- What is Data Feed?
- What is Cyber Threat Intelligence (CTI)?
- What are Threat Intelligence Data Feeds?
- What is a botnet?
- 4 reasons why spam is dangerous
- Why TOR exit nodes may be dangerous?
- What is the attack surface?
- 5 main components of Threat Intelligence
- What are the key features of a Threat Intelligence Platform (TIP)?
- What is an Indicator of Compromise (IoC)?
- What is CIDR?
- What is a Domain name?
Why TOR exit nodes may be dangerous?
TOR is a network that allows users to browse the web anonymously by sending their internet traffic through a chain of volunteer-run servers called nodes. When using TOR, the data is scrambled and transferred through multiple nodes before reaching the final destination.
Each node peels off a layer of encryption to reveal only the next node in the chain, but not the origin or destination of the data.
The last node, or the exit node, removes the last layer of encryption and delivers the original data to its destination without disclosing, or even knowing, the origin IP address. Therefore, a TOR exit node is a specific gateway where scrambled TOR traffic reaches the Internet.
TOR exit nodes can introduce certain potential risks:
FOR USERS
1. Traffic Snooping
TOR exit nodes can spy on and capture unencrypted traffic that flows through them. While TOR scrambles the data within the network, if the communication is not encrypted from end to end (e.g., using HTTPS), the exit node can potentially see the content of the traffic. This poses a risk for users sending sensitive or confidential information.
2. Malicious Exit Nodes
As a result of #1, exit nodes may tamper with the traffic flowing through them and inject malware.
3. Man-in-the-Middle Attacks
As a result of #1, exit nodes can attempt man-in-the-middle attacks by intercepting communications between the user and the final destination. They may impersonate websites or alter the data transmitted between the parties, potentially leading to the theft of sensitive information or compromising the integrity of the communication.
4. Legal Implications
The anonymity provided by TOR can attract illegal activities. As TOR exit nodes are where TOR traffic reaches the regular internet, law enforcement agencies may scrutinize exit nodes and their operators for any involvement in illegal activities.
FOR ORGANISATIONS
Many online services, SaaS platforms, webshops, etc., do not welcome users who are hiding their IP address using TOR. TOR is not widely used for enterprise or business purposes. Legit users seldom use TOR to access web services.
In most cases, traffic from TOR exit nodes can be blocked without much harm. As a more costly option, this traffic can be flagged, monitored, and activities from TOR exit nodes shall be closely examined.
Our daily TI feed contains about 20,000 TOR exit nodes, labeled with threatType = ‘tor’, which you can use as a deny-list to block the traffic, or feed to your internal security system, which will flag activities from the TOR exit nodes.