How we can find misbehaving users in anonymizing networks like TOR, etc.,?
I need an apt answer for this question for helping my friend in her academic project..
Good Answers (5)
Charlie B.
Popwerful website security scanning made EASY
Best Answers in: Small Business (1), Computers and Software (1), Computer Networking (1), Databases (1)
Depends what you mean by misbehaving users. If they are on your network and going outbound, you have a bit more control, but TOR is designed to be hard to crack. There are 2 known ways to get at TOR users.
1) Create a malicious TOR gateway exit node, and observe users behavior. many protocols leak information, such as bittorrent, which will allow you to find the original IP address. Other users will remain anonymous, though you can do packet inspection to check for useful information such as unencrypted email messages. TOR knows some exit nodes are malicious, and the protocol takes this into account. Still, it is the best known way to find users, and some TOR users have been exposed this way.
2) Track users on their PC. If you own the network, you can watch for TOR connections (may be hard to spot if they are jumping bridges often, but most don't) and find which machine is connecting to TOR. Then, install monitoring software on the PC itself. This can be done if you for instance own the PC, as in a work environment.
try running snort at your gateway
If someone is careful about using it, you pretty much don't find them. You have to hope they make mistakes. For example, say someone uses Tor on a wireless access point to download some software. You trace it to the wireless access point IP, but it isn't theirs. What have you gained?
Your problem domain is not well defined. I don't know if this person is on a network you own, or someone else owns. I don't know if this is purely theoretical in the sense of "if protocols were to change how do we find misbehaving users".
Antenore G.
Experienced Middleware and Unix specialist
Best Answers in: Computers and Software (1), Software Development (1)
You cannot or better you should not, as far as you identify a bad user you can, by extrapolation, identify the good one.
Anonymity is total or is not anonymity
There are an endless supply of misbehaving users on any given network... Focus on the root of the problem, weak security controls.
