What About Tor?

 Some rights reserved by o5com on Flickr.com -- image licensed by Creative Commons Attribution 2.0 Generic

Some rights reserved by o5com on Flickr.com -- image licensed by Creative Commons Attribution 2.0 Generic

Tor has caught my eyes recently.  It seems to me Tor is great for anonymizing a user, but it’s not so great in protecting privacy unless the user is serious enough and encrypting everything he or she has to send through Tor.  Anyhow, I’m new to Tor, and so what I write about Tor in this blog post might need to be revised again in the near future.  Suggestions for corrections are welcome!  As always, I dabble on!

Let work backward a little!  Why Tor is great at anonymizing and not protecting privacy?  Well, Tor is known for being great at obscuring the identity of the data source.  Did I say identity?  It’s all about hiding (i.e., anonymizing) the IP addresses of the Internet users.  Here is an example, let say you want to visit a website, but you do not want to reveal an IP address of yours to this website, Tor is perfectly well-suited in hiding your IP address and so a website will not be able to know that it’s you who have visited it.

Tor is so able in obscuring an IP address for Tor has not a central router where every connection’s identity is made known.  Yes, I know it’s hard to understand what I mean by the previous sentence, but it means Tor relies on random folks like you to run Tor exit relay or non-exit relay (i.e., another meaning — Tor router).  The magic is happening when each Tor exit relay or non-exit relay sends the data onto the next destination.

Did I say magic?  Tor relay, especially the non-exit relay, encrypts the source and the destination IP addresses before it forwards the data onto the next Tor relay.  I do not know if Tor is going to encrypt the meat of the data (i.e., the whole enchilada of the content of the data) between the transit also, but it seems that this isn’t the case (please correct me on this if I’m wrong on this).  Anyhow, since the source and  destination IP addresses are going to be encrypted over and over again through each Tor relay, therefore even next in line Tor relay (i.e., the next Tor relay to be received your data from the previous Tor relay) can only know about a previous Tor relay’s IP address and not the source or the destination IP address.  To make things even more illusive, Tor client will always choose a different path within Tor network each time it requests or send data to a destination.  This makes the matter worse for whoever or whatever that tries to trace back to a source IP address.  I think software that specialize in analyzing web traffic might find Tor specifically unfriendly.

OK, we got the anonymizing part down, but why Tor isn’t so great in protecting privacy?  If I’ve not misunderstood from several online sources that I read on Tor, it seems to be that each Tor relay has the ability to read and log the transit data.  As the data reach a Tor exit relay, the data retain the original forms.  From here the data exit a Tor exit relay and entering third party ISP network (i.e., the Internet Service Provider which provides service to the destination — example, an ISP which provides bandwidth to a website that you’re visiting).  The third party ISP network has to be the one which passes on the data to the final destination (e.g., a website, an online service, a social network).  Since Tor relay isn’t actually encrypting the data, therefore each Tor relay is capable in reading and logging the source’s data.  This means privacy isn’t actually being protected by using Tor.

Nonetheless, many users can protect their privacy by using Tor!  How?  They only pass their data through encrypted protocol.  An example is that a user use Tor to browse the web, but he or she relies on HTTPS protocol to encrypt his or her web data.  So, in a way if a Tor user can encrypt his or her data before send the data onto Tor network (i.e., Tor relays), his or her privacy might be protected from prying eyes.

To really protect one’s privacy and using Tor the right way, Tor suggests users to use Tor Bundle Browser download.  The heavily configured, latest Firefox browser (i.e., heavily configured by Tor) which comes with Tor Bundle Browser download will always attempt to pass the data through an encrypted protocol (I might be wrong on this).  Also, Tor’s own heavily Firefox modified browser would not come with plugins that might reveal a user’s IP address, and it might actually block a user from installing such plugin in the first place (I might be wrong on this).

Can Tor be vulnerable to hack?  According to blog.torproject.org’s Rumors of Tor’s compromise are greatly exaggerated article, hackers might be able to hack into Tor relays (i.e., known Tor relays), and then somehow congest the not-so easy to hack Tor relays with some sophisticated hacks so the traffics/data of the congested Tor relays will have to go through the Tor relays that the hackers have hacked into.  This way, the hackers can actually log and read the data of the congested Tor relays since such data must go through the compromised Tor relays.  As how the article above has pointed out, it might take huge amount of computing resources to congest so many known Tor relays.  So, it might not be something that the average hackers may want to try.

It seems Tor can be used by all types of people.  Good people might want to use Tor to really protect their anonymity for good reasons, but bad people might want to use Tor for hiding their real identities so they can do very bad things.  Here is one example how bad people might use Tor to hide their real identities so their really nasty, dirty laundries won’t hang out in the open; they might use Tor for viewing child porn videos online.

Tor can be speeded up for most Tor users if there are many more Tor users who actually host their own Tor relays.  I suspect many more Tor users who only use Tor as client.  These folks simply want to hide their identities from whatever web destinations and various ISPs (e.g., watching Hulu videos that are not made viewing available for certain people who have their IP addresses belong to the countries that are being blocked by Hulu) .  Nonetheless, few Tor users go on hosting Tor relays out of their altruistic nature.

I might be wrong, but there are four ways a Tor user can set up his or her own Tor relay or relays.  The first way would be the hosting of Tor middle relays (also known as Tor non-exit relay).  Tor middle relays are somewhat safe to host, because the middle relays cannot appear as the source of the data.  On the other hand, when a Tor user hosts Tor exit relays, he or she might be liable for the misuses of their Tor exit relays by some random Tor users, because Tor exit relays will always appear as the source of the data.  One example of a misuse of Tor exit relays would be someone might use Tor exit relays to view child porn.  The third and the fourth types of Tor relays are Tor private and public bridges.  It seems to me that Tor private bridges are only made known to the people who might know each other personally, because Tor private bridges’ information would not be distributed openly.  On the other hand, the Tor public bridges are made known to Bridge Authority.  According to blog.torproject.org, Bridge Authority is a special relay which collects all bridges’ IP addresses that pass through it.  If I’m not wrong, int a nutshell, Tor private and public bridges help Tor users to circumvent the ISPs that are blocking Tor’s normal relays (i.e., Tor middle and exit relays), consequently allowing these users to use Tor normally.  Still, ISPs can also block known Tor public bridges, therefore Tor private bridges might be the best hope for Tor users who want to truly circumvent ISPs’ Tor blocking measure.

Using Tor is easy as downloading Tor Browser Bundle for Mac or Windows or Linux, extract the Tor Browser Bundle to a known location on the computer, and then go to this location to fire up Start Tor Browser (i.e., essentially a heavily modified latest version of Firefox browser).  You might also notice when you fire up Start Tor Browser, a control panel known as Vidalia would also pop up.  Vidalia control panel allows Tor users to configure how they want to use Tor.  From Vidalia control panel, Tor users can configure Tor to be just a client to hosting a Tor relay.  Some users might even configure Vidalia to have Tor hosts hidden services.  What are Tor hidden services and why some people might want to host them?  Well, Tor hidden services are just like any other normal computing/web related services, and these might be websites, game servers, and so on.  What makes Tor hidden services different than the rest is that Tor hidden services will not reveal the IP addresses of  the Tor users who host Tor hidden services.  This might appeal to some Tor users who want to get their services or messages out to the public but stay anonymous.

In conclusion, Tor is fascinating to me since it’s a tool that can be excellent in doing what it does best, that is to anonymize a user’s IP address.  Unfortunately, Tor cannot be used solely for protecting one’s privacy.  Therefore, many people encrypt their data before they pass such data onto Tor network so their privacy can be protected better.  Tor isn’t hacker-proof, because hackers might know how to congest Tor network and compromise known Tor relays to do their dirty deeds.  Few Tor users might have been using Tor for malicious purposes such as anonymizing them from persecution of child porn and the likes.  These users might make the many Tor users who use Tor for legitimate purposes look really bad in the eyes of non-Tor users.  Tor true fans might even go as far as to host a Tor relay, because setting up one is not that hard!  All in all, Tor is pretty nifty, crafty and useful, but it can also be malicious as well!

Sources:

Advertisements

Pragmatic Security Tips To Protect Routers And Networks In 2012 And Beyond

Some rights reserved by gcg2009 (Creative Commons License - Attribution 2.0 Generic) from Flickr.com

Tips to how to secure your router and network in 2012 and beyond.  These tips are pragmatic, and so it’s most likely that you may be able to apply these tips onto most routers and network setups.  Unfortunately, even though these tips are pragmatic in details, sometimes the tips here won’t be any useful for you if you have older routers or your network setups are too unique and special.  Let us get on with the tips.

In no particular order, the tips to secure your routers and networks are:

  • Change router’s default password for the administrator username/login.  Make sure the new password is a lot harder than the default password.
  • Change router’s default passphrase for your wireless network.  Make sure the passphrase is strong enough.  It’s best to throw in at least 50 plus characters string.  Also, don’t forget to include capitalization letters, numbers, and special characters (i.e. signs) in your 50 plus characters string passphrase.
  • Make sure to disable UPnP feature within your router.  I’ve heard hackers can exploit this feature.  To be safe than sorry, I guess you should turn this feature off if you don’t have the need for it.
  • Make sure your router’s firewall is turning on and filtering inbound and outbound traffics.
  • Make sure your router has MAC address filtering turns on and allowing only Mac addresses of machines on the list to access network.  Of course, you have to know hackers can still spoof MAC addresses easily, therefore this is not 100% hacker proof.
  • Disable DHCP feature or limit the DHCP IP address range to amount to how many physical machines you have and want to connect to your network using DHCP protocol (DHCP IP addresses).  This way, if an undesirable person wants to use your network, he or she might not be able to get a lease of DHCP IP address from DHCP server which runs on your router, therefore he or she cannot use DHCP IP address to access your network.  Keep in mind that he or she can just assign himself or herself a local static IP address and connect to your network anyway.  Nonetheless, this method might prevent script kiddies from acquiring DHCP IP address from using hacker tools.  Still, there is no guaranteed DHCP might prevent hackers from just running another script which automatically demands a static local IP address.  If you turn off DHCP, you might prevent hackers to exploit DHCP weakness/exploits, and so you can disregard DHCP exploits for your router.  Turning off DHCP also encourages you to enter a local static IP address for each computer’s network configuration, therefore you might prevent a specific computer from automatically connect to your router; in a way this method helps preventing a specific computer of yours from automatically connecting to a fake access point, because hackers can use a special router which can emit an even more powerful wireless signal, overwhelming your wireless router’s signal and encouraging a computer to connect to the wrong/rouge access point which hackers have controlled of (i.e., man in the middle attacks).
  • Disable Wi-Fi Protected Setup feature, because this feature is weak against hackers’ brute force attack which exploits a weak secure PIN authentication process (i.e., this feature reveals too much information on PIN authentication algorithm while authenticating a device).  Nonetheless, this feature might be patched by the routers’ makers in the near future, but to be safe than sorry it’s best to disable it until you really have the need to use it and it has been patched.
  • Enable WLAN Partition if you are paranoid about your network security.  This feature prevents wireless devices to communicate with each other.  Why is this feature useful in securing your network?  Imagine if a hacker can insert himself in your network with a wireless device, he or she might not be able to hack another wireless device of yours if the network disallows the communication between wireless devices.  Unfortunately, this feature might prevent you from sharing files and data between your wireless devices.  One example is iTunes home sharing might not work on wireless mac laptops.  Therefore, if you need to have your wireless devices to talk to each other, then you should not enable this feature.  Otherwise, it’s an awesome feature for enhancing your network security.  Let not forget, if an elite hacker has hacked into your network, he or she might also have control of your router, therefore this feature in the end might be useless if a hacker can change the router’s settings at will.
  • Turning on several log features within your router.  Logs will help you trace back to strange network traffics, requests and errors.  Perhaps, logs can even tell you that you’re getting hacked.  Of course, elite hackers might have way to not trigger your router to log their hacking activities.  Therefore, this feature is just one more layer/tool for you to protect yourself against hackers.  This feature might slow down your router though, because it’s logging network traffics.  So, if your router isn’t equipped to log heavy network traffics, then you should turn this feature off.  It’s all depend on a network situation and the capability of your router really.
  • Enable Access Control.  This feature is useful only if your router is able to allow you to add two types of rules that matter most, and these two types of rules should be made available at the same time, so one rule is enhancing the other rule in security measures.  First rule should be disallowing all other machines to connect to your network.  Second rule should be allowing only the machines with the IP addresses listed in Access Control’s IP table to connect to your router/network.  Of course, you should note that this feature will enable a default blocking feature which might prevent your machines to access dangerous websites and so on, therefore some websites you might want to access will not be accessible.  Also, your router may allow you to add additional websites to be blocked, consequently enhancing the security measure for Access Control feature.  Some routers even go as far as allowing Access Control feature to block certain network ports, but I don’t think this feature is necessary.  After all, your router’s firewall should be blocking all incoming requests and ports.
  • If your router isn’t connecting to your ISP through DHCP protocol, then you should add a trusted but more secure DNS IP addresses of third-party/trusted/secure DNS providers.  One good example would be DNS IP addresses of Google Public DNS service.  Another good example would be DNS IP addresses of OpenDNS.
  • Update your router’s firmware to the latest firmware.  This way you can prevent hackers from using known firmware exploitations that specifically target your router’s firmware.
  • Reboot your router sometimes or add a schedule reboot for your router if your router has this capability.  This way you can actually clear up the router cache and might prevent your router from storing what hackers have uploaded to your router.  I don’t think that it’s yet possible for hackers to be able to permanently make change to your router in regarding to what the router could store and so on.  Therefore, when you reboot your router, your router clears up the cache in its memory and so everything within your router should work as how it was.  Reboot a router can be done in two way.  One is to do a soft reboot which requires you to log into your router’s administration panel and reboot it this way.  The other way is just to pull the electrical adapter which powers your router off the electrical outlet, forcing the router to reboot and reconnect to your ISP.
  • You might also want to disable the SSID broadcast.  When you disable this feature, your machines might not be able to connect to your router using DHCP protocol.  Nonetheless, as long you know how to connect to your router manually using static local IP addresses, then you should be fine.  Of course, you have to remember your router’s SSID name and enter the router SSID onto your machines correctly before your machines can talk to your router.

With The Release Of Reaver, Now Anyone Can Exploit Wi-Fi Protected Setup Flaw Freely; Reaver Releases As Open Source Software

English: Internet wireless router

Image via Wikipedia

Just recently, I had touched on how easy it’s for hackers to exploit and acquire PINs from routers that have Wi-Fi Protected Setup feature enabled (Wi-Fi Protected Setup PIN Method Has Flaw, Allowing Hackers To Deploy Brute Force Attack For Valid PIN Number In Lesser Time Than Before), because there has always been a flaw which associates with this particular feature, consequently allowing hackers to deploy brute force attacks and correctly guess PINs in less time than ever before.  It’s not a surprised for us to see someone has already had a tool which could hack a router for Wi-Fi Protected Setup PIN.  In fact, someone is releasing such a tool to the public already.  So, in a way, we can say once the exploits are known, smart hackers who write their own codes usually can come up with new tools to penetrate the flaws of most computer systems.  In this case, it’s no different, because the folks at Tactical Network Solutions has had such a tool known as Reaver which they probably use to do their own penetration tests on their own networks and clients, as a way to stay ahead of the curve so they can prevent their own networks and clients from being hacked.

Since the Wi-Fi Protected Setup exploit has been discussed publicly, the folks at Tactical Network Solutions are now releasing Reaver to the open source community, and this means anyone can download it and start using it.  Of course, like any tool, bad people can use it to break into other people’s networks, or good people can use it to do penetration tests on their own networks so they will know how resilient their networks would be against certain hack attacks.  The folks at Tactical Network Solutions also release Reaver as a commercial version which they claim it would be even more feature rich than the open source version.

Basically, once Reaver allows the hackers to attain the correct Wi-Fi Protected Setup PINs, the hackers can further more use Reaver to recover WPA/WPA2 passphrase in 4 to 10 hours range.  As long the owners of the routers/networks aren’t yet disabling Wi-Fi Protected Setup feature, no matter if the owners change their WPA/WPA2 passphrase to anything, the hackers will always be able to recover WPA/WPA2 passphrase using Reaver.  This is quite serious, because Reaver is just a tool where anyone can download and use freely.  So, if the manufacturers of most routers aren’t going to patch the flaw, then it’s really up to the users of such routers to disable the Wi-Fi Protected Setup feature.

It seems to me that the folks at Tactical Network Solutions suggest that once hackers guess the Wi-Fi Protected Setup PINs correctly, hackers can take control of the routers.  Worse, I think hackers can also insert themselves into the middle of the compromised networks to listen and sniffing and recording, consequently reading the network traffics for plain text data.  Of course, they can also read the encrypted data in encrypted form only, but hackers who have the will to decrypt the encrypted data might also have tools that allow them to decrypt encrypted data in time.

In summary, if your router hasn’t yet had Wi-Fi Protected Setup feature disabled, it’s currently an easy target for just about anyone who has the will to download Reaver and use it for hacking your router.  Usually, if someone hacks your router, they might have an even more insidious intention than just stealing your bandwidth.  Perhaps, they might use your bandwidth to do some serious hacking against some big corporations, and you would be the one to take the blame.  After all, once the hackers done with what they had to do, they could always clean up their trails and leave almost no trace of theirs behind.  The authorities would have a hard time to believe your story as in “It wasn’t me,” kind of thing.  So, I recommend you to turn off Wi-Fi Protected Setup feature at all cost and wait till the manufacturer who produces your router to come up with a patch that can address this particular exploit.

Sources:  https://threatpost.com/en_us/blogs/attack-tool-released-wps-pin-vulnerability-122911,
http://www.tacnetsol.com/news/2011/12/28/cracking-wifi-protected-setup-with-reaver.html,
http://code.google.com/p/reaver-wps/

Wi-Fi Protected Setup PIN Method Has Flaw, Allowing Hackers To Deploy Brute Force Attack For Valid PIN Number In Lesser Time Than Before

According to threatpost’s article “WiFi Protected Setup Flaw Can Lead to Compromise of Router PINs,” your router with Wi-Fi Protected Setup enabled can allow hackers to take less time to figure out the PIN number and have access to your wireless network.  The article suggests that Wi-Fi Protected Setup reveals too much information when it tries to authenticate a device, consequently allowing hackers to take less time in acquiring the valid Wi-Fi Protected Setup PIN number through brute force hacking method.

I’ve always disabled my Wi-Fi Protected Setup, because it seems to me as if it’s just another door for hackers to break into.  When reading the piece from threatpost, I’m glad that I’d been careful all along.  Most modern routers provide Wi-Fi Protected Setup feature so users don’t have to actually enter long WPA2 passphrase for connecting to a wireless network, because Wi-Fi Protected Setup requires a PIN number (e.g., 1234567…).

I’m no expert on Wi-Fi Protected Setup, because I had avoided using it from the very beginning.  It seems to me Wi-Fi Protected Setup feature has several methods which it’s associated with.  One involves in pushing the Wi-Fi Protected Setup button on the router and then on the client in a short time frame (i.e., less than 2 minutes or so).  After the user pushes the Wi-Fi Protected Setup buttons, user can just stand idle by and wait for the client and the router to automatically communicate with each other, allowing the client to connect to the router, thus the client would be able to surf the Internet using the wireless network which the router provides.  The second method requires PIN number registration, but this very method has two sub methods of its own.  The first sub method requires less work for users, because the users can just hand their devices’ Wi-Fi Protected Setup PIN numbers (i.e., printed on the back of their devices or generated by their devices’ software) to the administrators.  The administrators then have to enter users’ Wi-Fi Protected Setup PIN numbers into a router or access point‘s administration control panel (e.g., https://192.168.1.1) to register users’ Wi-Fi Protected Setup PIN numbers with the access point, consequently allowing users’ devices to connect to the particular wireless network.  The second sub method requires the users to enter the Wi-Fi Protected Setup PIN number of the router or access point onto their devices’ software, consequently allowing the client devices and the router or access point to communicate with each other (i.e., granting wireless network access).  The piece from threatpost emphasizes the weakness in the second sub method of the Wi-Fi Protected Setup PIN number method, because the hackers only need the Wi-Fi Protected Setup PIN number and not having to be within certain distance of the access point or the router.  The third method of Wi-Fi Protected Setup feature involves with Near Field Communication method.  Wikipedia‘s article “Near field communication” explains rather well on how Near Field Communication method works.

threatpost suggests that most modern routers tend to enable Wi-Fi Protected Setup feature by default.  If you are aware about the flaw of Wi-Fi Protected Setup PIN number method, then you might want to disable Wi-Fi Protected Setup feature so the hackers won’t be able to use brute force attack to acquire the Wi-Fi Protected Setup PIN number of the specific access point or router.  threatpost suggests many well known brands are all being affected by Wi-Fi Protected Setup flaw; as long any router has Wi-Fi Protected Setup feature with PIN method enabled, then the hackers who aware of the Wi-Fi Protected Setup PIN number flaw can brute force attack the router for the Wi-Fi Protected Setup PIN number in less time than ever before.

Sources:  https://threatpost.com/en_us/blogs/wifi-protected-setup-flaw-can-lead-compromise-router-pins-122711
http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup
http://www.wi-fi.org/knowledge_center_overview.php?docid=4614