We define it as a new attack mode of exit nodes. When we observed the behavior of exit nodes in tor network for a long time, we find a phenomenon: the host IP address directly connected to the target website is inconsistent with the consensus IP address of exit nodes. These works have achieved remarkable results, but in the face of some new malicious exit node attacks, the results of the above methods are not satisfactory. In 2016, Philipp Winter’s team again designed Sybilhunter tool to detect the sybil nodes of the Tor network . designed the ExitMap tool to detect malicious exit nodes . For example, Tor officials launched Tor Metric project to measure the ecology in Tor network.
Tor officials and some researchers have launched defense against some common exit node attacks, such as traffic sniffing, DNS pollution and SSL based attacks through practical work. The attacker can hijack the transaction traffic and fake the content in the traffic by implementing man in the middle attack , so as to gain profits. Because the exit node acts as the middleman between the client and the target website, it is common for attackers to attack by controlling the exit node. , The reason why attackers are happy to implant malicious exit nodes may be that some government or school researchers try to destroy the anonymity of tor network Another kind of attacker is for benefit. A lot of work has proved that attackers have caused great harm to the anonymity and stability of tor network by manipulating controlled nodes . Since the relay nodes of Tor are contributed by volunteers, attackers can implant malicious nodes with different roles into tor network at a very small cost to realize their attacks, such as sybil attack . Therefore, the identity of the exit relay node is very sensitive, which is directly related to the security and privacy of client traffic. This may directly expose some client traffic without encryption means (such as HTTP requests) to the attacker’s vision. Since the exit relay node is the last hop from the Tor network to the target website , it means that Tor’s onion encryption algorithm will not be able to protect the traffic between the exit relay node and the target website. As of August 2021, there are approximately 1,300 exit relay nodes in the Tor network to provide services for clients . Tor provides a safe and concealed channel for clients to access the clear network.
0 kommentar(er)
