Tor: a quick overview (How Twitter can help) Jacob Appelbaum The - - PowerPoint PPT Presentation

▶
tor a quick overview how twitter can help
SMART_READER_LITE
LIVE PREVIEW

Tor: a quick overview (How Twitter can help) Jacob Appelbaum The - - PowerPoint PPT Presentation

Nov 02, 2022 260 likes •681 views

Tor: a quick overview (How Twitter can help) Jacob Appelbaum The Tor Project https://www.torproject.org/ 1 About me: Free software hacker (libmsr, blockfinder, etc) General human and other animal rights activist Founder of

slide-1
SLIDE 1

1

Tor: a quick overview (How Twitter can help)

Jacob Appelbaum The Tor Project https://www.torproject.org/

slide-2
SLIDE 2

2

About me:

  • Free software hacker (libmsr, blockfinder, etc)
  • General human and other animal rights activist
  • Founder of Noisebridge
  • Cold Boot Attack
  • MD5 Considered Harmful Now: Constructing a

Rogue CA Certificate

  • Cult of the Dead Cow member
  • Chaos Computer Club supporter
  • EFF supporter
  • Tor Project Developer
slide-3
SLIDE 3

3

Tor: Big Picture

  • Freely available (Open Source), unencumbered.
  • Comes with a spec and full documentation:

Dresden, Aachen, Yale groups implemented their

  • wn compatible Java Tor clients; researchers use it

to study anonymity.

  • 2000 active relays, 250,000+ active users, >3Gbit/s.
  • Official US 501(c)(3) nonprofit. Seven funded

developers, dozens more dedicated volunteers.

  • Funding from U.S. Naval Research Lab, Electronic

Frontier Foundation, Voice of America, Human Rights Watch, NLnet, Google, ...you?

slide-4
SLIDE 4

4

Who uses Tor?

  • Normal people use Tor
  • Bloggers use Tor
  • Militaries use Tor
  • Journalists and their audience use Tor
  • Law enforcement officers use Tor
  • IT professionals use Tor
  • Activists and whistleblowers use Tor
  • High and low profile people use Tor
  • Business executives use Tor
slide-5
SLIDE 5

5

Anonymity isn't just wishful thinking...

“You can't prove it was me!” “Promise you won't look!” “Promise you won't remember!” “Promise you won't tell!” “I didn't write my name on it!” “Isn't the Internet already anonymous?”

slide-6
SLIDE 6

6

Anonymity serves different interests for different user groups.

Anonymity

Private citizens “It's privacy!”

slide-7
SLIDE 7

7

Anonymity serves different interests for different user groups.

Anonymity

Private citizens Businesses “It's network security!” “It's privacy!”

slide-8
SLIDE 8

8

Anonymity serves different interests for different user groups.

Anonymity

Private citizens Governments Businesses “It's traffic-analysis resistance!” “It's network security!” “It's privacy!”

slide-9
SLIDE 9

9

Anonymity serves different interests for different user groups.

Anonymity

Private citizens Governments Businesses “It's traffic-analysis resistance!” “It's network security!” “It's privacy!” Blocked users “It's reachability!”

slide-10
SLIDE 10

10

Threat model: what can the attacker do?

Alice Anonymity network Bob watch (or be!) Bob! watch Alice! Control part of the network!

slide-11
SLIDE 11

11

Anonymity isn't cryptography: Cryptography just protects contents.

Alice Bob “Hi, Bob!” “Hi, Bob!” <gibberish> attacker

slide-12
SLIDE 12

12

Regular citizens don't want to be watched and tracked.

(the network can track too)

Hostile Bob Incompetent Bob Indifferent Bob

“Oops, I lost the logs.” “I sell the logs.” “Hey, they aren't my secrets.” Name, address, age, friends, interests (medical, financial, etc), unpopular opinions, illegal opinions.... Blogger Alice 8-year-old Alice Sick Alice Consumer Alice Oppressed Alice ....

slide-13
SLIDE 13

13

Businesses need to keep trade secrets.

AliceCorp Competitor Competitor Compromised network “Oh, your employees are reading

  • ur patents/jobs page/product sheets?”

“Hey, it's Alice! Give her the 'Alice' version!” “Wanna buy a list of Alice's suppliers? What about her customers? What about her engineering department's favorite search terms?”

slide-14
SLIDE 14

14

Law enforcement needs anonymity to get the job done.

Officer Alice Investigated suspect Sting target Anonymous tips “Why is alice.localpolice.gov reading my website?” “Why no, alice.localpolice.gov! I would never sell counterfeits on ebay!” Witness/informer Alice “Is my family safe if I go after these guys?” Organized Crime “Are they really going to ensure my anonymity?”

slide-15
SLIDE 15

15

Governments need anonymity for their security

Coalition member Alice Shared network Defense in Depth Untrusted ISP “Do I really want to reveal my internal network topology?” “What about insiders?” Agent Alice “What does FBI Google for?” Compromised service “What will you bid for a list of Baghdad IP addresses that get email from .gov?” “Somebody in that hotel room just checked his Navy.mil mail!”

slide-16
SLIDE 16

16

You can't get anonymity on your own: private solutions are ineffective...

Officer Alice Investigated suspect ... AliceCorp Competitor Citizen Alice AliceCorp anonymity net Municipal anonymity net Alice's small anonymity net “Looks like a cop.” “It's somebody at AliceCorp!” “One of the 25 users

  • n AliceNet.”
slide-17
SLIDE 17

17

... so, anonymity loves company!

Officer Alice Investigated suspect ... AliceCorp Competitor Citizen Alice Shared anonymity net “???” “???” “???”

slide-18
SLIDE 18

18

Yes, bad people need anonymity too. But they are already doing well.

Evil Criminal Alice Stolen mobile phones Compromised botnet Open wireless nets .....

slide-19
SLIDE 19

19

Current situation: Bad people on the Internet are doing fine

Trojans Viruses Exploits Phishing Spam Botnets Zombies Espionage DDoS Extortion

slide-20
SLIDE 20

20

The simplest designs use a single relay to hide connections.

Bob2 Bob1 Bob3 Alice2 Alice1 Alice3 Relay E(Bob3,“X”) E(Bob1, “Y”) E ( B

  • b

2 , “ Z ” ) “Y” “Z” “X”

(example: some commercial proxy providers)

slide-21
SLIDE 21

21

But a single relay (or eavesdropper!) is a single point of failure.

Bob2 Bob1 Bob3 Alice2 Alice1 Alice3 Evil Relay E(Bob3,“X”) E(Bob1, “Y”) E ( B

  • b

2 , “ Z ” ) “Y” “Z” “X”

slide-22
SLIDE 22

22

... or a single point of bypass.

Bob2 Bob1 Bob3 Alice2 Alice1 Alice3 Irrelevant Relay E(Bob3,“X”) E(Bob1, “Y”) E ( B

  • b

2 , “ Z ” ) “Y” “Z” “X”

Timing analysis bridges all connections through relay ⇒ An attractive fat target

slide-23
SLIDE 23

23

So, add multiple relays so that no single one can betray Alice.

Bob Alice R1 R2 R3 R4 R5

slide-24
SLIDE 24

24

A corrupt first hop can tell that Alice is talking, but not to whom.

Bob Alice R1 R2 R3 R4 R5

slide-25
SLIDE 25

25

A corrupt final hop can tell that somebody is talking to Bob, but not who.

Bob Alice R1 R2 R3 R4 R5

slide-26
SLIDE 26

26

Alice makes a session key with R1 ...And then tunnels to R2...and to R3

Bob Alice R1 R2 R3 R4 R5 Bob2

slide-27
SLIDE 27

27

We're into Privacy by Design!

  • Isolate PII information

– Reduces liability

  • Separation of roles

– Reduces vulnerability

  • Discourage logging
  • Discourage privacy by policy
  • Anonymity is an important component of privacy

– Circumvention generally requires confidentiality – Reduce liability and discovery for helpers

(bridges, middle relays, etc)

slide-28
SLIDE 28

28

The basic Tor design uses a simple centralized directory protocol.

S2 S1 Alice Trusted directory Trusted directory S3 cache cache Servers publish self-signed descriptors. Authorities publish a consensus list of all descriptors Alice downloads consensus and descriptors from anywhere

slide-29
SLIDE 29

29

slide-30
SLIDE 30

30

Many firewalls block the Tor website (email resistance)

slide-31
SLIDE 31

31

Governments and other firewalls can just block the whole Tor network.

Alice Alice S S S S X X

(China and Iran do this today)

slide-32
SLIDE 32

32

slide-33
SLIDE 33

33

slide-34
SLIDE 34

34

slide-35
SLIDE 35

35 R4 R2 R1 R3 Bob Alice Alice Alice Alice Alice Blocked User Blocked User Blocked User Blocked User Blocked User Alice Alice Alice Alice Alice Alice Alice Alice Alice Alice

slide-36
SLIDE 36

36

How do you find a bridge?

  • If you can, go to

https://bridges.torproject.org/ and it will tell you a few based on time and your IP address

  • Mail bridges@torproject.org from a

gmail/yahoo address, and we'll send you a few

  • From your friends, neighbors, and Twitter

like before

– Other private bridges

slide-37
SLIDE 37

37

Others simply discriminate by protocol matching (or mismatching)

Alice Alice S S S S X X

Is there a solution for a “whitelisted” Internet?

slide-38
SLIDE 38

38

Twitter and Tor

  • Lack of proper SSL support (for mobile too)

– redirects to plain-text site – no SSL (secure link only bit) cookies – Unauthenticated (JS) content is loaded too – Incorrect host names in certificates

  • Changing passwords doesn't change OAuth token

– Why isn't this done via POST?

  • Your captcha is broken (See Jonathan Wilkin's

research)

  • Blocked in many areas because you're useful!
slide-39
SLIDE 39

39

How can you help?

  • The Tor network needs bridges

– Anyone can run one – no real liability

  • The Tor network needs relays

– A middle node sends only encrypted data – Exit nodes are tricky but very important – Exit Enclaves are needed

  • tor.twitter.com could exit to itself

– Hidden service login for Twitter users?

  • Ideas, research, feedback?
slide-40
SLIDE 40

40

Questions?