Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


08:37 PM
Connect Directly

Researcher Shows Why Tor Anonymity Is No Guarantee Of Security

Tor exit node in Russia spotted downloading malicious code.

Users of the Tor network now have one more reason to be cautious when using the service to browse the Internet or to download executable code anonymously.

A security researcher last week uncovered a malicious Tor exit node in Russia being used by unknown attackers to insert malicious code into files being downloaded by Tor users. Tor administrators have since flagged the node as a BadExit, meaning that Tor clients now know to avoid using the server.

Still, its presence on the network shows how Internet users are not immune to malicious downloads when using Tor, said Josh Pitts, security researcher at Leviathan Security Group who discovered the malicious node.

Tor is a network that allows users to browse the web anonymously. It uses a series of encrypted connections to route data packets in such a manner as to hide the true IP address of the person using the service. Instead of routing traffic via a direct path to a destination, Tor routes traffic through a series of servers distributed around the world with an exit node serving as the last server on the network before the public web. Between 1,100 and 1,200 servers currently serve as exit nodes on the Tor network.

Pitts discovered the malicious node while doing research on the threat to Internet security posed by unencrypted binary files. In a presentation at the DerbyCon security conference earlier this year, Pitts showed how binary files hosted without any transport layer security encryption on the web could be easily intercepted and tampered with when they are being downloaded.

According to Pitts, some 90% of the sites from which downloads are available do not use SSL/TLS encryption nor use digital signatures to prevent such tampering. As a result, hackers are likely inserting malicious code into binaries via man-in-the-middle attacks, Pitts had maintained at his DerbyCon presentation.

Pitts decided his best chance of catching binaries being maliciously tampered with during download was to look at traffic coming out of known Tor exit nodes. Using, a tool called exitmap, Pitts checked the nodes for traffic modifications and quickly discovered the malicious server in Russia.

Though this was the only malicious node that Pitts discovered, it is quite possible there are others similar nodes. "I may not have caught them, or they may be waiting to patch only a small set of binaries," Pitts said.

The key takeaway here is that binary files hosted in the clear without any digital signature pose a danger and should be avoided, he said in an email exchange.

"Companies and developers that host static, compiled binaries and source code need to host it via SSL/TLS so that nobody can patch them [maliciously]," he said.

Though such binaries pose a threat to everyone, Tor users need to pay attention, he said. Users should be careful particularly about download Windows executables or raw binaries over Tor, he said,

"Tor is risky because you need to have good information security awareness when using it. Tor is not a beginner network. You need to have some sort of understanding that every exit node could be out to get you," Pitts said.

The issue discovered by Pitts is not an indictment of Tor security or of the strength of its anonymity protocols. Even so, it is the second time the Tor Project has been in the news over something similar in the past one year. Last year, some people questioned whether the FBI had found a way to exploit an vulnerability in Firefox to disable Tor’s privacy protections.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Robert McDougal
Robert McDougal,
User Rank: Ninja
10/28/2014 | 10:05:00 AM
Privacy at the cost of Security
Tor has always provided privacy at the cost of security.  Since the nodes that Tor routes traffic through do not belong to the user, you are essentially routing your traffic over multiple men in the middle.  Yes, if you are careful you can obtain privacy, but not security.
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-13
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to ro...
PUBLISHED: 2021-04-13
SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp etc. because of missing authorization check in the servlet.
PUBLISHED: 2021-04-13
SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored ...
PUBLISHED: 2021-04-13
SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server. When a victim tries to open this file, it results in a Cross-Site Scripting (XSS) vulnerability and the attacker can read and modify data. However, the attac...
PUBLISHED: 2021-04-13
SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the sour...