- tor-dev - lists.torproject.org

Fwd: HTTPS Server Impersonation project
by Akshay Hebbar Y.S. 29 Apr '13

29 Apr '13

Hi, I wish to do the project 'HTTPS Server Impersonation' as a GSoC project this year. For that, I propose an approach for implementation. I would like to use Nginx as reverse proxy. Because nginx is very widely used and it is known for its high performance, stability and low resource consumption. Once this is used, this will become the interface for Bridges. All connections to the bridge will be listened on port 443. Two back-end servers for this reverse proxy : 1. Tor itself 2. Web server A special module has to be written for handling the requests. Once the request is authenticated, it will be sent to tor process. Otherwise, it will be sent to web server and suitable response is sent back. Once the new tor client finishes its handshake, its IP address will be mapped to Tor in nginx 'Load Balancer'. Further requests from that IP address will be sent to the Tor directly. How does a bridge distinguish between Tor client and attacker? For this, I need suggestions to select one among the following. 1. Use AUTHORIZE and AUTHORIZED cells as discussed in proposals #187 and #189 2. Provide a public key while giving the bridge address. I.e. When someone requests a bridge address, provide [IP ADDRESS] + [PORT] + [PUBLIC KEY] [ here port = 443 ] Once the client gets the public key of bridge, it can encrypt its data send to bridge. Bridge uses its private key to decrypt the message, and hence only bridge can decrypt the message. If the message received has proper headers it will be sent to tor, otherwise it will go to the default web server. What will the web server contain? Web Server will have some pages which makes the website look like 'online storage site' or 'Online gaming site' or 'social networking site' or something like that. Because a passive attacker can wonder what the client is sending/receiving from a website which looks like 'blog'! Hence from the above discussion, we can achieve the goals of project: a. Impossible for a passive attacker who examines only a few packets at a time to distinguish Tor->Bridge traffic from an HTTPS client talking to an HTTPS server Tor client -> bridge connection will be TLS. So he can't distinguish b. Impossible for an active attacker talking to the server to tell a Tor bridge server from a regular HTTPS server Every ill-formed request will be handled by Web server. c. Against MITM attack If AUTHORIZE and AUTHORIZED cells are used, I need some help in making it preventing MITM attack. If method 2 is used for authentication, MITM attack can be easily prevented. Because even though the attacker receives the packet, he can't decrypt the message since he doesn't have key for decrypting it. Tor client sends this message along with its public key. Hence the bridge can encrypt and send back its response. Once the TLS connection is established then attacker will behave like hop in communication d. Code changes to tor It will be minimum and we just need to implement authorization code. e. Efficiency Once the new client completes its handshake, its IP address will be added to whitelist. Any packets from a client which is in whitelist will not be authenticated by the handlers in nginx. It will be directly sent to Tor process. Please correct me wherever I'm wrong and please give me suggestions to improve it. Thank you -- Akshay Hebbar Y S 6th sem, PESIT-CSE

2 1

About GSOC 2013 Steganography Browser Addon project idea
by Hareesan 29 Apr '13

29 Apr '13

Hey there, I'm Hareesan, undergraduate from University of Moratuwa,Sri Lanka. Interested in working on the project Steganography Browser Addon. I wish to confirm is that a project for GSOC? and Is it a good time to start working on my proposal? I have already gone through few chapters of the paper (Message In A Bottle: Sailing Past Censorship<http://www.cs.kau.se/philwint/censorbib/#Invernizzi2012>) a bit. -- *Hareesan R Undergraduate Department of Computer Science And Engineering University Of Morat**uwa Sri Lanka**** *

3 4

Re: [tor-dev] Stem Integ tests for Tor
by Ashish Patil 29 Apr '13

29 Apr '13

Hi! Thanks atagar, your reply cleared up a lot of things. I am going through the present integ tests in Stem & would contact you if I have any doubts. As for chutney, I suppose nickm's copy of chutney would be the one with most updates (if different from the default copy). I will go through that as well & let you know how much I grasped from it & what all needs to be done further as you mentioned in the reply. Thanks! -Asis

1 0

Re: [tor-dev] Stem GSoC 2013
by Tomasz Kunikowski 29 Apr '13

29 Apr '13

Hey, I favor GSoC projects that are collections of small items rather than a single big one (that way the incremental pieces are helpful, even if the project isn't quite fit into the summer). > We're on the same page here, I think more tasks of a smaller scope is the way to go. The next area I was planning to primary focus was client migrations, > which would involve work with TorBEL and Tor Weather... > I've looked through both TorBEL and Weather and while undoubtedly they could use some love, I think I'll follow my heart and stick with Stem :) Please don't take my ambiguity in regards to any concrete ideas as lack of interest on my side - it's that the more I learn about Stem (and I try to dedicate it most of my free time) the better I can assess its current needs and areas of lacking and come up with something substantial. As far as tutorials go, I was thinking about dealing with manual stream attachment (as a follow up to #8728), exploring more operations on circuits i.e. tearing down, forcing hops through specified countries or address ranges (maybe a more robust example as an excuse to come up with good use cases for REDIRECTSTREAM and TRUNCATE). As for the Stem itself, I'd love to work on adding any missing functionality (against the Tor protocol or expanding the lib itself), but I'd like to hear your suggestions where the real priorities and missing spots are first. Thanks, Tom

3 7

GSoC 2013 - "Compass"
by Emanuel Pascoal 29 Apr '13

29 Apr '13

Goof Night, My name is Emanuel Pascoal, i have 20 years-old and i'm from Portugal. I'm developing studies in the area of computer engineering in the University of Évora. I have knowledge in Python and a little of Java. I would like to make my candidacy in the project named"Compass", that are tagged on your ideas lists for Google Summer Of Code 2013. I would like to discuss the project in order to try to understand the best way to submit the application. I want to know more details about the ideas, so that you can outline what the best ways to make the project as well as the resources that I will need, and be able to think about the time we'll need for the project's development. I would have the most pleasure in work with your community, researching and developing the previous ideas, in any way that i can be helpful. Thanks for the time spent, Emanuel Pascoal

2 1

Source Code Static Analisys
by Ulises Cuñé 28 Apr '13

28 Apr '13

I want colaborate with Tor project. I send a document of analys source code about the lasted version Summary Issues by Fortify Priority Order High 1620 Low 178 Critical 38

3 3

"identity digest" and "hash of a router's identity key"
by Frank Young 28 Apr '13

28 Apr '13

In a consensus, the item after nickname is base64 encoded "hash of a router's identity key" If this item is base64 decoded, is it the same as the "identity digest" of the router?

3 3

Obfsproxy support for Tor Browser Launcher
by Micah Lee 27 Apr '13

27 Apr '13

I want to make it so Tor Browser Launcher users can optionally choose to install teh Obfsproxy TBB instead of the normal one, but I have some questions about that on this issue: https://github.com/micahflee/torbrowser-launcher/issues/38 Maybe someone here knows the answers. Here's the question: Do the obfsproxy bundles have the exact same release schedule as normal TBB? I know what the current alpha and stable version numbers are by looking here: https://check.torproject.org/RecommendedTBBVersions At the moment it seems like the current alpha is 2.4.11-alpha-2, and the obfsproxy bundle is at that same version too. Is it ever recommended to run the "stable" obfsproxy bundle? -- Micah Lee https://twitter.com/micahflee

4 4

GSoC 2013: Build Better Pluggable Transports
by Chang Lan 26 Apr '13

26 Apr '13

Hello all, My name is Chang Lan. I am a fourth-year computer science undergraduate student at Tsinghua University, China, and will be a grad student at Berkeley focusing on networking in this fall. I have been a big fan of the Tor Project for years, as I am actually using it for circumventing the censorship. I look forward to contributing to this project as well. Specifically, I would like to improve current obfsproxy implementation, so that it can resist active censors from scanning its presence. To my knowledge, obfsproxy should avoid responding to handshake requests from clients unless clients have the server's key, which shall be obtained from BridgeDB. I am a newbie at Tor development though, and it would be great if there is anyone willing to talk further with me on this topic. Thanks. - Chang

1 0

Human factors of security software
by Bernard Tyers - ei8fdb 26 Apr '13

26 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello nice Tor people, [I've spoken with Runa about this and she suggested me to send this to the dev list. If it should belong somewhere else, just let me know. Thanks Runa.] Tl;dr: 6 months worth of a reasonably security/privacy/encryption savvy HCI researchers time to carry out a MSc dissertation about usability of security software, and the effect their UIs have on peoples idea of how they work. (You may see this e-mail on a number of lists,I'm mailing each list individually.) Seeing as I am going to be asking for a favour, I should give some information about me. My background is: electronics engineering, network and systems admin, then telecoms engineer (mobile networks). I'm not a coding/security/crypto bod, but security has been part of the past 10 years+ of my work that I can understand some and know where to find/who to ask for the answers for the other. My interest is: HCISEC - Human Computer Interaction in security technology. Security, privacy, encryption tools and why people, who should use them, do not use them. I define a "people who should use them" as human rights activists, investigative journalists, people in countries whose government are oppressive. I define "security, privacy, encryption tools" as "Tor, TBB, Orweb, Orbot, PGP, Redphone, TextSecure, Pixelknot, Silent Circle, Tails, and other tools I don't yet know about. My focus is not with security professionals/experts, technical people who can understand the limitations of these tools, threats they defend against. These users have the technical knowledge and understanding of computing concepts, and threat models, etc which allow them to make a more educated decision. I am doing a masters in human computer systems, and it's coming to the time to start planning my dissertation. My chosen topic (very generally) is: "Usable security and its impact on mental models and trust." Over the next few weeks I want to focus this better. (If you're familiar with the concept, or are not interested, just skip this.) A mental model is a "small scale model of reality" humans create to use to reason, to anticipate events, and to reenforce explanation. Based on the users understanding of a software interface, they will construct an idea of what is happening in an application. If a user creates a number of mental models because a software interface gives different/wrong/conflicting information, this causes the user to be confused, as as result, they will make incorrect decisions, and possibly stop using the software. Given the scenarios where these tools are used, making mistakes, having a false sense of security, or not using them, can be dangerous. There is a lot of research in trust and confidence in recommender systems, transparency in system status, credibility of information provided in user interface, but (from what I've found so far) not much specifically to do with security and privacy tools. So to my request: I have 6 months (beginning from May) to carry out a hcisec human factors focused project. There have been usability evaluations of Tor carried out already, and I was looking for other areas to focus on. I can find a subject myself, but I would like to do some work on an area that could lead to some useful research/provide input to making these tools better, from a user point of view. Is there a question you'd love to see answered? Is there some area of a tool that needs some research? I will also be looking for participants to take part in research - again I am very conscience of the scenarios where these tools are used, and the need to maintain anonymity and privacy. I will be anonymising all research, asking for the minimum information and am happy to carry out communications via secure communications tools. I would appreciate support from users of security and privacy tools. At the end, all research will be released and available for use by the security community if required. At the risk of teaching you to suck eggs, if you are interested in learning more, I can recommend the "Security and Usability: Designing Secure Systems that People Can Use" book by Lorrie Faith Crannor and also the SOUPS Conference (http://cups.cs.cmu.edu/soups/2013/) I look forward to some feedback (on or off list). thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJRY/8bAAoJENsz1IO7MIrrM4AIALW27F757Fn4Jgy3pk0ZX4PQ yl4ToEyJcFmZcKNjlejuTAeeVc00UGLlJRNTPuGT1WAUwt7JhgCYX8p9/YwgA4Pm 1AU6tCHcg9LBpc8ca+0lqBvCh/ZmVf5zTTEVjlXyylrUpqdlR67QemkpyjN0sUJW V7PGPxig2Y3opdVzWZRrmvhLsJf7qN2mAxLUyzSS44nInqpS9+Db1MsDLpI5mof5 ze/FUKV3eTiTzJJ1qLMXbo8VbJvpZO3HgeUFwZH7btbUZQszwrifWupuZefqtro5 nyCNFnUcQ6fyxMOnRLPAji2eAe/fBasQ9h5pCiYVScclddWe1VWhf4poyjVHv9U= =Sak4 -----END PGP SIGNATURE-----

2 3