On July 4 2014 Tor Team discovered a group of malicious relays that they assume were trying to deanonymize Tor Network users with confirmation attack technique.

Tor network is an excellent technology to ensure users’ online anonymity, thanks to the Tor network users can hide online activities, staying far from the prying eyes of governments and law enforcement. Recently, members of the Tor project warned their users about the presence of a critical vulnerability that was probably being used to de-anonymize the identity of users within Tor network. A few weeks ago, researchers  from Carnegie Mellon University’s computer emergency response team (Cert), Alexander Volynkin and Michael McCord, revealed that they are able to de-anonymize Tor users using a cheap equipment. Initially they planned to reveal their discovery during the next Black Hat Conference in August, but later they have announced that they will not participate in the conference. On July 30th, the website of the Tor project published a security advisory to reveal that early this month, on July 4th 2014, a group of relays suffered a cyber attack that was conducted probably to deanonymize users. The experts at Tor project noticed that bad actors were targeting relays to track users accessing Tor networks or access Tor hidden services.

The security advisory explains that bad actors were leveraging a critical flaw in Tor to modify protocol headers in order to perform a traffic confirmation attack and inject a special code into the protocol header used by attackers to compare certain metrics from relays to de-anonymize users. The advisory reports that 115 malicious fast non-exit relays (6.4% of whole Tor network) were involved in the attack, the servers were actively monitoring the relays on both ends of a Tor circuit in an effort to de-anonymize users. The malicious relays were running Tor version 50.7.0.0/16 or 204.45.0.0/16 and bad actors were using them trying to de-anonymize Tor users who visit and run so-called hidden services. The malicious relays joined the Tor network on January 30th 2014 and experts at Tor Project removed them from the network on July 4th 2014.

The members of Tor project team also advised hidden service operators to change the location of their hidden service.

“While we don’t know when they started doing the attack, users who operated or accessed hidden services from early February through July 4 should assume they were affected,” Tor said.

When users access the Tor network with Tor software, their IP address is not visible and it appears to the Internet as the IP address of a Tor exit relay, which can be anywhere.