- tor-dev - lists.torproject.org

GSoC: A Framework for Website Fingerprinting Countermeasures
by Marc Juarez 22 Apr '14

22 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, My name is Marc Juarez and I'm a PhD student at KU Leuven [0]. I'm going to work in the GSoC project "A Framework for Website Fingerprinting Countermeasures" [1] that will be mentored by Mike Perry and Yawning Angel. I'm very excited about this project because my research now is on website fingerprinting topics. The main goal of the project is to implement the building blocks for a future padding based website fingerprinting countermeasure [2,3] as a pluggable transport. These days I'll be familiarizing with obfsproxy and twisted and getting things ready to start coding on May 19th. I will try to keep everybody updated and I'm looking forward to any advice and comments. If anybody needs to contact me, this is my main email and my oftc username is mjuarez. Best, - -- marc [0] http://homes.esat.kuleuven.be/~mjuarezm [1] http://homes.esat.kuleuven.be/~mjuarezm/GSoC14Proposal.pdf [2] https://blog.torproject.org/blog/critique-website-traffic-fingerprinting-at… [3] https://trac.torproject.org/projects/tor/ticket/7028 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTVj4UAAoJEGfJ5xfgazlxNC0H/2mBLaaqoxk3oAPcFBqagJDN 2gWU0VA0o3XXzVxAvuB5ikEimNKmCGVimMGhC71shZe3Ot26AzJtD3dqFSNGtucB 5lzZR/tcsHjp2TDChePnQH/iDHNMY+VrdakkM/gjWorqjQHutrqGW+1crhkwscCO nJEcA4kinrQQc4mN/xTNHva6HDFx99e9Qs6N6sbumsdlNO3cew7Ly0NhTs7Jn4Jm U1/JlmnCfNyIArd65Ywcaqsb7ZMnKcu00DT34/1uNYqAbxEP+MQ3yH2IJjDHVgM3 7L1wTCM0OjsWVmVu5boQqsTeneRh0LzfdtBKdmQQJqfsPOgcOjskyALHwcjXt5s= =v9eI -----END PGP SIGNATURE-----

1 0

Tor Cloud - Issues/Maintainer/Next Steps
by Sina Rabbani 21 Apr '14

21 Apr '14

Dear Team, I have created a ticket for Tor Cloud, I think I need access to the following assets: Tor's Amazon EC2 account login, or API access Access to update cloud.torproject.org and git.torproject.org/tor-cloud.git Access to update blog.torproject.org with latest Updated in regards to Tor Cloud Please let me know how to move this ticket forward. All the best, SiNA -- "be the change we wish to see in the world." Gandhi

2 2

Python Only Tor Client?
by Fabio Pietrosanti (naif) 21 Apr '14

21 Apr '14

Hi all, does anyone know of any work to make a Python Only Tor Client, that just enable to expose a Tor Hidden Service? It would be very cool if it would be possible to avoid "Tor binary" as a dependency for Globaleaks, making it pure Python application code. The questions are: - Are there projects that foresee to do something like that? - From a Tor Project perspective, does it make sense? - From a Security perspective, are there strong security implications in doing so? -- Fabio Pietrosanti (naif) HERMES - Center for Transparency and Digital Human Rights http://logioshermes.org - http://globaleaks.org - http://tor2web.org

4 3

Re: [tor-dev] Python Only Tor Client?
by Jacob Garber 21 Apr '14

21 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 4/21/14, Fabio Pietrosanti (naif) <lists(a)infosecurity.ch> wrote: > Hi all, > > does anyone know of any work to make a Python Only Tor Client, that just > enable to expose a Tor Hidden Service? > > It would be very cool if it would be possible to avoid "Tor binary" as a > dependency for Globaleaks, making it pure Python application code. > > The questions are: > > - Are there projects that foresee to do something like that? > > - From a Tor Project perspective, does it make sense? > > - From a Security perspective, are there strong security implications in > doing so? > I have been considering such a project, though my purpose for pursuing it would be to both learn Python and to come to a better understanding of the internals of Tor. Perhaps not the best circumstances for a solid implementation... For the time being my implementation is just going to be an experiment with trying to speak the Tor protocol, but assuming that I can get some of the basic building-blocks working I'll be pursuing a Tor rewrite in my spare time (I'm currently a student, and as such still sorting out my schedule). I'll probably be in and out of IRC and these mailing lists asking questions every now and again (and trying not to ask stupid ones). - - ajtgarber (0xEFDA75F9) A190 2527 2D58 6A2B 8108 CB66 D57A A16A EFDA 75F9 -----BEGIN PGP SIGNATURE----- Version: n/a iQIcBAEBAgAGBQJTVV/4AAoJEEyLqVBnwH7XGu0P/3e0ZI+y067si2PItq4xWsaq +NLIzEymUjoSEM8iaYkZVumcOofY+yD1vCEGIvUroCvymC0YWFH+FYw5jkiffjRX 6wmc/d25ARtT/wVP59Nrmi+P9ZpD1fMaNaQ68eS3rnIPbZHc/ONsemXnW3g/m49Q zPViKtXNu3/1pmix33yS2SSU8uJIPd9j7NWDV3lxZ9fOlFfv0TocgJgvYdx0gVJC QGXiK6dprGgXhEy4+pzxDroUbKynh0pwd6N5ZiwlCbhcSAeIps87zGPldnasb8cA ZHEcyG8Gvlsoat/kQAVI7EwLYS3HCXiqKnhmoB1hXllDG6pJpYK1FufwGYyvlUZM ds1s0OQymmuftgEFcAbuInBlbqKihwllspMGdoz6SjBj50+iYqG3K/XP5yhyiZBx fk6X4LhAPh+GCClSRPn7ZV6oPDqrc/T3yodcUfGoKAlZiFQkCkX/DZUITr59Sb1g Hy7CKBIUdrzvK0B4XLf9gdVpf/pZCy0CTUikZbnke2ctyEseKkQbiZGLYIC5+ueT VJTGYtlFxZtblz3dh+lfwEI5HAPQRaa/cR6yRJd4yxvIOGlFNNAyn4E4HXuI4K+L VoWaDoFQQButYMlx8LiYt228HGVQkfxPpwX5OWH8u2BJpRYqKblGWpGu2bvkgiyw ZpsBF6B/8v+FTLN0fMk6 =s4ji -----END PGP SIGNATURE-----

2 1

Potentially n00b question about Tor Cloud & Heartbleed
by Peter B 21 Apr '14

21 Apr '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hi all, As I understand, there are two steps to mitigating the Heartbled bug for Tor bridges: 1. Upgrade OpenSSL 2. rm -rf /var/lib/tor/keys/* and restart the tor procses While the bridges on Tor Cloud (and therefore Access' Global Proxy Cloud) are configured to automatically fetch updates, there is no way to complete step 2 with SSH access, correct? If so, is there any plan to deal with instances that were set up with the vulnerable version of OpenSSL, but whoever set up the instance has not or cannot regenerate the keys. - -- Peter Bourgelais Circumvention and Network Interference Technologist Access | accessnow.org | rightscon.org PGP ID: 0x1C16F6D8 Fingerprint: EC9B 18C2 EBF4 07E0 37C6 E306 6592 DE70 1C16 F6D8 Github: https://github.com/pbourgel -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJTVUToAAoJEGWS3nAcFvbY15oP/31qpnsLAFZZiuvsQ19jwx6C 74drB1P8zdr8cpAvCVMpmEGRE1hDHTB4iyKQ4rttaAhJu5D5ukP+pGvL+bIL7bTC mzyww37gZE4Fh/ydyaUEQSPw6dBR0pMpKl61/DUKsvF2G/62gW8c5j/+ZXlvBYb8 5tX1ecfWF3LAuBDqrFK0EHtysZ8JfwjRz9aOBR/ZuGM9NKW2UN5iLljxsq7nKIIx YFDKEwPJKPV8t4AsaAxv1Z6ctFqAOSmFObj5Ku9Ifc8vgpSKx9yZpuAttpfaEwYT wf+PHvn1hZNzHb/UZ5ZaIBqP63w+xqTLUEmoDrO9qwSUsi2DhCPUCvKhQ7wzWsnZ 3U+GvmsV3c1JGHCroXii+B2hu04DI0fKxboyFdy+x19PvAMf4UAEIwAG+X0FO9dS pd1F8Zq5ohXItjdAm6ZxGtOL1Q9KHU29G9liYjj/N9NYq7iQLd59CNhoELHulYoO BYBUyTzVwASYIDPbcUZ63z23vCk+ymfX95JTj2J4LK0ZbmJWhe+23ZOIfXiF/v/t 5UBoSIPok336NmsNv7vGMV8O8PuqsEm6/Gv9CCETlUw+wzrSdlu3K0QhLjYagj0C Fl8uEiKzH1LzavdBsSMfDKCGQya4LbvWSnDM2DmHWra3hPG6xJMvnMPxCdqr73dv vGezCcQBb6limTdHW1xH =xqRh -----END PGP SIGNATURE-----

1 1

Starting Tor from Python using Ctypes improving Sandboxing?
by Fabio Pietrosanti (naif) 19 Apr '14

19 Apr '14

Hi, currently starting Tor from an python application using existing frameworks (such as txtorconn) provide limits related to the capabilities of sandboxing the application itself with AppArmor. If you want to start Tor from your own application, then you must enable such application to "execute" an external binary called /usr/bin/tor . I'm wondering if anyone ever tried to start Tor from a Python application using Ctypes, to start the Tor "main()", placing the Tor process into a dedicated Python's application Thread. That way it would be possible to sandbox the Python application using AppArmor without enabling any kind of execve() call. Does anyone ever tried this? -- Fabio Pietrosanti (naif) HERMES - Center for Transparency and Digital Human Rights http://logioshermes.org - http://globaleaks.org - http://tor2web.org

1 0

consensus-health.torproject.org
by Michael Wolf 19 Apr '14

19 Apr '14

I think I can make some improvements to the consensus-health page (mostly removing redundant formatting code in the HTML), but I can't seem to find the git repo for the project listed at https://gitweb.torproject.org/ Could someone point me in the right direction? I another pertinent question would be: is anyone using any scripts that scrape this page, which might be broken if things are changed? An example of a change could be: since the flags in the "Consensus" column seem to always be blue, remove all the <font color="blue"> tags, (and closing tags) in the consensus column, and replace them with one class per <td> in that column. I estimate that this change alone would save about 575KiB in the uncompressed HTML. That's about 10% of the document's uncompressed size, without even using any CSS3 trickery. -- Mike Wolf

2 1

Please try 3.5.4-meek-1 bundles (covert HTTPS pluggable transport)
by David Fifield 18 Apr '14

18 Apr '14

A while back I wrote about a pluggable transport called meek that routes your traffic through a third-party web service in a way that should be difficult to block. There are now experimental bundles featuring this transport, ready for somewhat wider testing. Please try: https://people.torproject.org/~dcf/pt-bundle/3.5.4-meek-1/ The files are signed with my key 0xC11F6276 from: https://www.torproject.org/docs/signing-keys https://www.bamsoftware.com/david/david.asc You don't have to do anything in the configuration. Just click "Connect". What you'll see, if you look at your network traffic, is a lot of HTTPS requests to www.google.com. (And no connections to any Tor bridge, nor anything speaking the Tor protocol.) Behind the scenes, Google is passing the requests on to our web app, which then forwards them to a Tor bridge. More on how the whole system works is at https://trac.torproject.org/projects/tor/wiki/doc/meek. Another thing to know is that starting the browser will run a second, headless instance of Firefox. The second browser is used as a tool for making HTTPS requests. It's the same Firefox binary used by Tor Browser (so it doesn't increase the size of the bundles), but it has a special configuration and an extension that allows it to access the network directly. When you're using meek, this browser extension is in fact the only thing that touches the network, but you never interact with it directly--it only takes orders from the client transport plugin. We do it this way so that the HTTPS requests look like they come from a browser, and are not fingerprintable as coming from some custom SSL program. The second browser should be completely invisible to you--except on OS X, where it creates a second dock icon (this is bug #11429). These bundles are experimental and you shouldn't use them to replace your main browser just yet. We're most interested in hearing about what didn't work for you or what was surprising. I'll write another post about code review and other things that need to happen before you'll see meek in a mainline bundle. David Fifield

1 1

[Flashproxy] Some sites filtering users?
by Griffin Boyce 18 Apr '14

18 Apr '14

Hey all, Got a report from a friend* who noticed that twitch.tv stops letting him watch broadcasts while flashproxy is in an active state. He uses Cupcake, which shows flashproxy's status in the icon bar, and he only has an issue when the cupcake icon has a mustache. Has anyone noticed similar behavior when using flashproxy? ~Griffin * who is a hacker

1 0

Combining obfsproxy+scramblesuit with OpenVPN
by irregulator＠riseup.net 17 Apr '14

17 Apr '14

Hello people, I'm investigating how may we combine the traffic obfuscation provided by obfsproxy+scramblesuit with OpenVPN instead of Tor. I completely understand how this combination does not provide anonymity, but nevertheless I think it will be of some use. In the recent past there have been some interest in this combination [1], [2], [3], mainly cause of VPN traffic blocking in various countries or networks. OpenVPN supports only Socks5 proxy but current obsfproxy's version doesn't have a Socks5 listener, see ticket #9221 [4]. Luckily yawning provided a patch some days ago [5], and I decided to test it. According to patch's comments, it implements a Socks5 proxy with authentication as in RFC 1928/RFC 1929. This authentication is gonna serve as a means to pass parameters to the pluggable transport, please correct me on this one. Firstly, does this patch and generally obfsproxy development takes in consideration other clients except for Tor, e.g. OpenVPN or OpenSSH ? I think it would be very nice to have a way to combine OpenVPN with Scramblesuit as stated in the latter's paper. But then I'll understand if that's not a priority for obfsproxy's developers. So, while testing OpenVPN with obfsproxy and the latest patch, the vpn client enters the authentication phase. Do the credentials depend on the pluggable transport in use by the obfsproxy? If so, what credentials should the vpn or the ssh socks client provide when talking with scramblesuit? Will vpn client have to provide the session ticket or other pre-shared secret through socks authentication? Thanks in advance for any answers. Alex [1] http://community.openvpn.net/openvpn/wiki/TrafficObfuscation [2] http://www.dlshad.net/?p=135 [3] https://www.void.gr/kargig/blog/2012/10/05/bypassing-censorship-devices-by-… [4] https://trac.torproject.org/projects/tor/ticket/9221 [5] https://trac.torproject.org/projects/tor/attachment/ticket/9221/0001-Use-SO…

7 12