Thousands of Tor exit nodes attacked cryptocurrency users over the past year

[mimi89999]

Malicious Tor exits should not be an issue. Tor is for anonimity and protects your identity. Enforce HTTPS to protect against MITM.

[devwastaken]

Tor is not anonymous if the relays and hidden service work together. Given the cost of hosting and the significant funding put into this by the U.S. it's just a matter of probability before the deanon cannon aligns to a user.

[tyingq]

Seems unsurprising. An ecosystem where you can volunteer to be a MITM ends up having malicious MITM.

[bluedino]

My manager started playing around with crypto trading, at work, on his work PC…it’s amazing how many alarms it sets off on our Fortigate.

[mnahkies]

I had a fun one a few years back - the company it guy pulled me aside and then with a lot of hesitation/beating around the bush told me that someone on my team had been mining crypto at work and that they would have to format their machine and disrupt their day as a result.

Never felt so much relief to hear the world "crypto" as the delivery of the message had me confused and fearing bad things.

When I spoke to the person about it turns out they'd started mining on their own hardware as a hobby and were just curious what the perf diff would be on the work computer's

[capableweb]

Unless you're talking about interacting directly with DeFi stuff via a standalone Ethereum node, isn't those alarms just based on a DNS and IP blocklist?

[tootahe45]

Stopped taking tor seriously when i read one of these attackers controlled something like 30% of exit nodes around 1-2 years ago. Just makes you wonder whether the rest are govt hosted given there are no incentives for anybody to host a node. Another reason i don't trust TOR is that on the TOR subreddit they always tell you not to use a VPN before TOR, which just seems very suspect given there is only upside to doing this (VPN only sees what your ISP would've seen unless the vpn client is malware).

[JohnJamesRambo]

>there are no incentives for anybody to host a node.

Sounds like you kids need an anonymous decentralized cryptocurrency powering your tor nodes with rewards for doing so. But everyone here hates crypto so I’ll just be over here sipping my Monero tea.

[batch12]

I think their point about VPN is that a third party provider then could be compelled to disclose information about you. Since all your traffic routed through a single provider before hitting the remote proxy, there is now the potential for a single point of collection. When using Tor only, traffic leaving your computer is encrypted before hitting the first node which mitigates this threat. If the use of Tor is illegal for you, a VPN makes sense to hide its use-- but like you said, it is only hidden from the ISP. The VPN provider can still see that you are using it. In practice, how Tor is used should depend on the threat a person is trying to defend against.

[vbezhenar]

I can't even access TOR without VPN, because it's blocked in my country. My government makes sure our citizens use the best security practices to access the Internet. Very nice.

[throwitaway12]

You are completely correct about the nodes being run for all sorts of nefarious reasons. Although, there are a small number of nodes rub by enthusiastic individuals but it's rare.

Reddit has tons of actors spreading disinfo especially about VPN's never trust the info from there without serious vetting.

[worldofmatthew]

I think it is mostly to avoid people using the same VPN across mobile and desktop and having both having a common end-point.

[tyingq]

"there are no incentives to host a node."

Agreed. There are even pretty strong disincentives from a legal standpoint.

[LatteLazy]

Forgive my ignorance but why does it matter who controls exit nodes? Unless you identify yourself on the clearnet an exit node operator can't identify you can they?

Like you, I imagine plenty of governments run exit nodes just to see what's happening and keep the system working for their own uses.

[swiley]

Yeah you really shouldn't generally be using TOR to browse the clear net if you're worried about attacks from a national government.

[jazu]

I hosted a node which moved a hefty amount of traffic. Tor and the EFF sent me several T-shirts even. Then Tor decided they would label themselves a “human rights project” and started to go full political. I shut down my node forever.

[mimi89999]

Why is this an issue? Most websites support HTTPS. It should be required and impossible to disable. Other malicious actors could also be running such attacks even at a much smaller scale.

[FatalLogic]

In this case, I think if the user makes an HTTP connection to a site, even if the site is HTTPS only, the attacker can intercept it, and man-in-the-middle it or pose as the legitimate site

edit: and, the reason it's an issue is not because these systems and networks don't have strong secure communication options available, but because if there is any potential security hole at all, some users will fall into it

[michaelt]

> Why is this an issue? Most websites support HTTPS.

Tor Browser and TAILS try not to keep any trace of the websites you've visited.

That means no 'frequently visited sites' start page, no bookmarks, no address bar autocomplete from history, and no HSTS unless it's preloaded.

So if a tor user visits bitcoin-mixer.com there's a good chance they'll be typing the address in manually - and a good chance they'll omit the https:// at the start.

(Also, a great many bitcoin mixers, for some inexplicable reason, don't get themselves HSTS preloaded)

[em-bee]

the attackers are intercepting the initial request which is a plain text tcp packet containing the https url. that https is then stripped from the url, turning the url into a plain http request.

i think the only way to prevent that from working is if the websites outright reject http requests.

[hartator]

You only one or two to not notice the http instead of https to make it a profitable attack.