Something is rotten in the state of Tor: Swedish researchers have found at least 22 corrupted exit nodes that were tampering with encrypted traffic leaving the supposedly private Tor network.
While the corrupted nodes were able to touch only a small amount of Tor traffic, they're evidence of what security experts have long feared: that criminals or spies could exist among the volunteers who operate Tor's network and thus undermine Tor's implicit mutual trust.
MORE: What is TOR? Frequently Asked Questions
Tor, short for The Onion Router, is an Internet protocol that anonymizes users' Web traffic by stripping it of personally identifiable information and passing it through several different servers, also called nodes or relays, to disguise its point of origin before it reaches its final destination.
A data packet's path through the Tor network is similar to the roundabout path a person might take through a city, changing cars several times along the way, to shake off a pursuer.
But at some point, all Tor data has to leave the Tor network via an exit node to arrive at its final destination.
Unencrypted data passing through an exit node can be read by the operator of the node, just as it can on any normal Web server. Tor users have to either trust that exit-note operators aren't reading their traffic, or make sure to use only secure HTTPS or SSL connections when they first access the network.
Now, two researchers from Karlstad University in Sweden have found 22 "spoiled onions" — Tor exit nodes that were deliberately sabotaging the SSL and HTTPS encryption of Web traffic passing through them.
As part of online "man-in-the-middle" attacks (in which attackers insert themselves between their target and their target's intended destination in order to spy on or alter the target's incoming and outgoing data), these 22 nodes were undermining Web encryption by either turning HTTPS traffic into plain, unencrypted HTTP traffic, or by replacing the security certificates with forgeries convincing enough for the sending servers to provide decryption keys to establish "secure" connections.
What does that mean for Tor users? If someone used Tor to protect financial information when making an online payment, for example, and that Web traffic passed through a compromised exit node, the node operators might be able to decrypt the online session to see and record financial information.
This isn't the first time Tor exit-node operators have been found to be rotten. In 2007, Swedish security consultant Dan Egerstad showed that he could capture sensitive data, such as government emails and passwords, by running a traffic analysis program called a "packet sniffer" on five Tor exit nodes.
Now, the question everyone's asking themselves: Could the U.S. National Security Agency be behind these malicious Tor exit nodes? Not likely, the researchers say.
"Organizations like the NSA have read/write access to large parts of the Internet backbone," one of the researchers, Philipp Winter, told the tech blog Ars Technica. "They simply do not need to run Tor relays. We believe that the attacks we discovered are mostly done by independent individuals who want to experiment."
MORE: NSA Has Trouble with Tor, Snowden Documents Show
The researchers did find that all but one of the 22 nodes were located in the network of a Russian-based virtual private system provider.
These findings highlight the inherent risks of using Tor, even when connecting to secure servers, because Tor users must, to some degree, trust relay operators not to read or tamper with their data packets.
However, whether individual Tor users are affected by these 22 "spoiled onions" is just a numbers game, and the odds are in your favor. Out of approximately 1,000 exit nodes active during the month that the researchers performed their study, only 22 were malicious. The nodes' operators can't target individual Tor users, so whether these "spoiled onions" can actually affect Tor users is just a numbers game.
Furthermore, when Tor plots a route for data through its network, it prefers faster relays over slower ones, and the 22 affected relays had a small bandwidth that made them less likely to be chosen.
If you use the Tor Browser bundle, make sure you enable the HTTPS Everywhere extension, which can protect you from some of these attacks.
Finally, the researchers created an exit-node scanner that you can download from Github to see if Tor traffic has been compromised.
Email jscharr@techmedianetwork.com or follow her @JillScharr and Google+. Follow us @TomsGuide, on Facebook and on Google+.
