Tor is an excellent tool for privacy, and we do not recommend you avoid it. However, there are many limitations to be aware of and ways of using it that can compromise your anonymity on Tor. This article will discuss just a few of the ways, but there may be others that the public is unaware of. For example in 2017, the FBI dropped a case against a school worker accused of downloading child pornography because the FBI would have rather let him go than reveal the source code for how they deanonymitized him through Tor. [1] If you really want to get your privacy game to the next level, consider subscribing for free to our new content by email, by Session messenger, RSS feed, or Nostr.
The sources for this article can be found here.
The techniques we will cover include:
1) JavaScript based attacks
2) Cookies
3) Compromised Exit Nodes
4) Compromised Middle Relays
5) Compromised Entrance Guards
6) Opening Files Outside Tor
7) Ultrasonic Sounds
JavaScript Attacks
JavaScript is used by many websites to deliver content and perform services. Many sites use it as part of their core functionality. JavaScript also can be used to browser fingerprint and therefore serve content that’s appropriate for the end user’s browser and operating system versions, such as ensuring the content has the correct screen dimensions. While the purpose of JavaScript’s fingerprinting is to properly serve content to benefit the user, it can be used maliciously against the user to identity him or her through Tor.
JavaScript was created by Brendan Eich in 1995. Ironically, Brendan went on in 2015 to become the founder and CEO of Brave Browser, which is promoted as a privacy browser by hiding and confusing your JavaScript fingerprints. In other words, the founder of JavaScript 20 years later became the founder of one of the most popular JavaScript evasion tools!
Brave Browser has Tor functionality and is popular for obscuring fingerprints for everyday casual use, but it isn’t as effective as Tor Browser, which has a fixed smaller screen resolution and better browser isolation. Browser isolation is the ability to prevent different tabs open at the same time and any downloaded files from accessing your main PC.
While JavaScript’s incredibly popular, website developers do not technically have to use it for websites to have interactive experiences or to be properly sized. For example our website, SimplifiedPrivacy.com, uses PHP to allow you to buy services with cryptocurrency, but the overall industry standard has moved towards JavaScript’s use and adoption.
Most large corporate developers are interested in collecting data on users because that data has value in marketing goods and services to those users. Because surveillance data has value to both website owners and third parties, large software developers create tools that utilize the data, and then smaller website creators often are reliant on these pre-existing tools.
JavaScript can be used to identify a user through Tor in a number of different ways. This is why Tor Browser comes pre-bundled with the “NoScript” plugin. This plugin can either reduce or disable JavaScript’s ability. When the plugin is set on the “Safest” setting, JavaScript is completely disabled. This level of security is required to completely stay anonymous and secure on Tor.
The first way that JavaScript can identify a user is if a malicious website were to inject code into Mozilla Firefox (the foundation upon which the Tor Browser bundle is built). An example of this exploit was demonstrated as recently as 2022 by Manfred Paul at a Pwn2Own hacking contest of getting a user’s real IP address through Tor. [4a] [4b]
But this is not a one time bug or incident, as Mozilla Firefox has a history of being vulnerable to these types of malicious JavaScript injections. Malicious script hacks caused Tor to have to patch to correct them in 2019 [5], 2016 [6], and 2013 [8].
Back in 2016, cybersecurity researcher Jose Carlos Norte revealed ways that JavaScript could be used to identify Tor users through its hardware’s limitations. These advanced techniques fingerprinted the user’s mouse movements, which are tied to hardware restrictions and potentially unique operating system settings. Norte additionally warned how running CPU intensive code could potentially identify the user’s PC based on how long it takes to execute. [7]
The point of all of this is that all of these vulnerabilities did not work when NoScript was set to the safest mode of disabling JavaScript.
Browser Alone doesn’t stop cookies
Another security issue with Tor is pre-existing cookies, which could compromise your anonymity. For example, let’s say you previously signed on to your Amazon account from the same computer you are now using Tor Browser in (but using a different browser). If you now visit an Amazon page using Tor Browser (or maybe even receive a forwarded Amazon URL), you could potentially be connected to the Amazon cookie already on your computer and be deanonymized instantly. This would immediately connect the Tor traffic with you.
Remember though that Tor Browser is only one of a few options for using Tor. The way around this cookie issue is to use Tor in a virtual machine with the Whonix operating system or the USB operating system version of Tor called Tails.
Compromised Tor Exit Nodes
Your traffic enters Tor encrypted and stays encrypted through its journey throughout the mixnet until it gets to the final stop, which is the exit node. Here the exit node communicates with the “regular” clearnet without Tor’s onion encryption to access a website on your behalf.
Outside of Tor on the “regular” clearweb internet, most websites use httpS encryption. This is shown with a padlock in the top by the URL. If the website is http, without the “s,” then it’s unencrypted plain text data. Anything you do using an unencrypted http website with a Tor exit node can be snooped on and seen. However, this risk is relatively low because of the high percentage of websites that use httpS.
The biggest risk is that the httpS encryption can be removed using SSL stripping. This is when the Tor Exit node acts as a man in the middle, faking the server with which you’re trying to authenticate and downgrading the connection to httpS. For example in 2020, a malicious actor took control of over 23% of all Tor exit nodes and started doing SSL stripping to steal Bitcoin being sent on mixing websites. [9] [10]
To prevent against these types of attacks, upgrade the Tor security level to safest, which requires the use of HTTPS encryption with “HTTPS-Only”. Also pay attention to the top icon by the URL bar, to make sure there’s always a padlock showing it’s using this encryption.
You can click on the icon to see your Tor connection route and the certificate authority. Certificate authorities are the entities that validate the authenticity of the HTTPS encryption to this IP address. On a side note, these certificate authorities can act as a censor by removing an entry’s IP address, and this is one of the flaws that many cryptocurrency blockchains are actively working to solve.
Another way to prevent malicious Tor exit nodes from stealing your data or cryptocurrency is to avoid using exit nodes by using primarily Onion services. If you only login to Onion websites, then you never exit Tor. This doesn’t mean completely avoiding clearweb sites, but try to only browse them and not login. It’s the login/password credentials that malicious exit nodes steal with SSL stripping.
Malicious Middle Relays
The next type of risk is malicious middle relays — the hop between an entrance guard and an exit node. For example, the malicious group KAX17 had been identified as having run up to 35% of the middle relays and 10% of the overall Tor network before the official Tor project removed 900 of its servers. [15] [16]
While malicious exit nodes often want to steal Bitcoin or data, the goal of malicious middle relays is to deanonymatize users by seeing the path of their traffic. This is especially true on Onion hidden services because it doesn’t even use exit nodes.
There are a few things you can do to reduce this risk. We will go over them in the entrance guard section, because they are the same methods.
Malicious Entrance Guards
Entrance guards can see what IP address is connecting to the Tor network, but can’t see the traffic itself as it’s onion layer encrypted. However, they can gather some information, such as the time, size, and frequency of the data packets.
Researchers from Massachusetts Institute of Technology and Qatar Computing Research Institute wrote in a 2015 paper that if one of their malicious machine learning algorithm servers gets randomly picked to be a user’s entrance guard, then it may be able to figure out what website that user is accessing. The MIT researchers are able to do this by analyzing the patterns of packets from a pre-determined list of websites and seeing if they match the traffic their malicious entrance guard snoops. [17] [18]
According to MIT News, the MIT machine learning algorithm has above an 80% chance to be able to identify what hidden services a given Tor participant is hosting, but there are two conditions. First the host has to be directly connected to its malicious entrance guard and second the hosted site was on MIT’s predetermined list. [18] And finding who is the host of controversial materials is often of more interest to oppressive regimes than just who are the website’s visitors.
How can you avoid this?
There are a few ways you can reduce your risks with malicious entrance guards and middle relays.
First, use your own hosted ob4s bridge as an entrance guard to avoid ever having both a malicious relay and guard. Our company can help you set this up on a cloud server (VPS) or create it for you. See our product page for more details.
And second, you can enter Tor with a VPN first.
Opening Files Outside of Tor
If files are opened outside of Tor Browser, they could have code that executes and reveals back to an adversary your real IP address. To avoid this, one can use a dedicated virtual machine like Whonix, which forces all traffic in the VM through Tor. Another option is the Tails operating system on a USB stick, which automatically erases everything after you’re done.
However, if you want to use a PDF outside of Tor, then you’ll need to convert it to plain text. One great Linux tool to do this inside Whonix’s command line is PDFtoText. You can install it with this command:
sudo apt install poppler-utils
Then use it with this:
pdftotext -layout input.pdf output.txt
The -layout flag keeps the original layout. input.pdf is the original file, and output.txt is what you want the output to be named.
Ultrasonic Cross Device Tracking
As University of California Santa Barbara cybersecurity researchers presented at a BlackHat European conference, malicious websites can identify users through Tor using sounds invisible to the human ear. [20]
The way this works is that many popular phone apps use Silverpush’s ad system, which can receive high frequency audio without the phone’s owner being aware of it. Audio of this type could be broadcast maliciously from a Tor website.
These doctoral researchers warned of the dangers Silverpush presents by being connected to wide-spread platforms such as Google Ads. To demonstrate this, the researchers played video of their lab experiment, which de-anonymatized a laptop through Tor Browser, as a result of an Android’s mic next to the laptop’s speakers, while being signed in to a Google account. [34]
While the researchers presented a Chrome browser app that can stop this, we do not recommend it for Tor use because of fingerprinting (and Tor Browser is Firefox based). The best solution is to turn off the speakers and any phones around you when visiting controversial or private websites. Also consider a degoogled phone with a custom operating system, such as Graphine or Calyx, which would allow you to modify when apps have microphone privileges.
Conclusion
In this article, we covered a variety of different ways your identity can be revealed through Tor. To summarize your best defenses are:
1) Disable JavaScript with Tor’s Safest Setting
2) Use a custom private entrance bridge (ob4s) for an entrance guard that you control. Our company can help you set this up.
3) Use Whonix or Tails when you need JavaScript or for doing anything outside a browser, such as opening unknown software or files
4) Before connecting to Tor, first use a high quality VPN with OpenVPN (Avoid Wireguard)
5) Avoid resizing Tor Browser because of fingerprinting
Simplified Privacy can help you by setting up a custom ob4s bridge for you on a cloud provider of your choosing. This would provide significant privacy since you’d control your own entrance guard. You would get the passwords (and SSH login), which you could change. We’d walk away and you’d be in full control of your own private server.
You can speak with us via end-to-end encryption like Signal, Session, or XMPP and pay for this with anonymous cryptocurrencies. Enjoy the privacy of our “No JavaScript” .Onion website and we process all crypto payments on our own private node. You would get a lot out of subscribing for free to our new content by email, by Session messenger, RSS feed, or Nostr.
The sources for this article can be found here.