1

I just downloaded Tor Browser Bundle and extracted it.

I had no copy of my Tor Nodes Settings so i just browsed using the standard nodes and i forgot to disabke Java Script.

I did not notice anything suspicious while i was browsing, all the homepages looked like the ones i was trying to reach. Still i am asking myself if my DNS conection could have been manipulated and if i could have been forwarded to a malware hosting homepage.

Junior J. Garland
  • 677
  • 5
  • 15

2 Answers2

3

For your question, you can imagine TOR like a proxy whose administrator can see everything you do if it is not encrypted.

Every unencrypted content you send through TOR can be seen by the owner of the first and the last node. And every content not signed can be potentially altered by these nodes.

Here is an article about a security researcher trying to identify nodes sniffing traffic: https://chloe.re/2015/06/20/a-month-with-badonions/

EDIT: I had not read her last article about content manipulation by exit nodes, but this clearly shows HTTPS may be recommended: https://chloe.re/2015/06/30/this-weeks-tor-attacks/

Jyo de Lys
  • 679
  • 3
  • 9
  • seen by owner of first and to the last or from the first to the last nodes? The information can be sniffed in whatever hop it is.. –  Jul 31 '15 at 18:15
  • It has always been recommended to use HTTPS with Tor. If no means of security is used with Tor, plaintext can be see from the exit node to the destination. Here is a [related question and answer.](https://security.stackexchange.com/questions/72679/differences-between-using-tor-browser-and-vpn) – RoraΖ Aug 03 '15 at 11:41
1

There is just one thing I want to correct in the good answer of @JoedeLyes: Tor has no control over the traffic between the exist node and the destination server. I mean it can not encrypt in anyway the communication between the exit node and the destination server, and that is one of the weaknesses of Tor because exit nodes are vulnerable to eavesdrop.

As for disabling JavaScript it is a matter of pros and cons: when you whitelist websites by disabling JS when you visit them your behavior becomes a sort of a cookie that makes you recognizable and you're not that strongly anonymous anymore. But disabling it protects you from browser vulnerabilities too. But you have to know that JS is enabled by default in Tor browser.

Talking about DNS requests being forwarded to malicious targets, that sounds extremely difficult regarding how Tor nodes function, however it is claimed that NSA redirects identified Tor users to another set of its own secret Internet servers.

  • Did i miss something in that admittedly interesting articele you linked? It doesnot testify that the NSA is redirecting tor users which would be an attack possibly caused by DNS spoofing/poisoning but more like that the GCHQ is able to sniff https traffic if i interpreted it correctly. – Junior J. Garland Jul 31 '15 at 16:49