Date: Fri, 28 Jun 2013 23:37:45 -0400
From: Neel Rowhoiser <neel.rowhoiser@...look.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: tor vulnerabilities?

I just stumbled across this and despite its sort of half-assed write up, I think its possibly an advisory? If I am understanding it correctly, they're saying that you can use a directory authority that hands out invalid/wrong RSA keys for other relays, you can cause decryption to fail and thus introduce path bias to nodes of the directory authorities choosing by selectively handing out valid RSA keys?
If the bit towards the end about guard nodes is correct, it would seem to indicate that they can use the semantics for detecting when a guard is causing too many extend relay cells to fail to cause valid guards to be marked invalid, and their rogue guards to succeed essentially using tor's semantics against them and causing the odds that you-re ingress point to the tor network is rogue to approach 1.
Why aren't the tor relay keys signed? And what other myriad of documents do directory authorities serve that also don't have integrity controls? This sort of makes me question the tor projects ability to deliver on any of the promises they make, as it would seem that a person needs like 3 or 4 rogue nodes before they could start de-anonymizing users, and the more of them they introduced the more of the network they could capture?
What I ran across (pastebin-- source unknown) http://pastebin.com/pRiMx0CW
Cheers,
Neel Rowhoiser 		 	   		  
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists