How you can be deanonymized through Tor
There are many limitations to be aware of and ways of using it that can compromise your anonymity on Tor
Tor is an excellent tool for privacy, and we do not recommend you avoid it. However, there are many limitations to be aware of and ways of using it that can compromise your anonymity on Tor. This article will discuss just a few of the ways, but there may be others that the public is unaware of. For example in 2017, the FBI dropped a case against a school worker accused of downloading child pornography because the FBI would have rather let him go than reveal the source code for how they deanonymitized him through Tor. [1] If you really want to get your privacy game to the next level, consider subscribing for free to our new content by Session messenger, RSS feed, or Nostr.
The sources for this article can be found here.
The techniques we will cover include:
a) JavaScript based attacks
b) Cookies
c) Compromised Exit Nodes
d) Compromised Middle Relays
e) Compromised Entrance Guards
f) Opening Files Outside Tor
g) Ultrasonic Sounds
JavaScript Attacks
The first way that JavaScript can identify a user is if a malicious website were to inject code into Mozilla Firefox (the foundation upon which the Tor Browser bundle is built). An example of this exploit was demonstrated as recently as 2022 by Manfred Paul at a Pwn2Own hacking contest of getting a user’s real IP address through Tor. [4a] [4b]
Many times
But this is not a one time bug or incident, as Mozilla Firefox has a history of being vulnerable to these types of malicious JavaScript injections. Malicious script hacks caused Tor to have to patch to correct them in 2019 [5], 2016 [6], and 2013 [8].
Hardware Fingerprint
Back in 2016, cybersecurity researcher Jose Carlos Norte revealed ways that JavaScript could be used to identify Tor users through its hardware’s limitations. These advanced techniques fingerprinted the user’s mouse movements, which are tied to hardware restrictions and potentially unique operating system settings. Norte additionally warned how running CPU intensive code could potentially identify the user’s PC based on how long it takes to execute. [7]
NoScript Ends it
The point of all of this is that all of these vulnerabilities did not work when NoScript was set to the safest mode of disabling JavaScript.
Browser Alone doesn’t stop cookies
Another security issue with Tor is pre-existing cookies, which could compromise your anonymity. For example, let’s say you previously signed on to your Amazon account from the same computer you are now using Tor Browser in (but using a different browser). If you now visit an Amazon page using Tor Browser (or maybe even receive a forwarded Amazon URL), you could potentially be connected to the Amazon cookie already on your computer and be deanonymized instantly. This would immediately connect the Tor traffic with you.
Remember though that Tor Browser is only one of a few options for using Tor. The way around this cookie issue is to use Tor in a virtual machine with the Whonix operating system or the USB operating system version of Tor called Tails.
Compromised Tor Exit Nodes
Your traffic enters Tor encrypted and stays encrypted through its journey throughout the mixnet until it gets to the final stop, which is the exit node. Here the exit node communicates with the “regular” clearnet without Tor’s onion encryption to access a website on your behalf.
httpS
Outside of Tor on the “regular” clearweb internet, most websites use httpS encryption. This is shown with a padlock in the top by the URL. If the website is http, without the “s,” then it’s unencrypted plain text data. Anything you do using an unencrypted http website with a Tor exit node can be snooped on and seen. However, this risk is relatively low because of the high percentage of websites that use httpS.
SSL Strip
The biggest risk is that the httpS encryption can be removed using SSL stripping. This is when the Tor Exit node acts as a man in the middle, faking the server with which you’re trying to authenticate and downgrading the connection to httpS. For example in 2020, a malicious actor took control of over 23% of all Tor exit nodes and started doing SSL stripping to steal Bitcoin being sent on mixing websites. [9] [10]
HTTPS Only
To prevent against these types of attacks, upgrade the Tor security level to safest, which requires the use of HTTPS encryption with “HTTPS-Only”. Also pay attention to the top icon by the URL bar, to make sure there’s always a padlock showing it’s using this encryption.
CAs
You can click on the icon to see your Tor connection route and the certificate authority. Certificate authorities are the entities that validate the authenticity of the HTTPS encryption to this IP address. On a side note, these certificate authorities can act as a censor by removing an entry’s IP address, and this is one of the flaws that many cryptocurrency blockchains are actively working to solve.
Avoid Exiting Tor
Another way to prevent malicious Tor exit nodes from stealing your data or cryptocurrency is to avoid using exit nodes by using primarily Onion services. If you only login to Onion websites, then you never exit Tor. This doesn’t mean completely avoiding clearweb sites, but try to only browse them and not login. It’s the login/password credentials that malicious exit nodes steal with SSL stripping.
Malicious Middle Relays
KAX17
The next type of risk is malicious middle relays — the hop between an entrance guard and an exit node. For example, the malicious group KAX17 had been identified as having run up to 35% of the middle relays and 10% of the overall Tor network before the official Tor project removed 900 of its servers. [15] [16]
Why Middles?
While malicious exit nodes often want to steal Bitcoin or data, the goal of malicious middle relays is to deanonymatize users by seeing the path of their traffic. This is especially true on Onion hidden services because it doesn’t even use exit nodes.
There are a few things you can do to reduce this risk. We will go over them in the entrance guard section, because they are the same methods.
Malicious Entrance Guards
Entrances see a lot
Entrance guards can see what IP address is connecting to the Tor network, but can’t see the traffic itself as it’s onion layer encrypted. However, they can gather some information, such as the time, size, and frequency of the data packets.
MIT Algo
Researchers from Massachusetts Institute of Technology and Qatar Computing Research Institute wrote in a 2015 paper that if one of their malicious machine learning algorithm servers gets randomly picked to be a user’s entrance guard, then it may be able to figure out what website that user is accessing. The MIT researchers are able to do this by analyzing the patterns of packets from a pre-determined list of websites and seeing if they match the traffic their malicious entrance guard snoops. [17] [18]
According to MIT News, the MIT machine learning algorithm has above an 80% chance to be able to identify what hidden services a given Tor participant is hosting, but there are two conditions. First the host has to be directly connected to its malicious entrance guard and second the hosted site was on MIT’s predetermined list. [18] And finding who is the host of controversial materials is often of more interest to oppressive regimes than just who are the website’s visitors.
How can you avoid this?
There are a few ways you can reduce your risks with malicious entrance guards and middle relays.
ob4s bridge
First, use your own hosted ob4s bridge as an entrance guard to avoid ever having both a malicious relay and guard. Our company can help you set this up on a cloud server (VPS) or create it for you. See our product page for more details.
VPN first
And second, you can enter Tor with a VPN first.
Opening Files Outside of Tor
Virtual machines contain and isolate identities
If files are opened outside of Tor Browser, they could have code that executes and reveals back to an adversary your real IP address. To avoid this, one can use a dedicated virtual machine like Whonix, which forces all traffic in the VM through Tor. Another option is the Tails operating system on a USB stick, which automatically erases everything after you’re done.
Files Outside Tor
However, if you want to use a PDF outside of Tor, then you’ll need to convert it to plain text. One great Linux tool to do this inside Whonix’s command line is PDFtoText. You can install it with this command:
sudo apt install poppler-utils
Then use it with this:
pdftotext -layout input.pdf output.txt
The -layout flag keeps the original layout. input.pdf is the original file, and output.txt is what you want the output to be named.
Ultrasonic Cross Device Tracking
As University of California Santa Barbara cybersecurity researchers presented at a BlackHat European conference, malicious websites can identify users through Tor using sounds invisible to the human ear. [20]
Silverpush
The way this works is that many popular phone apps use Silverpush’s ad system, which can receive high frequency audio without the phone’s owner being aware of it. Audio of this type could be broadcast maliciously from a Tor website.
Silverpush enables the sale of your location data
Linked
These doctoral researchers warned of the dangers Silverpush presents by being connected to wide-spread platforms such as Google Ads. To demonstrate this, the researchers played video of their lab experiment, which de-anonymatized a laptop through Tor Browser, as a result of an Android’s mic next to the laptop’s speakers, while being signed in to a Google account. [34]
Their App
While the researchers presented a Chrome browser app that can stop this, we do not recommend it for Tor use because of fingerprinting (and Tor Browser is Firefox based). The best solution is to turn off the speakers and any phones around you when visiting controversial or private websites. Also consider a degoogled phone with a custom operating system, such as Graphine or Calyx, which would allow you to modify when apps have microphone privileges.
Conclusion
In this article, we covered a variety of different ways your identity can be revealed through Tor. To summarize your best defenses are:
-
Disable JavaScript with Tor’s Safest Setting
-
Use a custom private entrance bridge (ob4s) for an entrance guard that you control. Our company can help you set this up.
-
Use Whonix or Tails when you need JavaScript or for doing anything outside a browser, such as opening unknown software or files
-
Before connecting to Tor, first use a high quality VPN with OpenVPN (Avoid Wireguard)
-
Avoid resizing Tor Browser because of fingerprinting
Simplified Privacy can help you by setting up a custom ob4s bridge for you on a cloud provider of your choosing. This would provide significant privacy since you’d control your own entrance guard. You would get the passwords (and SSH login), which you could change. We’d walk away and you’d be in full control of your own private server.
You can speak with us via end-to-end encryption like Signal, Session, or XMPP and pay for this with anonymous cryptocurrencies. Enjoy the privacy of our “No JavaScript” .Onion website and we process all crypto payments on our own private node.
The sources for this article can be found here
If you really want to learn and take your privacy to the next level, subscribe to our new content via: Nostr, Bastyon, Session, RSS, Ethereum Push
Related Posts
Tor & IPFS are opposites
Opposite Server Setups.
[SP]
Jul 20, 2024
Tor Onion Nostr Guide: Best Apps
Tor and Nostr together is amazing for censorship resistance. Let's go over some tools you can use to do this.
[SP]
Mar 26, 2024
Why KVM Whonix over Oracle VirtualBox
KVM and VirualBox are two ways to use Whonix. Let's discuss why KVM is better.
[SP]
Feb 1, 2024
Super useful (& legal) Tor Onion links
Here’s a list of some excellent resources for Tor that are completely legal.
[SP]
Dec 10, 2023