On 2016-03-03 15:58, Damian Johnson wrote:
Thanks Aaron. I assume you, Donncha, and Yawnbox would all be mentors?
I would be happy to mentor this project.
Personally I'm not fully groking the idea though on first read I'm unsure why this would take three months (or be enough for a full GSoC project). This sounds similar to DocTor checks with some sort of Routeviews and BGPStream integration.
I think that a new GSoC student might take a bit more time to get up to speed on Tor - and there should be sufficient time to research the problem space more completely to understand the criteria for alerts, and to allow for time to package and deploy the software properly. I think this space is sufficiently interesting and useful that it ought to be a full project, but perhaps some other people have suggestions for expanding the scope? Ideally, the appropriate student will have some additional ideas of their own.
--Aaron
Cheers! -Damian
On Thu, Mar 3, 2016 at 5:47 AM, Aaron Gibson aagbsn@extc.org wrote:
On 2016-02-29 21:18, Donncha O'Cearbhaill wrote:
Damian Johnson:
Hi all, pulled the trigger on this...
https://gitweb.torproject.org/project/web/webwml.git/commit/?id=3ddd63efa529...
Folks are coming out of the woodwork to mentor so we still have ten projects (yay!), but not much concerning core tor. if you'd care to mentor one of these then more than happy to add it back to our page.
Great work on getting the GSoC program together, and getting selected!
I'd be happy to be the second mentor for any Python-based project, particular if it's related to hidden services or network monitoring.
Regards, Donncha
A project I discussed last night with Donncha and Yawnbox is
Title:
IP hijacking detection for the Tor Network.
Description:
IP hijacking (https://en.wikipedia.org/wiki/IP_hijacking) occurs when a bad actor creates false routing information to redirect Internet traffic to or through themselves. This activity is straightforward to detect, because the Internet routing tables are public information, but currently there are no public services that monitor the Tor network. The Tor Network is a dynamic set of relays, so monitoring must be Tor-aware in order to keep the set of monitored relays accurate. Additionally, consensus archives and historical Internet routing table snapshots are publicly available, and this analysis can be performed retroactively.
The implications of IP hijacking are that Tor traffic can be redirected through a network that an attacker controls, even if the attacker does not normally have this capability - i.e. they are not in the network path. For example, an adversary could hijack the prefix of a Tor Guard relay, in order to learn who its clients are, or hijack a Tor Exit relay to tamper with requests or name resolution.
This project comprises building a service that compares network prefixes of relays in the consensus with present and historic routing table snapshots from looking glass services such as Routeviews (http://routeviews.org), or aggregators such as Caida BGPStream (https://bgpstream.caida.org) and then issues email alerts to the contact-info in the relay descriptor and a mailing list. Network operators are responsive to route injections, and these alerts can be used to notify network operators to take immediate action, as well as collect information about the occurrence of these type of attacks.
Estimated time to build this service: 3 months
--Aaron
tor-project mailing list tor-project@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project
tor-project mailing list tor-project@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project