Spoiled Onions: Exposing Malicious Tor Exit Relays

• Several hundred Tor exit relays together push more than 1 GiB/s of network traffic. However, it iseasy for exit relays to snoop and tamper with anonymised network traffic and as all relays are runby independent volunteers, not all of them are innocuous.In this paper, we seek to expose malicious exit relays and document their actions. First, wemonitored the Tor network after developing a fast and modular exit relay scanner. We implementedseveral scanning modules for detecting common attacks and used them to probe all exit relays over aperiod of four months. We discovered numerous malicious exit relays engaging in different attacks.To reduce the attack surface users are exposed to, we further discuss the design and implementationof a browser extension patch which fetches and compares suspicious X.509 certificates overindependent Tor circuits.Our work makes it possible to continuously monitor Tor exit relays. We are able to detect andthwart many man-in-the-middle attacks which makes the network safer for its users. All our code isavailable under a free license.

Subject headings

TEKNIK OCH TEKNOLOGIER  -- Elektroteknik och elektronik -- Datorsystem (hsv//swe)

ENGINEERING AND TECHNOLOGY  -- Electrical Engineering, Electronic Engineering, Information Engineering -- Computer Systems (hsv//eng)

Keyword

tor

mitm

analysis

measurement

Computer Science

Datavetenskap

Publication and Content Type

vet (subject category)

rap (subject category)