Latest / CyberPodcast / What Tor Hidden Services Really Host | Paper Breakdown #7 | CyberPodcast

Transcript

What Tor Hidden Services Really Host | Paper Breakdown #7 | CyberPodcast · CyberPodcast

• 0:00
  Welcome to this explainer. Today we're diving straight into
• 0:03
  the technical architecture of Tor hidden services, and we're
• 0:06
  going to uncover exactly how researchers managed to map a
• 0:08
  network that was intentionally designed to be completely
• 0:11
  invisible. We'll be breaking down the
• 0:13
  complex underlying mechanics that make this anonymity
• 0:16
  possible, and then we'll explore the fascinating and honestly
• 0:19
  kind of alarming ways those very same mechanics can be exploited.
• 0:23
  Here's our road map for today. We'll start by demystifying Tor
• 0:27
  hidden services, then look at how Tor architecture actually
• 0:30
  works, followed by exploiting the shadow relay flaw, what
• 0:33
  lurks on the network, tracking the untrackable clients, and
• 0:35
  we'll wrap up with the illusion of perfect anonymity.
• 0:39
  Section 1. Demystifying Tor Hidden Services
• 0:43
  OK, so the crucial thing to understand here is that while
• 0:46
  the standard Tor network initially protected the client,
• 0:49
  you know the person browsing the web, hidden services were
• 0:52
  introduced later back in 2004 to protect the server's location.
• 0:56
  This concept is what we call responder anonymity.
• 0:59
  It basically allows an operator to host a website, a messaging
• 1:02
  server, or really any other service without ever revealing
• 1:05
  the physical IP address of their machine.
• 1:08
  Now, obviously this makes it an incredibly powerful tool for
• 1:10
  freedom of speech and oppressive regimes, right?
• 1:13
  But inevitably, it also provides a pretty robust platform for
• 1:16
  illicit activities. Section 2 How Tor architecture
• 1:20
  actually works. Let's look under the hood,
• 1:23
  because the mechanical flow here all starts with math.
• 1:25
  First, the operator generates an RSA key pair.
• 1:29
  The network takes that public key, hashes it, and that
• 1:32
  mathematically derives string that actually becomes your dot
• 1:35
  onion web address. Pretty cool, right?
• 1:37
  Next, the server creates A descriptor containing its public
• 1:40
  key and upload locations, and it sends that out to six specific
• 1:44
  nodes on the network, called hidden service directories.
• 1:47
  So when a client wants to visit that onion address, they have to
• 1:50
  go ask one of those directories for the descriptor.
• 1:52
  Finally, the client and the server meet up at a randomly
• 1:55
  selected rendezvous point. Because there's no central
• 1:58
  entities storing all these addresses, finding a service
• 2:00
  means you have to know exactly where to ask.
• 2:03
  The glue holding this whole oeration together is the hidden
• 2:06
  service directory, or HSTR. Think of an HSTR like a rotating
• 2:10
  O box that changes every 24 hours.
• 2:13
  The Tor authorities heavily restrict these to ensure the
• 2:15
  network stays stable and secure. A server actually has to prove
• 2:18
  it's reliable by maintaining at least 25 hours of continuous
• 2:21
  uptime just to earn that special HSDR flag.
• 2:24
  And to prevent someone from just flooding the network with fake
• 2:27
  directories, authorities strictly allow a maximum of two
• 2:29
  active relays per IP address in their official list, which is
• 2:32
  known as the consensus section. 3 Exploiting the shadow relay
• 2:37
  flaw Well, researchers found a really brilliant work around by
• 2:41
  exploiting a flaw in how Tor monitored that required up time.
• 2:45
  They realized there was a distinction between active
• 2:47
  relays, the ones officially listed in the Tor consensus and
• 2:50
  limited to two per IP, and what they called shadow relays.
• 2:54
  An attacker could spin up dozens of Tor instances on a single IP
• 2:57
  address. Only two of them would be active
• 2:59
  and visible to the network. But here's the catch.
• 3:01
  The authorities were still quietly monitoring the
• 3:04
  background shadow relays, counting their uptime.
• 3:07
  By deliberately cutting the connection to their active
• 3:09
  relays, the researchers forced the Tor network to instantly
• 3:12
  substitute in their shadow relays.
• 3:13
  And since those shadows already secretly possessed the 25 hours
• 3:16
  of uptime, they could rapidly cycle through and collect
• 3:18
  incoming hidden service keys from all across the network.
• 3:22
  The sheer efficiency of this attack is absolutely staggering.
• 3:26
  Normally, to blanket the network and become the directory for
• 3:29
  every single hidden service, an attacker would need hundreds of
• 3:32
  separate IP addresses running for over a day.
• 3:35
  But by using this clever shadow relay technique, the researchers
• 3:38
  entirely bypass the strict network restrictions.
• 3:41
  They managed to compromise the entire directory system using
• 3:44
  only 58 Amazon EC2 machines. Literally just 58 machines to
• 3:49
  map it all. Section 4.
• 3:51
  What lurks on the network? So once they captured all those
• 3:55
  onion addresses, they scanned them for open ports to see
• 3:57
  exactly what kind of services we're running.
• 4:00
  And the results? Totally eye opening.
• 4:03
  There is a massive spike on port 55,080, completely dwarfing
• 4:07
  standard web traffic on port 80. Why does that matter?
• 4:10
  Well, that specific port is heavily associated with the
• 4:12
  Skynet botnet. The malware infecting everyday
• 4:15
  users computers immediately closes this port unless it's
• 4:18
  been intentionally set up as a forwarder.
• 4:20
  This technical footprint revealed a surprising reality.
• 4:23
  Out of the roughly 24,000 active hidden services they scanned,
• 4:27
  over 50% of the entire network was actually just infected
• 4:30
  machines controlled by a botnet. Now if we filter out the bot
• 4:34
  Nets entirely and look strictly at standard websites, the
• 4:37
  Http://content, the picture changes completely.
• 4:41
  The researchers classified over 1800 English language pages.
• 4:45
  Despite the public perception focusing heavily on contraband
• 4:49
  like drugs and weapons, which to be fair did make up about 44%,
• 4:53
  the data shows a surprisingly balanced ecosystem.
• 4:57
  Political discussion, whistle blowing platforms and anonymity
• 4:59
  resources make up a massive chunk of the legitimate traffic.
• 5:03
  This proves the network is heavily utilized for its
• 5:06
  original intent, which is protecting free speech.
• 5:09
  However, just kinding websites doesn't really tell us what
• 5:12
  people are actually using. When we measure popularity by
• 5:15
  actual client request volume, meaning how many times users
• 5:18
  requested a services descriptor, the reality of the dark web
• 5:21
  shifts yet again. A completely hidden botnet
• 5:24
  infrastructure known as Goldnet vastly outpaced everything else,
• 5:29
  hitting over 13,000 requests in just a 2 hour window.
• 5:32
  Famous illicit marketplaces like Silk Road they saw around 1100
• 5:36
  requests, and legitimate search engines like Duck Go saw barely
• 5:40
  55 S The technical reality is that automated malicious botnet
• 5:45
  traffic is the undisputed heavyweight champion of hidden
• 5:48
  service requests. Section 5 Tracking the
• 5:51
  untrackable clients. So when you connect a Tor, your
• 5:55
  traffic bounces through three encrypted relays, stripping away
• 5:59
  your IP address. It begs the question, how do you
• 6:02
  track an anonymous client when their true origin is shielded by
• 6:05
  all these layers? Well, the answer lies in
• 6:08
  manipulating the very first node a client connects to when they
• 6:11
  enter the Tor network. That entry point is called a
• 6:13
  guard node. To protect against certain types
• 6:15
  of statistical attacks, the Tor protocol actually forces clients
• 6:19
  to pick a random guard node and stick with it for 30 to 60 days.
• 6:23
  But because clients hold onto these guard nodes for weeks at a
• 6:25
  time, it inadvertently creates a static vulnerability.
• 6:29
  If an attacker controls just a small portion of the network,
• 6:32
  they have a prolonged month long window to trap a target,
• 6:35
  provided that target happens to randomly select the attacker's
• 6:37
  server as their entry point. Let's breakdown how this builds
• 6:40
  into an actual attack. First, the attacker becomes the
• 6:43
  directory. When a client asks for a site,
• 6:46
  the attacker replies with a very specific, identifiable traffic
• 6:49
  signature. If that client is using a
• 6:51
  compromised entry guard node, that node spots the signature
• 6:54
  flowing through and boom, the user's true IP is exposed.
• 6:58
  This opportunistic deanonymization means if, say, a
• 7:01
  seller on a hidden marketplace frequently checks their
• 7:03
  messages, it's really only a matter of time before their tour
• 7:06
  client randomly selects a compromised guard node, exposing
• 7:09
  them entirely. And the real world consequence
• 7:11
  of this vulnerability is severe. Utilizing this exact traffic
• 7:15
  signature method, researchers targeted that popular Gold Net
• 7:18
  botnet service. We talked about every single
• 7:20
  time an infected computer reached out to the network for
• 7:22
  commands, there was a chance it passed through a compromised
• 7:25
  guard node. The researchers successfully
• 7:27
  stripped away the encryption and plotted the true geographical
• 7:30
  locations of these infected botnet clients all across
• 7:33
  Europe. It just goes to show client
• 7:35
  anonymity is actually incredibly fragile.
• 7:38
  Section 6. The illusion of perfect
• 7:41
  anonymity. Because every server's status is
• 7:43
  publicly recorded in the tour consensus, researchers were able
• 7:47
  to perform a historical statistical analysis of the
• 7:50
  network. They looked specifically at the
• 7:52
  famous Silk Road marketplace over a three-year period.
• 7:55
  In year 1, the directory selection was completely random,
• 7:58
  exactly as it should be. In year 2, the data clearly
• 8:01
  shows the researchers own experiments where they altered
• 8:04
  fingerprints to map the network. But year three, That's where it
• 8:07
  gets chilling. The historical data shows
• 8:10
  unknown outside entities successfully taking over all six
• 8:13
  directories for Silk Road continuously.
• 8:16
  This reveals it was being actively tracked by someone else
• 8:19
  long before the FBI officially shut it down.
• 8:22
  So how exactly did they spot this in the data?
• 8:24
  Tracking detection basically boils down to spotting unnatural
• 8:27
  mathematical behavior. Think of it like rigging a
• 8:30
  lottery. Attackers rapidly generate new
• 8:32
  server keys until they find a mathematical fingerprint that
• 8:35
  perfectly aligns with their targets descriptor ID.
• 8:38
  When you see a server rapidly changing its cryptographic
• 8:41
  identity just to land mathematically next to a
• 8:43
  specific site, and doing it so often that they completely defy
• 8:46
  statistical probability, you are watching an active tracking
• 8:49
  operation in progress. As we've unpacked in this
• 8:52
  explainer Tor, hidden services exist in a highly precarious
• 8:56
  state. The network is a very delicate
• 8:59
  balance. It provides an undeniably vital
• 9:01
  platform for preserving freedom of speech and protecting users
• 9:04
  in dangerous political climates. Yet at the exact same time,
• 9:08
  those precise mathematical mechanisms create a massive,
• 9:11
  easily exploitable infrastructure for automated bot
• 9:14
  Nets and illicit trade. And that leaves us with a pretty
• 9:17
  provocative technical reality to ponder.
• 9:20
  We've seen how vulnerabilities in uptime monitoring and
• 9:22
  predictable directory mathematics can completely
• 9:24
  unmask users in a decentralized system built entirely on trust
• 9:29
  and rigid mathematical rules, perfect anonymity is really only
• 9:32
  an illusion waiting for the right algorithm to shatter it.
• 9:35
  If academic researchers could expose the geography of an
• 9:37
  invisible landscape using just 58 IP addresses, we really have
• 9:41
  to ask ourselves who else is already quietly watching in the
• 9:44
  shadows?