Tor turns to proof-of-work puzzles to defend onion network from DDoS attacks
(2023/08/26)
- Reference: 1693038667
- News link: https://www.theregister.co.uk/2023/08/26/tor_tweaks_onion_routing_software/
- Source link:
Tor, which stands for The Onion Router, weathered a massive distributed denial-of-service (DDoS) storm from June last year through to May.
While that attack has [1]subsided , DoS abuse remains a persistent problem, one that degrades the performance of the anti-censorship service and has left many worried about its security.
Tor's onion routing is a [2]privacy technology that dates back two decades. It basically works by relaying your internet traffic through a shifting maze of nodes so that, with some clever encryption encapsulation, a network eavesdropper, as one example, will struggle or be unable to discern your true public IP address, which could be used to identify you and link any observed online activity to you specifically. [3]Caveats apply .
[4]
The project remains a target for [5]governments and a boon for those who want to communicate privately. Those using Tor may access [6].onion addresses via the Tor Browser, which is good but not perfect.
[7]
[8]
(Tor can be used to access non-onion services on the public internet, but this article concerns fending off DDoS attacks that disrupt access to .onion sites.)
To thwart future debilitating DDoS attacks, Tor developers have been working on a defense first [9]proposed in April 2020. It just arrived in [10]Tor version 0.4.8.4 and it relies on a mechanism developed in 1992 [11]by Moni Naor and Cynthia Dwork as a defense against DoS and spam but made famous for energy profligacy by Bitcoin: proof-of-work.
[12]
Essentially, clients trying to reach .onion services may be asked to complete small proof-of-work tests. If you're connecting as a legit user, you shouldn't notice anything. If you're trying to hammer the project's network of nodes with lots of repeated connections, the proof-of-work challenges may well hamper your attempts.
"If we ever hope to have truly reachable global onion services, we need to make it harder for attackers to overload the service with introduction requests," explain Tor contributors George Kadianakis, Mike Perry, David Goulet, and Tevador in the project outline. "This proposal achieves this by allowing onion services to specify an optional dynamic proof-of-work scheme that its clients need to participate in if they want to get served."
The updated software, used to run Tor nodes, now supports a proof-of-work challenge called [13]EquiX . Designed by Tevador, who developed [14]Monero's proof-of-work algorithm, it is "a CPU-friendly client puzzle with fast verification and small solution size (16 bytes)."
[15]
It appears this computation will not go toward cryptomining, which some may feel is a lost revenue opportunity and others may welcome as an ethical necessity.
[16]FYI: Tor Browser is very much still a thing and getting updates
[17]Malware disguised as Tor browser steals $400k in cryptocash
[18]Veilid: A secure peer-to-peer network for apps that flips off the surveillance economy
[19]Last rites for the UK's Online Safety Bill, an idea too stupid to notice it's dead
In a [20]blog post , Pavel Zoneff, director of communications for The Tor Project, explained that the way .onion services have been designed to provide privacy by obscuring user IP addresses makes them vulnerable to DoS attacks while also hindering IP-based rate limiting.
Tor's proof-of-work puzzle defaults to zero effort and is designed to scale up as network stress rises, taking into account client and server feedback.
Before accessing an onion service, a small puzzle must be solved, proving that some 'work' has been done by the client
"Before accessing an onion service, a small puzzle must be solved, proving that some 'work' has been done by the client," Zoneff said. "The harder the puzzle, the more work is being performed, proving a user is genuine and not a bot trying to flood the service. Ultimately the proof-of-work mechanism blocks attackers while giving real users a chance to reach their destination."
The hope is that making increasingly large computational demands on attackers will discourage abuse while allowing legitimate traffic to continue, though some legit users may notice a difference. According to Zoneff, users who submit only a few network requests will experience a small delay, on the order of five milliseconds for faster devices and as much as 30 milliseconds on slower hardware.
"If the attack traffic increases, the effort of the work will increase, up to roughly 1 minute of work," said Zoneff, who likened the experience to waiting on a slow network connection.
The initial proposal points out that this may affect Tor users on mobile devices more than on desktop devices, since prolonged puzzle-solving could drain the device's battery.
Tor developers may want to give more thought to the downsides of proof-of-work as the recent [21]debut of Veilid , a novel peer-to-peer networking technology, suggests alternative approaches to anonymity-preserving communication.
It's early days, but the ability of Veilid to route around such attacks could be crucial if enough users get on board. ®
Get our [22]Tech Resources
[1] https://status.torproject.org/issues/2022-06-09-network-ddos/
[2] https://tb-manual.torproject.org/about/
[3] https://support.torproject.org/faq/staying-anonymous/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.themoscowtimes.com/2021/12/07/why-the-kremlin-blocking-tor-is-a-big-deal-a75751
[6] https://community.torproject.org/onion-services/overview/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://github.com/torproject/torspec/blob/main/proposals/327-pow-over-intro.txt
[10] https://forum.torproject.org/t/stable-release-0-4-8-4/8884
[11] https://link.springer.com/chapter/10.1007/3-540-48071-4_10
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://github.com/tevador/equix
[14] https://github.com/tevador/RandomX
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2023/06/25/tor_browser_update_improves_interface/
[17] https://www.theregister.com/2023/03/30/kaspersky_clipboard_tor_malware/
[18] https://www.theregister.com/2023/08/12/veilid_privacy_data/
[19] https://www.theregister.com/2023/08/21/opinion_column_monday/
[20] https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/
[21] https://www.theregister.com/2023/08/12/veilid_privacy_data/
[22] https://whitepapers.theregister.com/
While that attack has [1]subsided , DoS abuse remains a persistent problem, one that degrades the performance of the anti-censorship service and has left many worried about its security.
Tor's onion routing is a [2]privacy technology that dates back two decades. It basically works by relaying your internet traffic through a shifting maze of nodes so that, with some clever encryption encapsulation, a network eavesdropper, as one example, will struggle or be unable to discern your true public IP address, which could be used to identify you and link any observed online activity to you specifically. [3]Caveats apply .
[4]
The project remains a target for [5]governments and a boon for those who want to communicate privately. Those using Tor may access [6].onion addresses via the Tor Browser, which is good but not perfect.
[7]
[8]
(Tor can be used to access non-onion services on the public internet, but this article concerns fending off DDoS attacks that disrupt access to .onion sites.)
To thwart future debilitating DDoS attacks, Tor developers have been working on a defense first [9]proposed in April 2020. It just arrived in [10]Tor version 0.4.8.4 and it relies on a mechanism developed in 1992 [11]by Moni Naor and Cynthia Dwork as a defense against DoS and spam but made famous for energy profligacy by Bitcoin: proof-of-work.
[12]
Essentially, clients trying to reach .onion services may be asked to complete small proof-of-work tests. If you're connecting as a legit user, you shouldn't notice anything. If you're trying to hammer the project's network of nodes with lots of repeated connections, the proof-of-work challenges may well hamper your attempts.
"If we ever hope to have truly reachable global onion services, we need to make it harder for attackers to overload the service with introduction requests," explain Tor contributors George Kadianakis, Mike Perry, David Goulet, and Tevador in the project outline. "This proposal achieves this by allowing onion services to specify an optional dynamic proof-of-work scheme that its clients need to participate in if they want to get served."
The updated software, used to run Tor nodes, now supports a proof-of-work challenge called [13]EquiX . Designed by Tevador, who developed [14]Monero's proof-of-work algorithm, it is "a CPU-friendly client puzzle with fast verification and small solution size (16 bytes)."
[15]
It appears this computation will not go toward cryptomining, which some may feel is a lost revenue opportunity and others may welcome as an ethical necessity.
[16]FYI: Tor Browser is very much still a thing and getting updates
[17]Malware disguised as Tor browser steals $400k in cryptocash
[18]Veilid: A secure peer-to-peer network for apps that flips off the surveillance economy
[19]Last rites for the UK's Online Safety Bill, an idea too stupid to notice it's dead
In a [20]blog post , Pavel Zoneff, director of communications for The Tor Project, explained that the way .onion services have been designed to provide privacy by obscuring user IP addresses makes them vulnerable to DoS attacks while also hindering IP-based rate limiting.
Tor's proof-of-work puzzle defaults to zero effort and is designed to scale up as network stress rises, taking into account client and server feedback.
Before accessing an onion service, a small puzzle must be solved, proving that some 'work' has been done by the client
"Before accessing an onion service, a small puzzle must be solved, proving that some 'work' has been done by the client," Zoneff said. "The harder the puzzle, the more work is being performed, proving a user is genuine and not a bot trying to flood the service. Ultimately the proof-of-work mechanism blocks attackers while giving real users a chance to reach their destination."
The hope is that making increasingly large computational demands on attackers will discourage abuse while allowing legitimate traffic to continue, though some legit users may notice a difference. According to Zoneff, users who submit only a few network requests will experience a small delay, on the order of five milliseconds for faster devices and as much as 30 milliseconds on slower hardware.
"If the attack traffic increases, the effort of the work will increase, up to roughly 1 minute of work," said Zoneff, who likened the experience to waiting on a slow network connection.
The initial proposal points out that this may affect Tor users on mobile devices more than on desktop devices, since prolonged puzzle-solving could drain the device's battery.
Tor developers may want to give more thought to the downsides of proof-of-work as the recent [21]debut of Veilid , a novel peer-to-peer networking technology, suggests alternative approaches to anonymity-preserving communication.
It's early days, but the ability of Veilid to route around such attacks could be crucial if enough users get on board. ®
Get our [22]Tech Resources
[1] https://status.torproject.org/issues/2022-06-09-network-ddos/
[2] https://tb-manual.torproject.org/about/
[3] https://support.torproject.org/faq/staying-anonymous/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.themoscowtimes.com/2021/12/07/why-the-kremlin-blocking-tor-is-a-big-deal-a75751
[6] https://community.torproject.org/onion-services/overview/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://github.com/torproject/torspec/blob/main/proposals/327-pow-over-intro.txt
[10] https://forum.torproject.org/t/stable-release-0-4-8-4/8884
[11] https://link.springer.com/chapter/10.1007/3-540-48071-4_10
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://github.com/tevador/equix
[14] https://github.com/tevador/RandomX
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOnNR9jLf8oFKjHHFkJgwQAAAU8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2023/06/25/tor_browser_update_improves_interface/
[17] https://www.theregister.com/2023/03/30/kaspersky_clipboard_tor_malware/
[18] https://www.theregister.com/2023/08/12/veilid_privacy_data/
[19] https://www.theregister.com/2023/08/21/opinion_column_monday/
[20] https://blog.torproject.org/introducing-proof-of-work-defense-for-onion-services/
[21] https://www.theregister.com/2023/08/12/veilid_privacy_data/
[22] https://whitepapers.theregister.com/
Anonymous Coward
> I... how would that even work??
> Who would get the money? how would you decentralise it? How would you ensure consensus?
In theory they could've designed it so that onion site owners could essentially run a mining pool. That is, the site farms out proof of work tasks for an existing currency, eg. bitcoin hashing, such that visitors would need to try a certain number of hashes on behalf of the site (who themselves get any proceeds) before they are allowed access.
Something similar was tried some years back, using cryptocurrency PoW implemented in Javascript to replace captchas and paywalls on websites. Unfortunately it was easily abused by malicious parties, and thus entirely blocked by web browsers. Which was a shame, because IMO it really was superior at spam-prevention and preserving privacy than the captchas that still survive to this day. But the cryptocurrency connection created perverse incentives for both bad actors and site owners, which is likely a big reason why they avoided such a connection in the Tor work.
It appears this computation will not go toward cryptomining, which some may feel is a lost revenue opportunity and others may welcome as an ethical necessity.
I... how would that even work??
Who would get the money? how would you decentralise it? How would you ensure consensus?
I mean a barn has a door, as does a car, but people aren't driving around the Cotswolds in a lovingly restored, 200 year old hay loft*, even if the beam work is both sympathetic and yet unobtrusive.
*Various models of Landrover excluded.