The Privacy Problem - TOR vs VPNs: Down The Rabbit Hole Part 2

In the first part of this series we laid the foundations, covering what the internet really is, how the web works, how search engines crawl and index it and why 96% of it remains invisible to Google. If you haven’t read it yet I’d recommend starting there before diving into this one. Now that the foundations are out of the way, things get interesting. In this part we get into the philosophy and idea behind TOR, why privacy was never a built in feature of the internet and why that became a serious enough problem for the US Navy to solve. We also get into VPNs, why that trust has limits and walk through real world case studies where that trust became a fatal opsec mistake. The Privacy Problem Imagine the internet as a global postal service, all the protocols are the logistics that carry your letters from one place to another and make sure they reach the right person without getting tampered with. The infrastructure that allows all of this is owned and controlled by private entities (ISPs) and these networks of private entities make the postal service scale globally.In order to send a letter the entities involved in logistics need to know the sender as well as the receiver, because at the end of the day you cannot send a letter without revealing the destination. While they might not be able to read your letter they can assume what it’s about just by correlating the sender and receiver, for example if you are sending a letter to a government entity there is a set of possibilities what the letter could be about, which can be further narrowed down based on your background. Similarly the internet is no different, to send or receive anything you need to reveal who you are and who you are talking to. Privacy never existed in the foundations of the internet, it was always an add on feature rather than a built in pillar and the problem with add on features is that they are inherently less secure. TOR essentially kept this in mind and solved this problem to a great extent by being specifically built for privacy and anonymity. Because of how the internet’s routing worked, privacy was structurally impossible, the system couldn’t function without knowing who you are and who you are talking to. This was a very big concern especially for the three letter federal agencies like the CIA, because the entity owning the infrastructure like a foreign ISP could figure out who the CIA was communicating with and in the worst case what they were talking about.This privacy nightmare soon led a group of US naval scientists to come up with an idea, to maintain privacy where it was considered impossible. The Onion Router source: wikimediaTOR also known as The Onion Router, was originally developed in the 1990s by a group of US Navy scientists who wanted a way to use the internet without revealing who was talking to whom, hiding both the sender and the receiver. But they soon realised TOR would essentially be useless without a large number of users, something we will get into shortly.This prompted the military to collaborate with the public in the early 2000s, which was quite fascinating as two distinct ideas of privacy came together: the authoritarian(military) and the libertarian (public), both shaping what privacy means today and laying the foundations of what TOR stands for. The primary goal of TOR was to provide a private way to access the internet in such a way that anyone monitoring the network like the ISPs couldn’t figure out who was talking to whom, in an age where the internet had become a mass surveillance tool. Getting back to the postal example, technically a sender’s address can be spoofed since in most cases it isn’t verified. TOR does something similar, it provides private access to the internet by hiding your true identity, or in other words by anonymizing you. But how does it achieve this?To understand this we need to start with what TOR actually is. TOR is a distributed overlay network, which means it is a decentralized network that overlays on top of the internet to anonymize low latency TCP connections like instant messaging. By low latency it means anything that is near instantaneous like web browsing where results come back in real time. This network consists of a diverse set of nodes or servers that act as onion routers or relays, which are basically volunteers with high bandwidth connections who act as proxies distributed across the globe. TOR uses the same infrastructure and protocols the internet provides but with its own tweaks layered on top.Before we dive into what those tweaks are, let’s understand how TOR anonymizes you. As I said, privacy is considered a myth on the internet because all the components that help you communicate know who you are and what you want. By design the internet never held a place for privacy, that’s because the internet we have today was just a hypothesis back in its foundational years, but TOR changed that. Tracert: Public Routing Example Let’s say Alice wants to visit Facebook. In a simplified situation where she is accessing the internet from her home network, the request would first route to her WiFi router, then to the ISP which is the WAN connected to the global internet, and finally to the destination server which in this case is facebook.com. Now everyone that carried her data including Google, her ISP, Facebook, and even the government depending on the level of surveillance, knows who she is and just enough to draw a picture of what she is doing.What do I mean by just enough?Well, technically because of TLS (Transport Layer Security) and HTTPS (Hypertext Transfer Protocol) her ISP and the other components cannot see the exact content she is accessing or the data she is sharing, but they can see the site she is visiting and they can observe the size and frequency of her traffic to draw a picture of what she is likely doing. This is known as traffic analysis, something we will look at more closely later.Can't alice use VPN instead to hide herself ?That's a fair question, but there is a slight problem.. Why VPNs Are A Bad OpSec (Operational Security) The all in one solution apart from TOR is a VPN, or at least that’s how it’s marketed. VPNs can be used to hide your true identity from the ISP and the server you are talking to, but at the end of the day most VPNs are private corporate entities. Depending on your need a VPN can either be good or it can be a fatal opsec mistake. To understand this let’s see how a VPN works using the same example.Tracert: VPN Routing ExampleThis time Alice decided to hide her identity using a commercial VPN, so now her request to facebook.com goes from her device to the router, from the router to the ISP, from the ISP to the VPN server, and from the VPN server to the Facebook server. Here the VPN has created an encrypted tunnel between Alice and the Facebook server, so all the ISP can see is that Alice is connecting to a random server in Romania and cannot see the domain she is visiting or what she is doing. Same with Facebook, because now Facebook thinks the VPN server is her true identity. Notice how in the above screenshot of the tracert result we cannot see our router and ISPs network, that is because all of that is inside the encrypted tunnel created by the VPN meaning your ISP and Router cannot read the packets sent by tracert, on the other hand everything listed in the tracert result marks the area where the VPN tunnel doesn't exist that would be the VPN gateway which is the last thing your ISP sees. This sounds good right, but it’s only good if the aim is having a decent amount of privacy while surfing the internet or bypassing regional restrictions by appearing to access the internet from a certain region like Germany. When it comes to being invisible in the digital world or leaving no trace, a VPN is not the solution. The simple answer to why is the lack of trust and lack of operational security. Let me make this more clear with some real world examples of why a VPN can be a fatal opsec mistake. Example 1: LulzSec source: wikipediaLulzSec is a pretty popular name in the world of cybersecurity, also known as Lulz Security, a grey hat hacker group known for several high profile attacks and stories of betrayal. This particular story is one of the best examples of why VPNs are bad opsec when the stakes are high. One of the most noticed attacks that grabbed global attention was the attack on Sony Entertainment, stealing 37,500 customer records from their website. This was also a dark period for Sony since LulzSec was not the only group targeting them around this time. Cody Kretsinger, also known as Recursion, a core member of the LulzSec group, managed to hack Sony Entertainment. As part of simultaneous arrests and raids by the FBI and international agencies, the LulzSec group was being closely monitored, especially their IRC chat where the lulzsec members revealed the use of HideMyAss, a UK based commercial VPN that promised to keep your browsing private. Noticing this, the UK court ordered a subpoena to HideMyAss where, being a corporate entity, they had to cooperate with the law enforcement and provide the logs that revealed the true identity of many members including Recursion. This is not an isolated case, many commercial VPNs like PureVPN have complied with law enforcement despite their policy of no logging or private browsing, because at the end of the day they are corporate entities that have to comply with the law to continue their operations. Example 2: DoubleVPN source: https://www.europol.europa.eu/Another example where compliance wasn’t even the factor was the case of VPN providers like DoubleVPN and VPNLab. Both of these were marketed specifically to criminals and provided something uncommon in a standard VPN which is double VPN, meaning your data goes through two encrypted VPN servers instead of one. This is not a common feature in other commercial VPNs because it increases latency and slows down speed at the cost of more privacy, which was excellent for cybercriminals and they trusted it blindly, until an operation by Europol in collaboration with multiple international agencies seized both VPNLab and DoubleVPN, getting access to all their logs and servers which led to unmasking and taking down some major criminal networks.Now despite all of this, VPN providers like Mullvad and ExpressVPN have been known to deny cooperation with law enforcement multiple times, but it’s still a fatal opsec mistake to use a VPN if your goal is staying invisible especially on the dark web. Because at the end of the day for features like double VPN you need to pay, and the moment you make a payment whether using crypto or not, you add another trail leading back to your real identity.This is exactly where TOR stands out, it truly helps you get invisible. So let’s understand how. Hiding In Plain Sight TOR has a very interesting and somewhat contradicting way of making you invisible. Where one might think of hiding, the architecture of TOR says “you cannot become invisible by trying to hide.” That’s right, in fact trying to hide will just make you the center of attention. Instead TOR uses something called multiplexing. In the simplest terms, multiplexing involves taking diverse streams of data and combining all of it into a single stream. So when you access TOR from the TOR Browser your device acts as an Onion Proxy. The TOR Browser comes as a package with the Onion Proxy built in, this is your manager, it handles the whole TOR session in the background so you can surf the internet without a worry. The Onion Proxy carries out the first multiplexing where your data is packed into a fixed size packet or a relay cell which we will talk about soon. So no matter what you are doing, all traffic is represented by the same fixed size packet whether you are downloading, surfing the dark web, or anything else. This was the first multiplexing carried out at the client side. The second multiplexing takes place at the network layer, where the relays that carry your traffic merges it with the traffic of thousands of other TOR users. So TOR combines all user traffic into a single stream, this is similar to pushing you into a crowd of people all wearing a white hoodie, white mask and white gloves. For someone looking from above they cannot pinpoint or identify a specific person because everyone looks exactly the same.In a way TOR hides you by making you look indistinguishable from every other user on the network, something VPNs cannot provide. What’s Next? Multiplexing is just one piece of the puzzle. In the next part we get into the architecture that makes TOR work, the onion routing, the hidden services and everything in between. That’s where the real magic happens, so hang tight for part three.Until next time, stay safe..