Astarte
Can't edit my other reply. The operator in the OP runs 68 nodes. I did not look at each one, but it looks like most, if not all of them are guard nodes. This article mentions someone running at least 10% of the guard capacity: https://medium.com/@nusenu/the-growing-problem-of-malicious-... Tor's design obviously failed. Everyone can become a guard. You just need some patience. Also other nodes like DirAuths, bridges, fallback directories can discover Tor users.
Go on.
I have been thinking about this for a while, too. There is some Tor fork which allows non-exit nodes to exit. It has been posted on tor-talk a while ago. For a private guard you would need to change the local consensus file and include the private guard. Then you would also need to control the next hop so it recognizes your guard as first hop and connect you to the third hop. I don't see why this won't work in principle.
I'm not familiar with bridges or the snowflake proxy but I think this would work:
Public bridges are public so no one cares about those. Now you run your own private bridge. First of all running your own leads directly back to you. Second it puts you on the list of even more paranoid people. Since you know and connect to that private bridge one can assume you trust that bridge for whatever reason which indicates some kind of "personal" relationship to that bridge.
The private bridge now connects to the second hop. This is a malicious one. The operator sees an IP which does not come from an official relay in the consensus. I don't know if a node knows he is in the middle (at least a guard and exit must know they are at the beginning and end of a chain, i guess?), but if he does he would now know that a private bridge is connecting to it. So you could enumerate private bridges.
If someone runs dozens of nodes, which is actually happening, this looks like a viable option. Correct me if I'm wrong.
Yes. This is happening on a fairly regular basis. ddos against a tor node in most cases is just trying to figure out someones IP address or guard node. If you run a big darknet site dealing with things like drugs, CP, fraud, and you want to stay around for a while you need to run lots of nodes otherwise you will be pwned probably within hours. There is no point in doing that for legal onions sites like facebook because everyone knows their real operators. Now when you run lots of nodes and at the same time a big website on the darknet you are in the perfect position to run traffic correlation attacks yourself. There is some tutorial available which suggests using some deceptive methods to spoil such tracing efforts. For example when website A is going down you also shut down your site. Or when there is a big blackout of AWS US etc
Do you really think they care about that 1% (made up number) of Tor users using their service legitimately? Or do they just want to avoid being attacked or their service being abused?
"In April 2018 a Tor core member — the most active Tor Project person on that closed mailing list — made an attempt to initiate a “do not do” relay requirements list to improve and streamline the handling of malicious Tor relay reports. (I’m not mentioning his name since he does not want to be publicly associated with bad-relays handling for safety reasons.) Unfortunately also this attempt failed since no Tor directory authority operator answered. (Tor directory authorities are required to enforce any Tor network wide rules unless it is part of the tor code itself.)
Starting with June 2019, after multiple reports about suspicious relays remained with no reaction I stopped sending them to the list. Occasionally I sent some suspicious relay groups to the public tor-talk mailing list instead — which ironically was more fruitful."
https://medium.com/@nusenu/the-growing-problem-of-malicious-...
Even more ironical, the very person which reported that issue and similar ones (also on twitter) got his twitter account closed shortly afterwards (see other post on that site). So he has much less audience than before. Coincidence? Tinfoil hattery? Maybe. But certainly fishy.
Some say it is one of the most attacked browser ...
>However, we have no clue how many users in authoritarian regimes have been pwned by similar malware, over what we'd call human rights issues.
Maybe not as much as you believe. The OP is talking more about traffic correlation. The FBI's attack came from the browser, this can also aid in correlation attacks but was irrelevant in the FBI's case. In authoritarian regimes you can just attack from the network side and log each IP which tries to connect to a Tor node. Then you visit those people personally. Or like in so many authoritarian regimes you just block Tor completely. Neither a firewall or Tails or Whonix will protect you against traffic correlation attacks.
Once in while, Tor node operators will complain about DDOS on the tor mailing lists or similar sites. In most of the cases this is just an attempt to figure out guard nodes or real IP addresses of an individual or server.
I don't get that. Every guard can discover users because the users directly connect to guard nodes. As a guard you can just collect the real IP addresses of Tor users except they use a VPN or proxy to connect to the Tor network.
There are single operators that run dozens of nodes. Just take a look at the article. Anyone can setup nodes and give no contact info or just change it to something else. I could spin up nodes as gzer0 and the next week add new ones as gze1. You could run hundreds of nodes as a single person without anyone noticing it.
>and a lot of time and patience
Tor has been around for a while ... Creation of nodes, which mostly are just VM's running in some datacenter, can be automated to some extend.
> and somehow knock off all of the non-malicious guard-nodes
There is no need for that. When you become the malicious guard of someone, by design, you can run correlation attacks for months. Just be patient and probability will do the rest for you.
Tor is not as secure as it (maybe) once was.
Related reading: https://medium.com/@nusenu/the-growing-problem-of-malicious-...
Also when being a guard you get the IP addresses of Tor users. Using Tor puts you in a group consisting of "interesting" people. No, these are probably not thousands of whistleblowers and people from oppressed regimes (well maybe russia). The majority of traffic comes from the US, and western European countries. Interesting people are: hackers, fraudsters, crawlers (guess why many sites block Tor), drug dealers, drug users, pedophiles, literally everything (cyber)crime and people having something to hide. A list of those people would be quite interesting wouldn't it? Even if there would be thousands of whistleblowers these are persons of interest, too.