A Look at The Onion Router (Tor)

June 1, 2005

This article was contributed by Joe 'Zonker' Brockmeier.

Last week we promised a look at Tor, a system for anonymous Internet communication, primarily developed by Nick Mathewson and Roger Dingledine. Current development is supported by the Electronic Frontier Foundation (EFF), but Tor was originally developed as part of the U.S. Naval Research Laboratory's Onion Routing program.

As the Tor web page explains, Tor is a "toolset for a wide range of organizations and people that want to improve their safety and security on the Internet". What does that mean? In a nutshell, Tor is a client/server application that anonymizes traffic by routing it from the client through a series of nodes to hide the origin of a request. It can also be used to protect services against denial of service attacks and the like by hiding their origin.

Tor routes traffic through nodes that "know" about the previous node and the next node -- but not the rest of the network. By routing traffic through a series of "onion routers" Tor makes it difficult for the receiver, observers and even other Tor routers to detect the source of traffic. A more complete description of Tor's design can be found in the design paper; a protocol specification is also available for those who wish to build compatible software.

Tor works as both a server and as a client. By default, Tor runs as a client only, but it can be configured to allow other users to connect to your system as a Tor node. In addition, Tor can be used to run "hidden" services that do not reveal your IP address to others at all. The "hidden wiki" maintains a list of hidden services that users can see as an example. Finally, it's possible to set up one's own Tor network that does not interact with the public Tor network, for those who want to test the protocol but may lack access to the Internet.

To achieve best results, one may need to use Tor in conjunction with other applications. For example, users who wish to browse anonymously would use Tor in conjunction with Privoxy. Other applications may require use of tsocks or ProxyChains.

To see what Tor had to offer, we installed it on a Ubuntu Hoary machine, along with Privoxy, tsocks and ProxyChains. Configuring services to work with Tor is not terribly difficult, and there is a relatively detailed HOWTO for users who wish to configure specific applications like Gaim, X-Chat, SSH or BitTorrent with Tor.

It should be noted that using Tor can have an impact on performance for client applications. Using Tor and Privoxy together for browsing, for example, introduced a notable lag. Firefox users may be interested in using the SwitchProxy Tool extension to switch Proxy use on and off, reserving Tor for specific sites rather than for all web browsing. Users should also be prepared for some odd behavior on some sites -- for example, we kept being redirected to country-specific versions of Google, rather than Google's main site, when using Tor and Privoxy. Tor itself didn't seem to have much of an impact on system performance overall.

Tor is not completely foolproof. It could be possible for someone who's running a Tor server to modify Tor or use other software to monitor traffic going through the server. Traffic coming out of the "exit node" (the last hop in the Tor "circuit") is not encrypted, so a malicious user could set up a Tor server and browse traffic coming out of their machine. (It is possible to specify your exit node in the Tor configuration.) There are also potential JavaScript issues, and there are other ways to analyze traffic that passes through Tor.

Interested users should also have a look at the EFF's legal issues page about Tor. Though Tor can be used for things like BitTorrent, it is not designed to assist copyright infringement or other illegal activity.

There is still a lot of development ahead for Tor, but it is definitely worth a look for users who are interested in anonymous communication on the Internet. Users with bandwidth to spare are also encouraged to set up and run a Tor server to help test its scalability and to help provide a larger Tor network. See the download page for Tor packages and source code.

Index entries for this article
GuestArticles	Brockmeier, Joe

to post comments

A Look at The Onion Router (Tor)

Posted Jun 2, 2005 16:07 UTC (Thu) by sjn (guest, #2775) [Link] (2 responses)

There's a video recording of Roger Dingledine having an informal talk about Tor at a Norwegian Unix Users Group meeting in april '05. Do have a look if you're interested! :)

Part 1 of the talk, 198MB
Part 2, 112MB

A Look at The Onion Router (Tor)

Posted Jun 6, 2005 19:40 UTC (Mon) by roelofs (guest, #2599) [Link] (1 responses)

There's a video recording of Roger Dingledine having an informal talk about Tor at a Norwegian Unix Users Group meeting in april '05.

Before downloading a few hundred megabytes, what language are we talking about here? ;-)

Thanks,
Greg

A Look at The Onion Router (Tor)

Posted Jun 10, 2005 15:02 UTC (Fri) by sjn (guest, #2775) [Link]

English, of course. :)

A Look at The Onion Router (Tor)

Posted Jun 2, 2005 21:28 UTC (Thu) by giraffedata (guest, #1954) [Link] (1 responses)

It can also be used to protect services against denial of service attacks and the like by hiding their origin.

I'm having a hard time imagining how Tor could be used for that. It clearly can be used for the opposite: for a DOS attack (or just about any other attack) to circumvent the defenses of the victim. But how would it protect against a DOS attack?

A Look at The Onion Router (Tor)

Posted Jun 3, 2005 6:41 UTC (Fri) by jwb (guest, #15467) [Link]

Tor has the ability to setup hidden services, where the client has no idea the network location of the
actual server. This prevents network DDoS attacks like packet floods, but obviously can't prevent
in-band DDoS attacks by simepl overuse of the service.

A Look at The Onion Router (Tor)

Posted Jun 3, 2005 6:45 UTC (Fri) by jwb (guest, #15467) [Link] (1 responses)

Running a Tor client is a snap, but running a fully-fledged node is turning out to be a pain. The current Tor server leaks memory eagerly. I restart my daemons every hour to keep them in check. Perhaps obviously, Tor can also involve a truly large amount of traffic. A new node I startup used its 192GB/month transfer quota in only 4 days.

I wish the article hadn't brought up the red herring of the exit node "security problem". Your IP traffic always goes through some piece of equipment belonging to someone else. In fact your packets normally traverse dozens of unknown nodes. Tor is no worse than normal networking in this respect. In fact your data is protected through two Tor hops and only exposed at the end, which is superior. If you want end-to-end security, you must use end-to-end encryption. Tor neither requires nor prevents you from doing so.

Carping about the exit node is pure FUD.

A Look at The Onion Router (Tor)

Posted Jun 3, 2005 16:32 UTC (Fri) by rfunk (subscriber, #4054) [Link]

I think the exit node stuff is just to avoid people wrongly assuminging
that Tor avoids all the usual network insecurity stuff, rather than
carping on that insecurity.

A Look at The Onion Router (Tor)

Posted Jun 6, 2005 14:45 UTC (Mon) by dpash (guest, #1408) [Link]

http://www.eff.org/deeplinks/archives/003585.php

BitTorrent designed to assist copyright infringement?

Posted Jun 9, 2005 22:22 UTC (Thu) by raboofje (guest, #26972) [Link]

Though Tor can be used for things like BitTorrent, it is not designed to assist copyright infringement or other illegal activity.

An unfortunately chosen example imho: BitTorrent is one of the few P2Pish protocols that are actually quite widely used for other things than copyright infringement.