Open Source Tortilla For Tor To Be Released At Black Hat 68
msm1267 writes "A researcher is expected to release Tortilla, an open source tool that anonymously routes TCP and DNS traffic through Tor, at the upcoming Black Hat conference. Tortilla provides a secure, anonymous means of routing traffic through Tor regardless of client software and without the need for a VPN or secure tunnel."
The real problem with Tor (Score:5, Insightful)
The real problem is that nefarious governments locate physical locations connecting to TOR by complicit ISPs and go after the people and hardware.
Re: (Score:3)
Exactly. Using Tor in a DPI world is waving a big red flag, and yelling, "I'm hiding something!!!"
Re: The real problem with Tor (Score:4, Insightful)
Re: (Score:1)
Using Tor in a DPI world is waving a big red flag, and yelling, "I'm hiding something!!!"
Tor is not for people who have something to hide. If you're doing something illegal online, odds are you'll be found anyway, weather you use Tor or not. Tor is for people who (like me) just want that added layer of privacy. In the end, if you're doing something illegal online, and the government wants to catch you, they're gonna catch you. Tor isn't going to help you much.
Re: (Score:3)
That doesn't make any sense. In fact, it's just wrong. The tor exit node can see all of your plaintext traffic, so that just adds yet another potential source of eavesdropping.
Staying inside of the tor network however basically guarantees anonymity. You think the DEA hasn't tried to shut down the silk road already? Or what about lolita city? Drugs and child pornography are the two biggest things the US government wants dead, and as of yet they've been completely unable to stop either of those, meanwhile bot
Re: (Score:1)
Re: (Score:1)
It's not that the ISPs ban them, per se, it's that they exit nodes get inundated with DMCA takedown letters because of bittorrent users. They pass the letter on to you, possibly hinting that you may be violating their terms of service. Most of the time they have no idea whether you're using Tor or not; they don't care.
If I were to run a Tor server, I'd filter it. (Actually, I'd first have to write my own so I could filter). I'd block all bittorrent usage, and I'd throttle the traffic so people surfing porn
Re: The real problem with Tor (Score:4, Interesting)
If I were to run a Tor server, I'd filter it. (Actually, I'd first have to write my own so I could filter).I'd block all bittorrent usage,
It's already blocked in the default configuration.
and I'd throttle the traffic so people surfing porn (legal or illegal) would get frustrated.
You going to crack AES to filter out all the hidden services, where all that nasty stuff is at, too?
I was last time I ran a Tor exit node.
Good thing you stopped, you don't seem to quite grasp how it works.
Re: (Score:1)
" If I were to run a Tor server, I'd filter it. (Actually, I'd first have to write my own so I could filter). I'd block all bittorrent usage, and I'd throttle the traffic so people surfing porn (legal or illegal) would get frustrated. " .
------
that is going to be a bit difficult , seeing as the traffic IS ENCRYPTED Not strongly , but still encrypted
yes in a few weeks you can decrypt it to see what is what , but by then a few weeks have past
there is no way to "filter" it IN REAL TIME
Re: (Score:2)
Only while it stays within the network.
One thing that makes Tor more popular than other darknet systems is that it connects to the regular internet. Sort of how VoIP took off once call gateways to the POTS network were established. Because before that, well, you're j
Re: The real problem with Tor (Score:1)
My ISP did not give a s**t about torrents or anything. But when they got letters about botnets being run from my address, thats when i dropped running a tor exitnode!
Re: (Score:1)
My line got blocked when I ignored the letter. a quick phonecall later all was ok as long as i did not run tor
Re: (Score:2)
Does not help that tor is abused by child porn seekers and such. Most ISP ban tor now.
It also does not help that Tor is subject to a FUD-based smear campaign to drive people away from a technology that they could use to empower themselves.
Re: (Score:2)
It's a valiant effort, but it still fundamentally depends on talking to specific hosts to get into the network. As long as that list is public, someone will be able to figure out if you're talking to it.
Re:The real problem with Tor (Score:5, Interesting)
Nefarious government hunt down Tor users.
Smart governments, like the U.S., run Tor nodes. In fact, it's been conjectured by cryptographers and analysts--not just Bruce Schneiner, but other academics--that the U.S. government runs a plurality of all Tor nodes. We know for a fact that they use Tor to hide some of their own surveillance and exfiltration traffic, but undoubtedly they also log all traffic on their nodes for analysis so they can figure out who else is using it.
Because Tor doesn't use constant-rate traffic padding, it's actually easy to trace Tor traffic if you can analyze a substantial number of Tor messages. Thus, the easiest way to defeat Tor if you have a decent budget is to just run as many Tor nodes as you can. (Because the NSA's taps into major exchanges, they're probably capable of doing it the hard way, too; specifically, by simply recording IPs and timing of traffic to and from all known Tor nodes.)
When I ran a Tor exit node on a gigabit Cogent link, I was constantly inundated with DMCA takedown letters and other legal harassment, primarily because of bit torrent users*. The EFF actually provides legal support, but I can't believe that there are enough people willing to put up with the hassle of running long-term, high volume Tor exit nodes. Rather, it seems far more plausible that the government runs many or most of them because they're effectively immune to legal harassment, not just because they're the government and actually immune, but because they have a limitless number of lawyers to fight the challenges without necessarily revealing their identity.
* You guys suck, BTW. Stop downloading all that crap. I hate you not because I believe in the legitimacy of copyright, but because you guys are being lazy about it and causing all kinds of other headaches, e.g. making it impossible to run a Tor exit node. Here's an idea--for every piece of media you download in contravention of copyright laws, why not at least send the money equivalent to the EFF, ACLU, and other organizations who will lobby to change the laws for the better, even if not perfectly.
Re: (Score:2)
it's been conjectured by cryptographers and analysts--not just Bruce Schneiner, but other academics--that the U.S. government runs a plurality of all Tor nodes.
That sounds about par for the course. I remember hearing that in the later decades of the 20th century the US government, at the behest of the NSA, made sure that it was cheaper to route international phone calls going from Europe to Asia or from South America, Asia and Africa to just about any other destination through the United States by subsidizing the connections so that the fees would be cheapest. This ensured that a majority of the world telecom traffic made it's way through the United States at some
Re: (Score:1)
Re: (Score:2)
Only if you set your OS up to use 127.0.0.1 for DNS instead of the IP addresses your router/ISP/whatever assign to you.
The meat is the payload. (Score:4, Funny)
Alright people, we've got the tortillas and the onions [wikipedia.org], all we need are some bell peppers and some meat and we've got ourselves a fajita.
Re: (Score:1)
Just use it to move porn and we've got plenty of meat. Any suggestions for what we can use as peppers?
Real sex with the wrong people will give you that burning sensation you're after...
Re: (Score:1)
Alright people, we've got the tortillas and the onions [wikipedia.org], all we need are some bell peppers and some meat and we've got ourselves a fajita.
Don't forget TACO [mozilla.org]....
Re: (Score:1)
Whonix (Score:2)
Re: (Score:1)
Whonix is a Linux operating system. Everything that can be done in this new Tortilla program can be done 20 different ways if you're using Linux, but Tortilla claims to be the first to do it on Windows.
Re: (Score:1)
In case you missed the news, using Windows is already game over for you.
Re: (Score:1)
Re: (Score:2, Informative)
No, Whonix is a system
Yes, it is an operating system.
The link you gave has instructions on how to run Whonix in a virtual machine. It's still a Linux operating system. Like I said, if you can run Linux, then you've already got a ton of options to run Tor. (tsocks, iptables transparent proxy, manual proxy settings with filters for unconfigured programs, etc.)
Tortilla claims to be the first program to transparently route your connections on Windows.
pfSense plugin? (Score:2)
Not on Torproject site yet. (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Currently, to use Tor a program must be written to communicate through Tor's SOCKS proxy, which apparently Windows doesn't support well.
This, in theory and if I'm reading the bits of the description properly, would allow you to run any program that talks basic internet protocols and route its traffic through Tor without any changes to the program. That's similar to how a firewall can change the internet permissions of a program without touching the program itself.
FTFA it appears to be a tool for security research (Score:3)
“The Tor client does all of the work,” Geffner said. “Tortialla(sic) redirects TCP and DNS traffic through Tor ensuring nothing else gets out. I wouldn’t call it a plug in; it does communicate with the Tor client over the SOCKS port Tor opens up, but it’s not a plug in.”
It sounds like their intent is to prevent the target malware sites from knowing your IP address while allowing the full impact of its flash/java/js payload to attack your machine. The idea being that such
Not New (Score:5, Interesting)
I wrote a tool like this ages ago called Torcap; http://freehaven.net/~aphex/torcap/ [freehaven.net] and it does all of that plus works on Windows and is open source.
Re: (Score:2)
Re: (Score:1)
Use ? USE ?? (Score:2)
“I’m hoping ..... the tool will be used,” Geffner said
You can bet it will !!