Active and Passive TOR Detection
Tor is a self organizing peer-to-peer network application. It encrypts network communications and also randomly spreads it across other Tor nodes to prevent traffic analysis.
Tor can be used for anonymous network browsing. It has recently been reported as being used by the Storm worm to connect to other potential victims as well as obtain command and control instructions.
Hostile "Tor users" have been running a Tor network "end node" in order to monitor and sniff unencrypted exit traffic for sensitive information.
For the Passive Vulnerability Scanner, several plugins exist
- 2542 - Tor Tunnel Detection (detects on start of Tor communication)
- 2543 - Tor Tunnel Detection (detect ongoing Tor communication)
- 4212 - Tor Tunnel 'End Point' Server Detection
When analyzing a network that contains Tor applications, you should ask yourself the following questions:
- Does carrying this anonymous traffic expose my network to risk?
- Does the presence of Tor indicate that the network has been compromised?
- Has there been an increase in the amount of virus, IDS or other types of alerts from the systems running the Tor software?
- Does the host running Tor consume noticeable network bandwidth?
- Does Tor open up any unauthorized or un-auditable connections into our network?
Below is a screen shot of a node discovered to be running Tor as viewed under the Security Center. This particular host also has a version of Firefox which is fairly outdated.
This site also was running the Log Correlation Engine with a Tenable Network Monitor. When viewing the last 25 days of network connections from this node, several were made to ports in the 9000-9100 range which is common for Tor communication. Below is a bar chart port summary of all TCP and UDP network connections.
This discovered Tor node was a client. If it were a Tor end server, the Log Correlation Engine and Tenable Network Monitor agent could have been used to analyze all "outbound" network connections.
For More Information
Nessus active network scans do not discover clients with installed Tor software. Tor clients don't have open ports which can be identified with traditional network connection requests and fingerprints.
If this is a requirement, consider performing a credentialed network scan and enumerate the installed software. Keep in mind that if you want to find out this sort of information in real time, you should use a network IDS or monitor the network with the Passive Vulnerability Scanner.
For other thoughts on passive network monitoring, we've blogged before about several different methods such as watching for new ports being browsed on, detecting network proxies and monitoring traffic for known and unknown encryption.