects random IPTs 2. HS uploads descriptor to HSDir Clien 3. Client finds out about HS 4. Client requests descriptor from HSDir 5. Client selects a random RP HSDir IPT RP 6. Client contacts one IPT 7. HS replies to RP 8. RP relays between client and HS HS Slide 19 throu 9 hout ^e recipient organisation, bi tj 0 l@ paj; 3{s^on must dissemination outside the omanicatinri

20 Rendezvous Point (RP) - What if we owned the RP? - Traffic still encrypted, although only a single layer of encryption - Still only content, don't know who the user is or where the HS is located - Clients randomly select their RP so unlikely to be picked anyway Hidden Service Directory (HSDir) - If we take a HSDir down, there are still many left - Could potentially collect onion domains if we acted as a HSDir Client ^ - No real way to distinguish between a Tor user accessing the web or a HS Contains Intellectual Property ownea ana/or managea Dy uwnersnip <jl.hu. i ne material may be disseminated throughout the recipient organisation, bi^^cygp^b^on musthj^jfjl^tj^flvj^r dissemination outside the

Introduction Points (IPT) - All Hidden Service IPTs are listed on its descriptor (the thing that's stored on a HSDir) - Potential for an attack on IPTs to stop them accepting connections for the HS -

21 Introduction Points (IPT) - All Hidden Service IPTs are listed on its descriptor (the thing that's stored on a HSDir) - Potential for an attack on IPTs to stop them accepting connections for the HS - This could be done using a 'Coil Attack' - Doesn't stop a HS selecting another set of IPTs - HS can encrypt their IPTs in their descriptor (but not many do) 2000 and may be subject to exerrmtion under other UK information leaislation. Refer disclosure requests to GCHQ on throughout the recipient organisation, bi^^cygpafj^^or; must^^t^tj^i^^r dissemination outside the

22 Hidden Service (HS) - What about exploiting the HS directly? - Potential to identify the IP addresses hidden services But cant really say which one - Identified a beaconing pattern from HS - Dependant on collection posture - Great for PRESTON fë* Slide 22 throughout the recipient organisation, bi^^cljtgjp^^jsr^or;must ^ f j f f c ^ ^ j f l f t f l v j f f dissemination outside the

23 2000 and may be subject to exprnntïnn unrlpr nthpr I IK infnrmat-inn Ipnklatinn Rpfpr disclosure requests to GCHQ on Slide 23 throughout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the IMWJititi ÉÉMH

24 0 0 Slide 24 throughout the recipient organisation, bi^ 0 fg paf; 9(Sjvori must l^j^t^tj^i^^r dissemination outside the

25 Tor helps people become anonymous Very naughty people use Tor Hidden Services hide the fact web content even exits! Near impossible to figure out who is talking to who Its complicated Some areas for further research Until then... Doesn't stop us from using them ) Crown Copyright. All rights reserved. This information is exempt from disclosure under the Freedom of Information Act Slide 25 throughout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

26 Questions? 2000 and may be subject to exerrmtion under other UK information leaislation. Refer disclosure requests to GCHQ on Slide 26 throu g hout the recipient organisation, bi^^cljtgjp^^jsr^or; must ^fjffc^^jflftflvjff dissemination outside the

MAT A Sek-13-5-a.pdf, Blatt 2 Outline TOR and the need for deanonymisation Data transformation Scoring Results Current status Software GCHQI

MAT A Sek-13-5-a.pdf, Blatt 1 A potential technique todeanonymise users ofthe TORnetwork OPC-MCR, GCHQ GCHQI MAT A Sek-13-5-a.pdf, Blatt 2 Outline TOR and the need for deanonymisation Data transformation