Tor warns users that system has been attacked

Anonymization service Tor warns users that it has been attacked. The attackers, who Tor suspects are the researchers who wanted to give a presentation on Black Hat, used two types of attacks simultaneously.

One of those attacks was a so-called ‘Sybil’ attack, Tor says. In addition, the attackers set up 115 nodes at once from the same IPs. Tor’s scanner was aware of this, but the nodes were nevertheless allowed to remain in the network.

The other attack was a ‘traffic confirmation’ attack, in which the attackers conclude that it comes from the same person by comparing characteristics of the traffic entering and leaving the Tor network. This makes it possible to find out who goes where on the Internet via the Tor network. It is unclear whether that attack was successful: the attackers had no control over exit nodes.

It is still unclear what exactly the attackers were able to see. The attack took place from about February to 4 July. Tor has taken steps to stop this attack, but cannot completely rule out the possibility of it happening again. It suspects and hopes that the researchers who were to give a presentation at the Black Hat hacker conference on de-anonymizing Tor users are behind the attack. The researchers have canceled that session.