- tor-dev - lists.torproject.org

Transparent Proxy: how does it work?
by CJ 16 Sep '14

16 Sep '14

Hello dear torrorists :) I'm wanting to do some weird things with iptables in order to force some connections through Tor's TransProxy, but before that I have an interrogation on its internals: How does it detect if we're wanting to use, let's say, SMTP over Tor? Is there any kind of sniffer that tells tor "ok, so this one wants to go to mail.google.com:25, this other one to www.ethack.org:443 with SSL" ? If so, how does it work? It seems it may cause some problems when using Tor on a gateway, like some android device with tethering: forcing tethered connections through tor [orbot] seems to be really hard. Thank you in advance for your enlightenment. Cheers, C.

1 0

Why the seeming correlation between flash proxy and meek on metrics graphs?
by David Fifield 16 Sep '14

16 Sep '14

In comparing the user graphs of pluggable transports, I found that there seems to be a correlation between the graphs of flashproxy and meek. They are not equal, but they seem to go up and down at the same time. Other transports don't show such an effect as far as I can tell. What could the cause be? I am trying to rule out a measurement error. Could it be an artifact of both transports running on the same bridge? After the "How to use meek" blog post on August 15, there was a noticeable increase in the number of meek users, from about 5 to about 20 concurrent users: https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… The blog post also seems to have had a positive effect on flashproxy and scramblesuit, too. I suspect it is because the blog post also named other transports and suggested to try them first: https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… On the other hand, I don't see any noticeable rise for obfs3 and fte: https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… What's interesting is when we plot meek and flashproxy together (this is the first attached image). There seems to be a strong correspondence between the two. They both jump on August 15, as expected, but then they both jump again together on August 21. In early September they settle back down, but still mostly match each other's up/down patterns: https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… What's really intriguing is that the apparent correlation goes back in time, even before August 15. Compare the shapes of the graphs during July, for example. The correlation between meek and scramblesuit appears to be not as strong (this is the second attached image). There's a rise around August 15, but no big secondary spike, although the first part of September matches pretty well. https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… There's no obvious positive correlation between meek and fte (this is the third attached image) nor meek and obfs3 (this is the fourth attached image). https://metrics.torproject.org/users.html?graph=userstats-bridge-transport&… Why could this be? Some hypotheses: * meek and flashproxy have similar capabilities (resistance to IP blocking), so maybe the circumstances where they work are similar. If one works, so does the other, so we expect them to more or less track one another. * There is a bug in metrics collection, so that, for example, sometimes a meek connection is counted as flashproxy or vice versa. The backend bridge for both meek and flashproxy is the same; i.e., tor2.bamsoftware.com. (Before May 8, 2014, it was a different bridge, namely tor1, but both transports were still running on it together.) * After my blog post, a bunch of people just picked transports at random until they found one that worked, which was likely one of {flashproxy, meek, scramblesuit}, and now we're just seeing the aggregation of those user's daily usage. Doesn't explain a match before August 15, though. To figure this out I'm thinking of i) counting bytes transferred on the flashproxy and meek external ports, or ii) moving one to a different bridge (or different tor instance), to see if the effect remains. Do you have any other ideas? David Fifield

2 4

Debian popcon as a vulnerability?
by Griffin Boyce 15 Sep '14

15 Sep '14

Hello all! I am wondering whether to force-uninstall Debian's popularity-contest package as part of Stormy's installation process. It would be good to have an idea how popular Stormy is, but on the other hand, I'm not sure how anonymous the reporting is on Debian's end. This is also relevant for users of the tor package, who might also be at mild risk (though far less so because the number of users is so high, and doesn't reveal location of location-hidden services). Anyone have opinions on this? I'm leaning towards checking if popularity-contest is installed and then asking if the user would like it to be removed. If y'all have other recommendations, please comment here or on the ticket. Ticket: https://trac.torproject.org/projects/tor/ticket/13154 thanks! Griffin -- "I believe that usability is a security concern; systems that do not pay close attention to the human interaction factors involved risk failing to provide security by failing to attract users." ~Len Sassaman

3 2

Re: [tor-dev] Symlink to latest sources
by Peter Swire 15 Sep '14

15 Sep '14

Dear Roger, You've avoided that for both binaries and sources? That's interesting. I guess it makes sense, if it's been a problem before. I mostly would like to be able to wget the the sources and build them automatically, without having to specify a version number. Whenever I setup a new machine, I like to make it a tor relay; I don't particularly care about versions, just as long as it's new enough to not have any old vulnerabilities. Best, Peter > Hi Peter, > > So far we have avoided doing this approach, since it increases the number > of user support cases where we ask "what version?" and they say "latest" > because their file name doesn't actually tell them what version it is. > > I guess we could try adding the symlink but then never tell anybody > about it, in hopes that users will keep downloading the files that have > version numbers in their names. > > What problem are you trying to solve? > > --Roger

4 4

Tor Research Framework update
by Gareth Owen 12 Sep '14

12 Sep '14

Hi all I thought I'd give you an update on where the Tor Research Framework is now at as there's been lots of development over the last few weeks. At present, the framework is a largely fully functional tor client with code that is easy to read, follow and crucially change for custom functionality. URL: https://github.com/drgowen/tor-research-framework Completed ======= The examples exercise a big chunk of the functionality so in the examples directory, we now have examples on how to do: - Circuit building, Random circuits based on flags, etc - Building HS circuits and establishing streams to their service - Consensus parsing examples - RELAY_EARLY scanner - scans HSDirs looking for RELAY_EARLYs coming the wrong way (aka the recent Blackhat deanon attack) - Tor SOCKS Proxy and PortForwarder The examples are here: https://github.com/drgowen/tor-research-framework/tree/master/src/main/java… The RELAY_EARLY scanner took around five minutes to write for example and didn't require modifying core library code. Work in progress ========== Fuzzer: We also have another chap (twilsonb) working on a fuzzing framework for Tor that is capable of fuzzing the protocol and directory services - although this is at early stage I'm sure he'd welcome help from anyone interested. Relay: We're working on building the capability to act as a Tor relay with examples for building malicious guard nodes that deny circuits or do correlation attacks. Naturally, we'll also look later down the line at optionally integrating with the shadow simulator for research which shouldn't be done on the live network. -- If anyone is interested in helping out then please dont hesitate to get in touch. Best Gareth -- Dr Gareth Owen Senior Lecturer School of Computing, University of Portsmouth Tel: 02392 846423 Web: ghowen.me

3 10

Let's talk about Globe/Atlas development this Thu, Sep 11, 14:00 UTC in #tor-dev
by Karsten Loesing 11 Sep '14

11 Sep '14

Hello front-end web developers, almost two months ago, Philipp and I started a call to find new developers for one of the two main Tor network status websites Atlas or Globe: https://blog.torproject.org/blog/looking-front-end-web-developers-network-s… We received great replies from some of you, but we failed to give you enough input to start developing. Unless you did start developing and we totally failed to see your results! We should fix this failure to communicate. Let's meet on Thursday, September 11, at 14:00 UTC in #tor-dev on OFTC and talk about Globe and Atlas development. If you're interested in front-end web development and want to help, even if you missed our original call, please join us. To be clear, neither Philipp nor I will be leading this development effort, mostly because neither of us knows enough about front-end web development to be a good leader. We're rather hoping to bring a few interested web developer folks together and answer any of your questions about relevant Tor specifics or about the back-end data service Onionoo. But let's talk more about that on Thursday! All the best, Karsten

1 1

CGI and Hidden Services
by TerryZ＠Safe-mail.net 10 Sep '14

10 Sep '14

Hi, Does CGI work the same way it does with regular websites when using it for Tor Hidden Services? Do the methods POST and GET work the same over Tor on Hidden Services? Thanks

2 1

Re: [tor-dev] Let's talk about Globe/Atlas development this Thu, Sep 11, 14:00 UTC in #tor-dev
by Tim 10 Sep '14

10 Sep '14

Dear Globe/Atlas Developers, When I used Atlas today with JavaScript turned off, it looked like it didn't work. I've heard that the Tor Browser is moving towards JavaScript being off by default (or, at the very least, one of 3-4 security level options). As you redevelop, can you consider making Atlas/Globe work without JavaScript, or, at the very least, teach it to ask for JavaScript? (Alternately, I may have made a mistake in assuming that JavaScript was the issue. Web development / bug reports really aren't my thing.) T On 9 Sep 2014, at 22:00 , tor-dev-request(a)lists.torproject.org wrote: > Date: Tue, 09 Sep 2014 11:00:00 +0200 > From: Karsten Loesing <karsten(a)torproject.org> > To: "tor-dev(a)lists.torproject.org" <tor-dev(a)lists.torproject.org> > Subject: [tor-dev] Let's talk about Globe/Atlas development this Thu, > Sep 11, 14:00 UTC in #tor-dev > Message-ID: <540EC190.3010200(a)torproject.org> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello front-end web developers, > > almost two months ago, Philipp and I started a call to find new > developers for one of the two main Tor network status websites Atlas or > Globe: > > https://blog.torproject.org/blog/looking-front-end-web-developers-network-s… > > We received great replies from some of you, but we failed to give you > enough input to start developing. Unless you did start developing and > we totally failed to see your results! We should fix this failure to > communicate. Let's meet on > > Thursday, September 11, at 14:00 UTC in #tor-dev on OFTC > > and talk about Globe and Atlas development. If you're interested in > front-end web development and want to help, even if you missed our > original call, please join us. > > To be clear, neither Philipp nor I will be leading this development > effort, mostly because neither of us knows enough about front-end web > development to be a good leader. We're rather hoping to bring a few > interested web developer folks together and answer any of your questions > about relevant Tor specifics or about the back-end data service Onionoo. > > But let's talk more about that on Thursday! > > All the best, > Karsten

2 1

Lowercase-t-tor patch workshop on #tor-dev IRC channel
by rl1987 09 Sep '14

09 Sep '14

Dear tor-dev, Everyone who is working on any kind of improvement to lowercase-t-tor code and would like to give/receive assistance (code reviews, advice, etc.) is welcome on Tuesday, September 16, 17:00 UTC @ #tor-dev OFTC channel This might become a regular weekly thing, if it proves to be successful.

1 0

Pluggable transports meeting tomorrow (16:00UTC Wednesday 10th of September 2014)
by George Kadianakis 09 Sep '14

09 Sep '14

Hola brothers and sisters, just wanted to remind you that the regular biweekly pluggable transports meeting is going to occur tomorrow at 16:00 UTC. Place is the #tor-dev IRC channel in the OFTC network. As you see, the meeting day was recently changed from Fridays to Wednesdays: https://lists.torproject.org/pipermail/tor-dev/2014-August/007317.html Thanks for your attention!

1 0