Proxy & TOR Security? - Forum

Yparxei enas mythos.... pou einai arketa megalos ston kosmo tou internet. Enas mythos pou para poli kosmos pistebh oti ontws yparxei 100% anonymity online. Poli tha lene gia ta proxies kai to TOR (The Onion Router).

Prota apola prepi na katalabate TI einai ena proxy kai PIA einai h pragmatikh douliea enous proxy.

To proxy einai ftiaxmeno gia :

1 - Caching. (Na fortonoune h selides pio grigora ean kathesai piso apo ena dyktio. To proxy apla kanei kati san ena image apo ta sites pou pate syxna kai otan ksana pate tha sas deiksi to image tou na mh perimenete na ksana fortosi olo). Dld.. CACHE:

2 - Transparent Proxy. (Gia na elexete to network data pou bgeni ekso apo ena dyktio. PX. Mporeite na peite oti ola ta pc piso apo ena tetio proxy PREPI na perasoune MESA apo to proxy gia na mporoune na paroun prosbash sto eksoteriko dyktio (h telos panton to dyktio pou einai EKSO apo to proxy). Auto einai gia na asfalhsei kapios to dyktio tou px se skoleia, web cafes & megala dyktia.)

3 - Application Level Firewalls. (Ena firewall DEN einai apla ena programma. Den einai ena software pou tha kanete click click kai auto eitane kai nomizete oti eisaste asfaleies. Ena SWSTO FIREWALL mporei na einai enas syndiasmos apo diafora hardware kommatia.. pou to kathe ena kommati kani mia douliea... enas krikos sto synolo ths asfaleias tou firewall. Sto application level firewall to PROXY pezei to ekshs rolo.)

- Bandwidth Management.
- Gateway Control.
- Antivirus Gateway.
- URL filter (h genikos filtra gia extensions kai adresses).
- Transparent Monitoring (web, chat, mail ktlp).
- Ease of setting up firewall rules. (Afou olo to traffic pernai mesa apo to transparent proxy ANAGASTHKA).
- Kai kati alla akoma pou den einai simantika.

To proxy DEN einai ftiaxmeno gia na:

1 - Kripsete thn IP sas. (Auto einai proxy ABUSE).
2 - Den einai gia na mpenete se IRC h selides nomizontas oti autoi eki den tha sas broune.

Oti to proxy polles fores tha dieksi thn teleutea IP tou proxy prin pai kapou einai apla o tropos pou leitourgi to proxy. Den einai gia na krhftiete.

Tora... yparxoune POLLA programmata kai online sites pou 'lene' oti prosferone 100% anonymity kai oti tha sas kripsoune. Auto einai PSEMA! Den yparxi auto. Prin pao gia 'details' prepi na kserete to ekshs:

To kathe online proxy/anonymity service/programma pou tha xsrismopei proxies mporei na einai ena apo ta ekshs:

1 - Government Trap Proxy. (Fakeloni thn KATHE sas kinshei.)
2 - Hackers/Crackers/Egglimateis proxy. (Afou pernate apo ena proxy pou DEN EXETE IDEA PIANOU EINAI mporei na fakelosi OLO to traffic. Including passwords and downloads).
3 - Ta mono 'nomima' online anonymizers tha sas roufianepsoune AMESOS ean kanete kati pou den epitrepete. PX. Esies mpenete sto webserver mou meson proxy kai kanete kati... kana injection.. ktlp... Egw san admin tou web server tha po sthn IP tou annonymizer tou kai tou kai thelo THN real IP. Autos tha mou thn dosei epitopou. Ara.. pai h IP sas. Meta tha sas brei o BUBBA otan skhpsete gia to sapouni.

Tora ti ginete me to TOR (The Onion Router). To tor einai enas eidos proxy chaining system. Dld to tor tha parei to request gia thn selida pou thelete na pate kai tha sas perasi apo polla diafora proxies prin ftasete sthn selida pou thelete na pate.

px.

Home user -------->TOR------>proxy1------->proxy2------->proxy3-------proxy ktlp...------->h selida pou thelate na diete. H selida tha deiksi ston admin to teleuteo IP apo to proxy4. Den tha dei thn ip tou proxy 1,2,3 ktlp.. oute thn dikh sas. (LOL tora tha lete WOOOW). Egw omos lew LOL!

Iparxoune Tropoi na brei kapios thn REAL IP sas meson ena syndiasmos apo Flash kai Cookei Attack. Sas roufianeboun to:

- Flash
- ActiveX
- Java
- JavaScript

Quote apo ISC.sans.org (Internet Storm Center)

QUOTE
Hacking Tor, the anonymity onion routing network
by Arrigo Triulzi (Version: 1)
On October 4th one of our readers sent in a very worrying analysis of what appeared to be "traffic modification" (in his words) on the part of the Tor network.

The Tor ("The Onion Router") network is an anonymizing peer-to-peer network of routers on the Internet which uses various techniques to bounce traffic around the Internet in such a way that traffic analysis becomes difficult if not impossible to perform. Tor is a perfect example of a dual-use technology: it can be used to avoid government-imposed Internet censorship or to protect the identity of a corporate whistleblower but at the same time it is sadly ideal for various nefarious uses.

The key tenet of Tor is that it should protect anonymity and the reader's analysis pointed not only to traffic modification on the part of a so-called "exit router" (the last hop in a Tor circuit before your packets reach the real destination) but also an attempt at tracking the true origin of the traffic (in a Tor network a hop only knows that the traffic comes from a previous hop but no futher back).

Both William Salusky and myself looked into the data and it seemed to implicate packetstormsecurity.org, an exit router in Denmark and, more curiously, a DNS tunnel to transmit data out (via obviously fake hosts under the t.packetstormsecurity.org domain). This last item was interesting because it replicated data which was apparently being submitted to the host via an HTTP cookie so it seemed that the idea was to have the cookie travel to the unwitting Tor user and be sent back via DNS tunnel to an external host to confirm the real identity of the host. As both of us were busy we looked a little deeper but ultimately we recommended that the reader report this to the Tor authors.

Well, the moral of the story is that our reader, who sadly asked not to be named in the original e-mail, was dead right and a paper entitled "Practical Onion Hacking" by Andrew Christensen was released today on packetstormsecurity.org.

Our combined analysis had it almost entirely correct except that the DNS tunnel was not quite in Dan Kaminsky's "let's carry RealAudio over DNS" style but a simpler trackable DNS request and we had guessed at but not entirely understood the Shockwave flash trick. All in all a pretty impressive paper, warmly recommended.

Finally a closing remark quoting from the actual paper for those who think Tor is "game over":

"Clearly Tor's designers have done a pretty good job: I couldn't find any weakness in Tor itself that violate the tenets set out at http://tor.eff.org/ (basically that end-to-end traffic analysis is always possible, but the traffic analysis should [be] difficult to everything but a global Echelon). So instead, I attacked the data which Tor carries the most of: web traffic."

To 'Practical Onion Hacking Paper' gia opios endiafereta gia leptomeries mporie na to katebasi apo edw:

Olo to thema auto... legetai: 'Security Through Obscurity'. Dld... epidi nomizete oti mporeite na kreifite den prosexete ta pragmatika pragmata pou tha sas prostatepsoune. H monh swsth lysh einai... mh psaxnete tropo na kriftite. Psaxkste kalitera gia tropous na ASFALISETE ta dedomena sas kai ta dyktia sas.

Allo ena oreo psema pou mou eipe enas admin einai to ekshs:

'Re LoKii... mh mou les tetia. Ean eimai piso apo ena Router (NAT).. DEN ginete na deis ta eswterika IP.'

Egw apla ena megalo LOL tou eipa. Epidi GINETE!!!

Ena tool pou tha brei to info einai to NMAP apo ton fyodor.

Kai allos enas tropos:

(Auto einai gia aftous pou nomizoune oti mporoune na kriftoune piso apo NAT ean yparxoune polla pc apo piso).

To mathima pio einai?

SECURITY THROUGH OBSCURITY einai KAKH idea.

Kalh sinexia magkes