[tor-relays] [Important] Update on an upcoming German broadcasting story about Tor/Onion Services

Hi Tor,

I am reaching out to inform you of an upcoming news story concerning a potential deanonymization attack on Onion Services.

What is happening?

On September 9, 2024, The Tor Project received a press inquiry from Norddeutscher Rundfunk (NDR, part of ARD, a German public broadcaster) with a request for comment to their upcoming reporting of “investigative measures by German and international law enforcement agencies in the Tor network, in particular the localisation and deanonymisation of onion services.” We complied with the outlet’s deadline of September 12th and answered a series of questions.

The reporter claims to have “evidence that shows that in several cases German law enforcement authorities were able to locate the Tor entry node of onion services and thus successfully deanonymise Tor users. V2 and V3 onion addresses were affected at least between Q3/2019 and Q2/2021.” The reporter further claims that “law enforcement agencies used so-called timing analyses and broad and long-term monitoring of Tor nodes in data centres.”

As of today, The Tor Project has not been granted access to supporting documents, and has not been able to independently verify if this claim is true, if the attack took place, how it was carried out, and who was involved.

In the absence of facts, it is hard for us to issue any official guidance or responsible disclosures to the Tor community, relay operators, and users at this time.

We are calling for more information from you.

If you have any information that can help us learn more about this alleged attack, please email security@torproject.org.

If you want to encrypt your mail, you can get the OpenPGP public key for this address from keys.openpgp.org. Fingerprint: 835B 4E04 F6F7 4211 04C4 751A 3EF9 EF99 6604 DE41

Your assistance will help all of us take the necessary steps and precautions to keep Onion Services safe for the millions of users that rely on the protections Tor provides.

Are Tor users safe?

Tor users can continue to use Tor Browser to access the web securely and anonymously. Nothing that the Tor Project has learned about this incident suggests that Tor Browser was attacked or exploited. We encourage Tor Browser users and relay operators to keep software versions up to date.

The reporter’s questions focus on the use of onion services and .onion addresses. Which leads us to assume that the alleged attack was targeting a specific .onion site.

We will continue to share updates on this email as this situation evolves.

Thank you!

Isabela

2 Likes

The reporter claims to have "evidence that shows that in several cases
German law enforcement authorities were able to locate the Tor entry node
of onion services and thus successfully deanonymise Tor users. V2 and V3
onion addresses were affected at least between Q3/2019 and Q2/2021."

this timeframe sounds familiar.

maybe, maybe not.

Looking forward to their publication.

kind regards,
nusenu

···

--
https://nusenu.github.io

_______________________________________________
tor-relays mailing list
tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

2 Likes

The "full" vanguards design includes other changes to how Tor handles
edge cases and unexpected circuit/stream behavior which might be able to
be used as a side channel, but the main tradeoff is that it slows down
your circuits. You have to run it alongside your Tor, as a controller,
which means it is not for "end" users. You can read about it on this
blog post:

Whereas the "lite" design is a subset of the full design, which we built
into C-Tor back in 2021-2022 when it became clear that some of these guard
discovery attacks we worried about might actually be more practical than
first thought. You can read about vanguards-lite in Proposal 333:

and you can read one of the motivations for it in this research paper:

And lastly, there is a great explanation of both variations of vanguards
in this blog post talking about adding them to Arti:

--Roger

···

On Mon, Sep 16, 2024 at 08:17:25PM +0000, pasture_clubbed242--- via tor-relays wrote:

Something I always found confusing is what the difference is between the Vanguards Github project, and the version of Vanguards that Tor has implemented. I thought Vanguards was added into Tor no? Is the Vanguards project still useful despite this?

I'm not sure if this spec is the exact implementation or a recommendation for an external plugin.
https://spec.torproject.org/vanguards-spec/full-vanguards.html
I have also seen other mentions of an implementation elsewhere.

_______________________________________________
tor-relays mailing list
tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 Likes

Hello, we just published more information on our blog: https://blog.torproject.org/tor-is-still-safe/

···

On Mon, Sep 16, 2024 at 7:31 AM isabela fernandes <isabela@torproject.org> wrote:

Hi Tor,

I am reaching out to inform you of an upcoming news story concerning a potential deanonymization attack on Onion Services.

What is happening?

On September 9, 2024, The Tor Project received a press inquiry from Norddeutscher Rundfunk (NDR, part of ARD, a German public broadcaster) with a request for comment to their upcoming reporting of “investigative measures by German and international law enforcement agencies in the Tor network, in particular the localisation and deanonymisation of onion services.” We complied with the outlet’s deadline of September 12th and answered a series of questions.

The reporter claims to have “evidence that shows that in several cases German law enforcement authorities were able to locate the Tor entry node of onion services and thus successfully deanonymise Tor users. V2 and V3 onion addresses were affected at least between Q3/2019 and Q2/2021.” The reporter further claims that “law enforcement agencies used so-called timing analyses and broad and long-term monitoring of Tor nodes in data centres.”

As of today, The Tor Project has not been granted access to supporting documents, and has not been able to independently verify if this claim is true, if the attack took place, how it was carried out, and who was involved.

In the absence of facts, it is hard for us to issue any official guidance or responsible disclosures to the Tor community, relay operators, and users at this time.

We are calling for more information from you.

If you have any information that can help us learn more about this alleged attack, please email security@torproject.org.

If you want to encrypt your mail, you can get the OpenPGP public key for this address from keys.openpgp.org. Fingerprint: 835B 4E04 F6F7 4211 04C4 751A 3EF9 EF99 6604 DE41

Your assistance will help all of us take the necessary steps and precautions to keep Onion Services safe for the millions of users that rely on the protections Tor provides.

Are Tor users safe?

Tor users can continue to use Tor Browser to access the web securely and anonymously. Nothing that the Tor Project has learned about this incident suggests that Tor Browser was attacked or exploited. We encourage Tor Browser users and relay operators to keep software versions up to date.

The reporter’s questions focus on the use of onion services and .onion addresses. Which leads us to assume that the alleged attack was targeting a specific .onion site.

We will continue to share updates on this email as this situation evolves.

Thank you!

Isabela