Tor is perfect! (except for the user....)

Tor is perfect!  (except for the user....)

I have been spending so much time with the Tor browser over the past months that I have forgotten just how seamlessly it uses a complex network of global servers, and encryption to provide a near perfect level of online anonymity. The Tor browser is extremely effective in providing near 100% anonymity that if not for one little flaw, it would be perfect, and I found that flaw.

The flaw is the user. Yes, every physical device and software application has the same flaw, but with Tor, it is a flaw that can completely negate using Tor for anonymity with misuse. Something as simple as a user not updating the Tor browser when prompted in bold print is enough to break anonymity. The Tor browser can only do so much to warn users to update the browser...

On one hand, criminals using the Tor browser who are lazy, too busy, or not accepting the danger of using outdated Tor browsers run the risk of getting busted.  On the other hand, legitimate users, such as those living under oppressive governments, can be discovered and imprisoned (or worse!) for exercising speech online.  Both situations generally require the user to be the weak link.

FBI Uses Spyware to Catch Tor-Based Child Pornography Suspect - Softpedia News

http://news.google.com Thu, 01 Oct 2015 02:46:49 GMT

http://t1.gstatic.com/images?q=tbn:ANd9GcQxYPXiaO7F03zDfLzy9fCeiyj7obMA0G6jj8US0UWF_LBSKY7Tuq7WFLZykSGdtdYjjBoDZl4Softpedia NewsFBI Uses Spyware to Catch Tor-Based Child Pornography If you were wondering, the Flash plugin comes turned off by default in all Tor Web browsers. For this particular reason, if you ever read a tutorial on how to pr ...

Read more ...

I have been known to have the superpower of being able to break steel balls while locked in a rubber room, so trying to break Tor seemed possible. With more than a few personal tests, I found Tor works well.  Reading through dozens of white papers written by computer scientists (waaaayyyy smarter than me) only confirmed that Tor works...very well.  It is just the user, either by using outdated Tor browser bundles or other user-created accidents that are easily led to their front door.  In my current book, Hiding Behind the Keyboard, I have written a chapter solely dedicated to the Tor browser and included some methods where investigators can force a user error to identify criminals. In short, for investigators it is a game of chance when Tor is involved in an investigation.

Writing about Tor is a bit touchy. Generally, individual countries create and enforce laws for that country. Some countries allow near unfettered freedom of speech and others less so. Some countries go to extreme measures to identify and punish anyone speaking out against their government or government officials.  Technically, the methods to uncover Tor users in both types of countries are the same.  Some countries go so far as to shut down the entire Internet to prevent any use at all by its citizens. The touchy part is that the methods to go after criminals are the same methods used to go after legimiate users (whistleblowers, activists, etc...).   

China tightens noose on Internet as anti-censorship tools suddenly shutter - Washington Times

http://news.google.com Wed, 26 Aug 2015 20:29:28 GMT

http://t3.gstatic.com/images?q=tbn:ANd9GcQ4S__sARQwUCjQj6xlXikkzYxHZMr-5dgXdzJOKPjG_VEKcHE0UIUw5bD8w0DKowAhIVMKwiJ4Washington TimesChina tightens noose on Internet as anti-censorship tools suddenly shutter. Censorship circumvention tools designed to bypass Internet restrictions are again under attack in China as software meant to let users around th ...

Read more ...

Which brings me to the many news articles and NSA/Snowden leaks about Tor. Nearly all are based on exploiting the user and not Tor. Sure, high-tech spyware has been used to infect Tor browsers to uncover IP addresses and such, but the only reason this has been working is because the user has failed to use the most current version of Tor. And much like a house of cards will fall with one card pulled out, an entire criminal organization using Tor to commit crimes will fall when one thing (the user) is exploited through user errors or forced errors.

Tor is not perfect, and certainly not best for all Internet use, but it has its place when needed. As one example, whistleblowers have a legitimate need for anonymity to report violations. Another would be anyone using a public computer (library, hotel, etc...) and would like the Internet provider see everything they are doing online, not for criminal activity, but simple personal privacy.

For forensic analysts, the biggest takeaway I can give is that if you are not looking for Tor use in your cases, you may be missing LOTS of evidence. Think back to the last time you even searched for Tor remnants in an analysis. How about the last time you even thought about looking for Tor in an examination.  Or better yet, have you ever even considered it? Examiners who conduct an "Internet Analysis" of a computer system is not being complete without including searching for remnants of the Tor browser.  The mere existence of the Tor browser can affect your analysis conclusions.

In two investigative/forensic books I have been working, Tor is a factor for analysts, but it is not the only factor. Tor is but one part of any person's overall communication strategy. Rare is communication based on a single method, but instead included many types of communication methods used in conjunction with other.  A cell phone text message can be a reply to an e-mail sent through Tor which was a reply to a face-to-face contact.  When uncovering covert communications, the goal is to find all the methods in order to put the entire communication threat together, without missing pieces. If you have not been looking at Tor, most likely, you have missing pieces.

A little update coming for Mini-WinFE
I had a blast presenting for ICAC at Microsot
 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Thursday, 25 May 2017