works - How ONION hidden services work - Tor use cases with a install demo - Tor deanonymizing? - Tor Exit relays dangers - Tor ONION hidden services web security - Tor relay live demo
The Surface Web, in comparison, contains 19 terabytes of content. • The Deep Web has between 400 and 550 times more public information than the Surface Web. • More than 200,000 Deep Web sites currently exist. • Together, the 60 largest Deep Web sites contain around 750 terabytes of data, surpassing the size of the entire Surface Web 40 times. • The total quality of the Deep Web is 1,000 to 2,000 times greater than the quality of the Surface Web. • 550 billion individual documents can be found on the Deep Web compared to the Surface Web’s 1 billion individual documents. • 95% of the Deep Web is publically accessible, meaning no fees or subscriptions.
principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997.
network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.
and you can't connect to it. https://torstatus.blutmagie.de/ An increasing number of censoring countries are using Deep Packet Inspection (DPI) to classify Internet traffic flows by protocol. While Tor uses bridge relays to get around a censor that blocks by IP address, the censor can use DPI to recognize and filter Tor traffic flows even when they connect to unexpected IP addresses. https://gitweb.torproject.org/pluggable-transports/obfs4.git/
domain with a tempting name(such as bitcoinbuy) and then created a sub-domain(admin.) by using vhost and sat up a simple login. I did not use any databases for this, only a simple PHP-script which allowed any password ending in "sbtc" and therefore I just created random passwords using binascii.b2a_hex and the suffix "sbtc".(e.g d25799f05fsbtc)
nodes using the Stem API, then create a unique password for each fingerprint and use that password for logging into the domain. All this is of course saved to a file so I later can go back and see what fingerprint used for password. The PHP-login also saved all the logins with used username, password, user agent, IP and time. The Python-script uses Tor Browser Bundle's user agent.
heavily modified. There was also a public message announcement in the index saying that we're moving all the bitcoins to our wallets so you can't login yet because there was a login form on the frontpage also. The Python-script also tries to make it look legit by first visiting the indexpage and sleep for 1-4 seconds and then navigating to the admin-page and login with the unique password and username "admin" and also a captcha. So it looks like this in the access log(IP removed):
you are from where you are going on the Internet. What content and data you transmit over Tor is controlled by you. Active content, such as Java, Javascript, Adobe Flash, Adobe Shockwave, QuickTime, RealAudio, ActiveX controls, and VBScript, are binary applications. These binary applications run as your user account with your permissions in your operating system.
service “I've discovered several such exposures over the last six months, reporting them wherever a contact was provided. And it's not just static pages or small personal sites that are vulnerable. Even sites where user privacy is absolutely imperative show negligence in this regard. Toward the end of 2015, I found a popular .onion search engine that had failed to disable the status module. As you might imagine, the result was not pretty.”
Tor users [tor-talk] Javascript exploit - https://lists.torproject.org/pipermail/tor-talk/2016-November/042639.html “The malicious payload it delivers is almost identical to one that was used in 2013 to deanonymize people visiting a Tor-shielded child pornography site. The FBI ultimately acknowledged responsibility for the exploit, which was embedded in webpages served by a service known as Freedom Hosting.” https://tsyrklevich.net/tbb_payload.txt
to allow the attacker to execute arbitrary code on the targeted system by having the victim load a web page containing malicious JavaScript and SVG code. It used this capability to collect the IP and MAC address of the targeted system and report them back to a central server. While the payload of the exploit would only work on Windows, the vulnerability exists on Mac OS and Linux as well.”
cujanovic
odashi
ykanoh
gogutan
jyouryuusui
takahashim
syuchimu
4o1sobblue
kakehashi
techtekt
ludicmind
pfn
greenmidori
cassininazir
reverentgeek
tammyeverts
geoffreycrofte
inesmontani
chikuwait
ianozsvald
marketingsoph
jonoalderson
holman
chriscoyier
jnunemaker
![Predrag Cujanović cujanovic.com [email protected] @cujanovic Nenad Zarić [email protected]](https://files.speakerdeck.com/presentations/928420196de9463992ca129d062cb7d7/slide_1.jpg){kind=link}
