The dangers of operating a Tor exit node

http://calumog.wordpress.com/2009/03/18/why-you-need-balls-of-steel-to-operate-a-tor-exit-node/

by vaksel • 17 years ago

96 59 17 years ago

calumog.wordpress.com

From the computers I've been asked by friends and family to repair of their malware epidemics lately, I could retitle this article "The dangers of operating Windows XP". Every single one has been in one botnet or another.

Tor is a sticky problem, sure, but uninformed law enforcement is as well. An IP is not a telephone number. With the onslaught of voip, soon a telephone number won't be either.

At least this case had a prosecution free resolution.

ryanwaggoner• 17 years ago

I found this part at the end of the post amusing:

They need to be disciplined and retrained, and their senior managers need to be named and shamed, as they are an unacceptable risk to innocent members of the public, and the real criminals must be running rings around them.

There's absolutely no incentive for the police to understand these things (or let on that they do) and avoid freaking out "innocent" members of the public. Look at this example: this guy won't be running a Tor exit node again, so in a way, they got what they wanted.

alecco2• 17 years ago

Blogspam, flagged.

Original: http://calumog.wordpress.com/2009/03/18/why-you-need-balls-o...

cdr• 17 years ago

It looks like the link now points there; I assume it was fixed. Shouldn't this comment be deleted now if that's the case?

alecco2• 17 years ago

I'd love to, but I can't delete it now. (Maybe after a while you can't or after a reply?)

poutine3• 17 years ago

Because of the ignorance of the police you need to be nuts to run a Tor exit node.

I don't much see the point in Tor anyhow, you want to be anonymous for some reason just use an unsecured WIFI AP or a proxy in another country, easy enough.

huhtenberg2• 17 years ago

> Because of the ignorance of the police you need to be nuts to run a Tor exit node.

You'd be nuts to do that because 90% of the traffic going through your node will warrant legit police interest.

orc• 17 years ago

So are you saying that 90% of the people who want privacy want it for illegal reasons? Then you won't mind if I read all your email?

That's what I thought.

jonas_b• 17 years ago

I think unsecured WIFI AP in Burma or China is a very precious commodity, if it even exists.

mahmud• 17 years ago

China has some open WIFI services (I deployed some FON routers in South China.) I have also been to Burma last year, and the biggest risk there is not technological censorship but human snitches. Burma is a massive country, some parts of which are controlled by the opposition groups, but in government strong-holds, you probably wouldn't find wifi, much less an unsecured one.

In any case, do not use someone's network to do something that might get them killed.

poutine3• 17 years ago

Then you think very wrong. It's trivial to find open WIFI all over China. Most restaurants and coffee shops have it.

I can see several from my apartment.

stcredzero4• 17 years ago

Better yet, a botnet of 3G smartphones. This might be useful enough that some criminal organization might actually buy smartphones in bulk to do this, instead of trying to hack them. (Maybe even manufacture them? These things wouldn't even need input devices and displays.) Pay truckers or bus drivers to carry them around in cities, and program the nodes to periodically shut themselves off. Combine this with a mechanism like TOR, and I'm not sure how you're going to prosecute. (Are judges going to issue warrants based on MAC address?)

Rod• 17 years ago

Your idea is devilishly cool! I am not qualified to assess whether / how it could be implemented, but I wonder if it would be cost-efficient. Smartphones are not that cheap. A criminal organization would need some serious financial incentives to deploy such a network. In any case, it sounds really neat: an entirely distributed and decentralized. Such a system can't be brought down with a warrant. It can't be beheaded.

krakensden• 17 years ago

Can you get prepaid internet access though? Otherwise, each phone has to be linked to a social security number (at least in the US), which seems like it would put a damper on the whole thing.

cstejerean• 17 years ago

What I'd like to see is a way to enforce restrictions on the destinations you're willing to route as an exit node. I'm all for giving people living under restrictive regimes access to things like Wikipedia, but I don't particularly care to enable anonymous access to child pornography.

eli2• 17 years ago

Well, obviously a blacklist wouldn't work, so are you suggesting a whitelist? Seems like that would seriously reduce the usefulness. How would you know what foreign-language dissident news sites to include?

stcredzero4• 17 years ago

What about the ability to spread out a particular request to many exit nodes? This would probably require the establishment of new formats and protocols. How about image formats with the same sort of information as Bittorrent? (Can someone be prosecuted for downloading a fraction of something?) As mentioned in the Rivest article posted recently, there are also "packaging transforms" that allow one to divide information up into n parts, such that all n parts must be provided to retrieve it.

I am surprised that such protocols haven't been devised yet. Yes, this would enable those engaged in child pornography. But those so engaged will just concoct yet another mish-mash of obscurity in any case. (Like using encrypted Windows Remote Desktop connections to virtual servers with encrypted archives on them.)

Just because Bittorrent is used by so-called "pirates," doesn't invalidate it or its use to distribute ISOs of Linux distributions. Likewise, such protocols would patch TOR's weakness at its exit nodes.

bprater3• 17 years ago

Yeah, it's pretty disheartening that a guy who really was trying to do something good for folks who have restricted legal access to the Internet, is hammered by the cops because of some douche-rocket that needed his pedophilia fix.

In his case, maybe white-listing would have been a good idea. I don't know what a Tor directory looks like, but perhaps there could be a list of Tor nodes that give access to specific sets of sites.

radu_floricica4• 17 years ago

Either you have freedom of information, or you don't. All you're saying is that you want to write the rules yourself.

edit: What I mean, is it's a slippery slope. If you do the selection by yourself, you'll let out a lot of good stuff. If you trust somebody else to do the selection, that someone will be in time important enough to become either corrupt or a target, or both. Just imagine google excluding sites from its index on some subjective criteria.

You can't solve this kind of problem by limiting access to information. It's simply a bad strategy from the start, and like any design mistake it creates problems farther and farther away, when the issue is only one: a bunch of bits have been made illegal.

greendestiny• 17 years ago

"a bunch of bits have been made illegal"

I strongly disagree with this idea that I've seen a few times, that somehow the law is irrationally and ridiculously making bits illegal whether in copyright or in pornography. Child pornography is illegal whether its printed on paper or stored as bits. That somehow it shouldn't be a crime just because of the fact that bits can be used to represent anything is a really bad argument.

chris11• 17 years ago

I agree with you. I would be extremely uncomfortable knowing that I might be enabling access to child porn.

But you might have problems legally if you take any responsibility for the kind of traffic that goes through your node. If you try to block anything, that might be implying legally that you have some responsibility for the traffic that goes through the node.

So a whitelist would be best, and you better be sure that every single thing on the sites on your whitelist is legal in your home country. For example, Australia has censored a wikileaks page. So you wouldn't want to allow access to that wikileaks page if you were in Australia.

Right now, you can use Google to find pirated material. You can even limit the file type to torrents. Google's main defense is that it has legal uses, and it is not responsible for policing files on other sites.

cousin_it• 17 years ago

Congratulations, now you understand who benefited when the media created the pedophilia scare.

I confess to being a total conspiracy theory nut on this topic, and go out of my way to defend "sex offenders" in any online discussion I come across. Sadly this is not enough. We're up against a monstrous evil machine made up of mostly good and well-intentioned humans and there's no apparent way to defeat it.

Think about it: who should we blame for the persecution and near ostracism of the article's author? The journalist who honestly warns the public about pedophiles? The media executives? The lawmakers? The police? The whole chain is structured to remove accountability, letting both idea creators and executives sleep peacefully with a clear conscience. The end result is the poor person facing a giant senseless Machine, thankful to be alive after narrowly avoiding its grinding gears. It doesn't have to be this way, people.

axod• 17 years ago

If anyone hasn't seen it already...

(Brasseye: Paedogeddon)

Part1: http://www.youtube.com/watch?v=y7jVnrfoZD8&feature=relat...

Part2: http://www.youtube.com/watch?v=UcnQDYnGtS8&feature=relat...

Part3: http://www.youtube.com/watch?v=fA07Tw4iEFw&feature=relat...

mikedouglas3• 17 years ago

Where did the process screw up here? Regardless whether he was running a Tor server or not, you don't think that the link between his IP address and child pornography was enough to warrant a search?

josefresco• 17 years ago

I would think that the Police, or a judge in particular (who allows this warrant) would require at least one more piece of cooberating evidence before 'breaking someone's door down'.

stcredzero4• 17 years ago

This has always been inherent in "the process." It's just that child pornography is particularly easy to vilify, as it likely should be. But in the past, there have been similar scares using witches, communists, homosexuals. Now there are Nazis and child pornographers. (Heck, I've even seen people trying to vilify Nazi child pornographers!)

I think more attention should be placed on the broader issue of Human Trafficking. We know this is real, and child pornography constitutes some fraction of it. It's just a lot easier for the police to get ahold of an IP and break down somebody's door.

graemep• 17 years ago

I would definitely blame journalists and the government. They did NOT report the dangers of paedophiles honestly. They grossly exaggerated the level of risk and mislead people about the sources of risk ("stranger danger").

CWuestefeld• 17 years ago

This stopped being about the defense of the vulnerable long ago. Once the laws were put in place that make it illegal to show non-children as if they were children, it became thoughtcrime, the persecution of people because they think differently than the rest of society. If a photograph shows an adult dressed as a child, or is entirely computer generated, then sure it's yucky, but what's the harm?

So it seems like one place to break the cycle of hysteria is through lawmakers, to roll back the thoughtcrime laws to the level that they're only protecting the vulnerable rather than punishing people for having weird thoughts.

(Off topic: Of course, the same things can be said about the war on drugs, and the obvious damage that it has done, but lawmakers aren't exactly falling over each other to undo their damage in that area either)

radu_floricica4• 17 years ago

I'd go a step further and say the yuckyness is in some cases purely subjective. You probably know about the guy who got into hot water over his manga collection. This is a clear example of a culture clash. For an american, or european, everything involving drawings of children in sexual contexts is at least distasteful. Strange as it may seem, there are cultures where "sexy" is closer to cute then to porn.

It's probably one of those things which 60 years after will sound _really_ weird, like blacks had separated restrooms or homosexuals liked to rape little boys.

raquo• 17 years ago

You can not fight the materialization of thoughts without fighting these thoughts. If enough people think X, X will be normal sooner or later, even if it was illegal. It is normal that Women and minorities have equal rights with white men now (on paper at least), in contrast to 100 years ago. Think pedophiles won't be normal in 50 years? Sounds perfectly plausible to me.

katz4• 17 years ago

The problem with paedophilia is that it is extremely difficult to enforce. It is not as if a 5 year old kid will walk up to a police station and file a complaint. The internet made it near impossible to enforce paedophilia laws.

If the cops have to cause a mild inconvenience to 50 people to successfully prosecute one bad guy - then so be it.

jibiki• 17 years ago

From what people say, the police are remarkably unsuccessful at prosecuting CP producers and distributors. They're good at prosecuting consumers, but I think that's like trying to empty the ocean with a teaspoon. (Of course, fighting crime is always like that...)

anamax4• 17 years ago

> If the cops have to cause a mild inconvenience to 50 people to successfully prosecute one bad guy - then so be it.

"mild inconvenience"?

If it's a "mild inconvenience", surely you won't mind paying for n instances, for non-trivial n. You've used 50 above, so let's start there.

Are you personally willing to pay for the "mild inconvenience" suffered by 50 innocent people?

What? You're not willing to pay? You're only willing for other people to pay?

topbanana• 17 years ago

Nice cover story

bprater3• 17 years ago

How do the police even stumble on the fact that this guy was involved?

Did they take down a pedophilia source and then rip through the web server logs? (That seems legit.)

Or were they monitoring IP traffic on a larger scale, knew of a pedophilia source, let it continue running and simply harvested IP addresses that were connecting with it? (Sounds like a privacy issue.)

Regardless -- how does a good guy help without putting himself in legal hot water?

bprater3• 17 years ago

This is the type of article that should be passed out to everyone running an open Wifi network.

jgfoot• 17 years ago

Hell yes. I thought of this sort of thing when I read Bruce Schneier's infamous piece about how it's a great idea to keep your wi-fi network open. http://www.wired.com/politics/security/commentary/securityma... Tor exit nodes and open-wifi let other people use your IP address, and for purposes of a search warrant you might as well let them use your name and face.

The dangers of operating a Tor exit node

Related Stories