Mystery malware destroys 600k routers from a single ISP during 72-hour span

Re:Mystery malware destroys 600k routers from a single ISP d... by londons_explore on Friday May 31, 2024 @03:48AM (#40532457)

But... That tor exit node then sends the traffic onwards... Again via the internet, and the backbone provider can inspect it again.

Seeing a packet heading to a tor exit node and then a similarly sized packet heading onwards a fraction of a millisecond later is a pretty surefire way to spy on individual tor users.

[ Parent | on HN ]

Re:Mystery malware destroys 600k routers from a single ISP d... by Thorrez on Friday May 31, 2024 @05:23AM (#40532943)

I think Tor tries to resize/split/join packets a bit. And each Tor node will in theory be carrying traffic for many different users simultaneously. And Tor uses 3 nodes, each in a different country. So it's not quite as trivial as you make it sound.

If 1, 2, or possibly all 3 nodes are run by a malicious actor, deanonymization becomes easier. At one point 10% of nodes were run by a single malicious actor: https://therecord.media/a-mysterious-threat-actor-is-running...

[ Parent | on HN ]

Re:Mystery malware destroys 600k routers from a single ISP d... by Pingk on Friday May 31, 2024 @12:22PM (#40537035)

Yes, being able to see all the traffic on a given network is a legitimate threat to Tor's anonymity.

IIRC There is an alternate method of connecting to an endpoint which uses a 3rd node as a rendezvous point which is meant to be better, but I forget the name of the process...

[ Parent | on HN ]