Untitled


<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <title>Killing Tor2Web once and for all - detect &amp; deny Tor2Web-users</title>
    <meta name="description" content="" />
    <meta name="HandheldFriendly" content="True" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <link rel="shortcut icon" href="/favicon.ico">
    <link rel="stylesheet" type="text/css" href="/assets/css/screen.css?v=ea56150a18" />
    <link rel="stylesheet" type="text/css" href="/assets/css/fonts.css?v=ea56150a18" />
    <link rel="canonical" href="https://chloe.re/2016/05/20/killing-tor2web-once-and-for-all/" />
    <meta name="referrer" content="origin" />
    <meta name="generator" content="Ghost 0.7" />
    <link rel="alternate" type="application/rss+xml" title="chloe  chloenlpvlemmmmd.onion" href="https://chloe.re/rss/" />
</head>
<body class="post-template nav-closed">
    <div class="nav">
    <h3 class="nav-title">Menu</h3>
    <a href="#" class="nav-close">
        <span class="hidden">Close</span>
    </a>
    <ul>
            <li class="nav-home" role="presentation"><a href="https://chloe.re/">Home</a></li>
            <li class="nav-posts-in-english" role="presentation"><a href="https://chloe.re/tag/english/">Posts in English</a></li>
            <li class="nav-posts-in-swedish" role="presentation"><a href="https://chloe.re/tag/swedish">Posts in Swedish</a></li>
    </ul>
    <a class="subscribe-button icon-feed" href="https://chloe.re/rss/">Subscribe</a>
</div>
<span class="nav-cover"></span>

    <div class="site-wrapper">


<header class="main-header post-head no-cover">
    <nav class="main-nav  clearfix">

            <a class="menu-button icon-menu" href="#"><span class="word">Menu</span></a>
    </nav>
</header>

<main class="content" role="main">
    <article class="post featured">

        <header class="post-header">
            <h1 class="post-title">Killing Tor2Web once and for all - detect &amp; deny Tor2Web-users</h1>
            <section class="post-meta">
                <time class="post-date" datetime="2016-05-20">20 May 2016</time>
            </section>
        </header>

        <section class="post-content">
            <p>I don't like Tor2Web. There I said it. I don't like Tor2Web because it simply destroys the purpose with having an onion. I believe that users that use my onion are anonymous to a certain degree, but if a user is using Tor2Web all this anonymity is gone. I can't offer the  anonymity that my onion is supposed to offer. </p>

<p>So let's kill Tor2Web once and for all. However, this was harder than I even could have imagine because some instances of Tor2Web are transparent so it's very hard to detect them. </p>

<p>I will share with you my journey on how I worked to detect Tor2Web-users and why I picked up this battle in the first place. </p>

<hr />

<h4 id="whatstheproblemwithtor2web">What's the problem with Tor2Web?</h4>

<p>The problem is that it's not anonymous. Of course Tor2Web states this several times and a user can clearly don't miss it. The problem is that users don't care and an onion is not meant to be used via a clear net proxy, but with Tor.</p>

<p>A user is talking to a clear net website instead of the onion so in theory the proxy can read all the information you're sending and getting from the onion. Also, you are far from anonymous because the Tor2Web-gateway sees your IP. </p>

<p>Another problem is that if the Tor2Web-gateway now would be sniffing and modifying traffic, the <a href="https://globe.torproject.org/#/search/query=&amp;filters%5Bflag%5D=Authority">authority dirs</a> have absolute no power to close the Tor2Web-gateway down. </p>

<p>According to some rumors there have been instances where Tor2Web-gateways actually rewrite Bitcoin-addresses in hope that users send money to the adress. I don't know if this is true but it's highly possible.  </p>

<p>So to conclude; Tor2Web-gateways reads data that is supposed to be end-to-end and anonymous. </p>

<p>Also, Facebook agrees with me: <br />
<img src="https://i.imgur.com/EZaCLfn.png" alt="" /></p>

<p></br> <p></p>

<p>But why is it hard to detect Tor2Web? Here's why:</p>

<ul>
<li>We can't ban via IP; it has 127.0.0.1</li>
<li>Tor2Web can modify traffic. Rely on Js is stupid </li>
<li>Tor2Web can be totally transparent </li>
</ul>

<hr />

<h4 id="detectingtor2webuserstheeasyway">Detecting Tor2Web-users the easy way</h4>

<p>The good thing about most of the public Tor2Web-gateways is that they are easy to detect. </p>

<p>First I created a script that checks if the user is on our domains. These domains are base64-encoded because otherwise it could be possible for the Tor2Web-gateway to rewrite them (adding .to, .link or .cab). </p>

<p>Here's the script and how it would look in action:</p>

<script src="https://gist.github.com/intchloe/2fb90cac49cba4e438a772c223ec5cac.js"></script>

<p><img src="https://i.imgur.com/hL2RFcv.png" alt="" /></p>

<p>But there're two major problems with this method:</p>

<ol>
<li>The user must have Javascript activated.  </li>
<li>The Tor2Web-gateway can still remove/change the script. </li>
</ol>

<p>However, this method works in most cases. But I want to go even further. </p>

<hr />

<h4 id="detectingtor2webuserstheharderway">Detecting Tor2Web-users the harder way</h4>

<p>Okay, let's say a user does not have Javascript. How can we then detect that the user is using Tor2Web? Well, we could check the users HTTP-header. Let's see if we see something that stands out. </p>

<p><strong>onion.link</strong> has the header <em>HTTP_X_TOR2WEB</em> so that's fantastic news! We can detect this Tor2Web-gateway on our server side!</p>

<p><strong>onion.to</strong> also uses the <em>HTTP_X_TOR2WEB</em> header!</p>

<p><strong>onion.cab</strong> does not use this header and the headers are pretty much totally transparent. Damn... </p>

<p>Alright, so now this is rather a mission to detect transparent Tor2Web-gateways because it's fun. Why stop here? Let's see how far we can go.</p>

<hr />

<h4 id="diggingdowntherabbithole">Digging down the rabbit hole</h4>

<p>The first thing I wanted to know was how Tor2Web (and onion.cab) actually rewrites onion-URL's. Does it uses regexp? Does it look for HTML-tags? </p>

<p>So I sat up the <a href="https://github.com/cure53/HTTPLeaks">Cure53 HTTP-leak</a> document on my onion and tried to visit it over <strong>onion.cab</strong>. To my surprise there were actually 55 tags that was not rewritten. You can see the complete list <a href="https://gist.githubusercontent.com/intchloe/fda9fe8871f6a718215a9ea39cc54d41/raw/650e372878a55baa2592b38da840af451b456110/onion.cab%2520bypasses">here</a>. Note that <strong>onion.to</strong> and <strong>onion.link</strong> both rewrote all the links correctly. </p>

<p>So that's pretty interesting. We can use some HTML-tags that <strong>onion.cab</strong> will not be handling correctly. So we could use any of these tags to force the user to make a request, and if the request was not successful we will know that the user does not use a direct Tor-connection (and therefore uses Tor2Web). </p>

<p>On <strong>onion.to/link</strong> I found that adding a backslash after the scheme actually does not get rewritten as you can see here: <br />
<img src="https://i.imgur.com/evA9XZt.png" alt="" /></p>

<p>But this is just one of <strong>many many</strong> "bypasses" I've found. The bypasses are not important, but rather how you use them. Read below!</p>

<hr />

<h4 id="exploitingthebugsbyprotectinglogins">Exploiting the bugs by protecting logins</h4>

<p>So we've found ways that we can construct URL's so Tor2Web won't rewrite them. So let's use this trick by simply forcing the user to POST data to an onion instead of via Tor2Web. With this trick, we will "save" the user so its credentials never goes through the Tor2Web-gateway. </p>

<video width="700" height="700" controls>
  <source src="https://nup.pw/Y6veai.webm" type="video/mp4">
</video>

<video width="700" height="700" controls>
  <source src="https://nup.pw/HxKwfU.webm" type="video/mp4">
</video>

<hr />

<h4 id="summaryandfinalwords">Summary and final words</h4>

<p>In this article I have shown you how we can use Javascript to detect if a user aren't using our domains and also how to detect Tor2Web via HTTP-headers. I've also shown you how you can [mis]use the bugs that Tor2Web has to protect POST-forms such as logins. </p>

<p>I highly recommend that you all stay away from Tor2Web as a user. You deserve privacy. As for you webmasters out there I highly recommend that you also have some sort of protection or notification that tells your users that they should not use Tor2Web. </p>

<p>Last but not least I created a small PHP-script that can detect Tor2Web-users based on headers, UA and via Js:</p>

<script src="https://gist.github.com/intchloe/82c6de46cd1f878d0dc0a9597a5c90dd.js"></script>
        </section>

        <footer class="post-footer">


            <figure class="author-image">
                <a class="img" href="/author/chloe/" style="background-image: url(/content/images/2016/04/49.png)"><span class="hidden">chloe's Picture</span></a>
            </figure>

            <section class="author">
                <h4><a href="/author/chloe/">chloe</a></h4>

                    <p>I really love privacy and I will fight for your right to it! </p>
                <div class="author-meta">
                    <span class="author-location icon-location">Sweden</span>
                    <span class="author-link icon-link"><a href="https://chloe.website/">https://chloe.website/</a></span>
                </div>
            </section>


            <section class="share">
                <h4>Share this post</h4>
                <a class="icon-twitter" href="https://twitter.com/intent/tweet?text=Killing%20Tor2Web%20once%20and%20for%20all%20-%20detect%20%26%20deny%20Tor2Web-users&amp;url=https://chloe.re/2016/05/20/killing-tor2web-once-and-for-all/">
                    <span class="hidden">Twitter</span>
                </a>
                <a class="icon-facebook" href="https://www.facebook.com/sharer/sharer.php?u=https://chloe.re/2016/05/20/killing-tor2web-once-and-for-all/">
                    <span class="hidden">Facebook</span>
                </a>
                <a class="icon-google-plus" href="https://plus.google.com/share?url=https://chloe.re/2016/05/20/killing-tor2web-once-and-for-all/">
                    <span class="hidden">Google+</span>
                </a>
            </section>

        </footer>

    </article>
</main>

<aside class="read-next">
    <a class="read-next-story prev no-cover" href="/2016/05/15/the-problem-with-writing-to-dev-null/">
        <section class="post">
            <h2>The problem with writing to /dev/null</h2>
            <p>If you are like me that take privacy very seriously you most definitely already write logs or other metadata&hellip;</p>
        </section>
    </a>
</aside>


        <footer class="site-footer clearfix">
            <section class="copyright"><a href="https://chloe.re">chloe.re</a> &copy; 2016</section>
        </footer>
    </div>

    <script type="text/javascript" src="/assets/js/jquery-1.11.3.min.js?v=ea56150a18"></script>
    <script type="text/javascript" src="/assets/js/jquery.fitvids.js?v=ea56150a18"></script>

    <script type="text/javascript" src="/assets/js/index.js?v=ea56150a18"></script>
</body>
</html>