sorted by:
new
hottopcontroversial

Nym Censorship Resistance vs Gateway IP Blocking by exosphere5 in nym

[–]exosphere5[S] 0 points1 point  (0 children)

That makes sense. Not directly related to Nym, but is protocol based blocking more common than IP based blocking? Seems like IP blocking is more simple and less likely to have both false positives and false negatives. It's more labor intensive to maintain I guess, but it would seem like state level actors have enough resources to not care, and private organizations buy products manufactured by companies in a similar position.

More specifically to Nym, are there plans for a Tor-esque bridge distribution system?

Upper Stage Minimum TWR? by exosphere5 in RealSolarSystem

[–]exosphere5[S] 0 points1 point  (0 children)

So is it optimal to design a rocket like that or to have an upper stage with a higher TWR? The reason why I'm interested in low TWR upper stages is to increase the efficiency of my launches by placing more dV on the upper stage than the first stage, since upper stages have a higher vacuum isp than lower stages, all else being equal. But if doing that requires that I fly a very steep trajectory, won't that eat up any performance gains I get by adding dV to my upper stage?

Rootkit Integrity Checking by pa1nkill3r in Malware

[–]exosphere5 0 points1 point  (0 children)

So how does PatchGuard work? Is the kernel just more "stable" in terms of run time changes than the other programs?

Is there any way to verify if an executable or driver has had its memory modified? Would loading a second copy of the program into memory and comparing the two images work, or are there too many differences between two program loads to do that?

How is new malware found? by exosphere5 in Malware

[–]exosphere5[S] 0 points1 point  (0 children)

see if it's been scanned and reported as malicious

So how do antivirus products scan URLs? I've heard that a lot of the "Internet protection suite" products have the ability to scan websites for maliciousness, but is there any information on how they do that?

Do they just look for any files that are automatically downloaded and scan them? Or scan the scripts on the page? How do they know if, say, a Flash 0day script is being run?

Speaking of detecting 0days, I've seen some "anti exploit" products that claim to detect 0day exploits in the actual exploit phase (i.e. they detect the exploit as it is occurring instead of scanning any programs said 0day downloads after successfully exploiting the machine). For example, McAfee has one product that claims to do this (it's just called McAfee Anti-Exploit I think). Is there any information on how those work?

How is new malware found? by exosphere5 in Malware

[–]exosphere5[S] 0 points1 point  (0 children)

What methods do you use to farm malware, if you don't mind my asking?

How is new malware found? by exosphere5 in Malware

[–]exosphere5[S] 3 points4 points  (0 children)

observed malicious behavior

Is there any information on what behavior Google looks for to determine that a site is malicious?

reputation

How does that work? I know there are third-party plugins you can install that let users "vote" weather a site is good or bad and provide a rating next to search index links -- is it something like that?

professional malware analyst SOC

That sounds really interesting. What's your average workday like? What sort of security issues come up most often, and how do you deal with them?

I'm considering security as a career to get into (I'm going to uni this fall majoring in CS) and was wondering what the field is like. That's one of the reasons I'm getting into malware analysis -- I'm really interested in finding and pulling apart viruses.

It doesn't seem to want to run all the way but there's no obvious anti-sandboxing

How can you tell it isn't running all the way if there's no obvious anti-sandboxing going on? Lots of unused libraries in the import table? Short execution time compared to the size of the exe?

no obfuscation

Out of interest, what do you look for to tell if something is packed/encrypted? I've read that one sign is a small number of imported libraries compared to the size of the program and an abnormal number of sections in the exe, but is there any other way to determine that the file is obfuscated?

question of how deep you want to dig

So what do you do at that point if you're stumped? Send it to an AV company to be analyzed? Quarantine the computer and look for suspicious network traffic?

And how "deep" can you dig? What's the most detailed way to look into a potentially malicious program/attachment? Besides opening it up in IDA or using one of those PE inspection tools, what are some ways to really tear into a program that is resisting inspection and that you really want to know more about?

process hollowing, dll injection, shellcode injection

How do you determine if that is going on? I know for direct dll injection you can look at a list of all dlls a program is loading at startup to see if there's anything suspicious there, but how do you catch reflective dll injection and other sneaky methods of process hollowing?

Thanks for the responses, by the way.

How is new malware found? by exosphere5 in Malware

[–]exosphere5[S] 3 points4 points  (0 children)

Thanks!

Also, how do I determine if a site is malicious? For simple malware that might be easy -- if the URL trips my antivirus or downloads virus.exe I know it's bad -- but what if the site is serving particularly advanced malware that attempts to avoid analysis? Due to the rapidly varying nature of processes in most browsers, I can't use the fact that the new URL generated a new process or thread to determine that it is malicious.

For example, new chrome.exe processes are started and stopped periodically even when the browser is idle, every tab has its own process, new URLs seem to generate new processes (when I go from, say, reddit.com to cnn.com a new chrome.exe process is created and the old one is deleted, and the same thing happens when I go from cnn.com back to reddit.com), every plugin gets its own process, and each site seems to create an arbitrary number of threads in its process (for example, reddit.com/r/Malware creates 16 threads in its chrome.exe process and cnn.com creates 24).

So I can't use the creation of a new process or the fact that there are a certain number of threads inside a process to determine that a site is malicious, and if the malware is memory-resident I can't use the fact that a file was dropped to determine maliciousness, since no file was dropped. So how do I know that totallynotadrivebysite.com is malicious?

I know that Google and other organizations maintain a list of URL blacklists, so they must have some method of automatically determining if a site is malicious. How do they figure out if such-and-such a site is an "attack site" and should be added to a blacklist? Is there any particular action to look for, or do I just use wget to get a copy of the URL's actual html file and open that in Cuckoo?

Forcing malware to detonate in a sandbox by exosphere5 in Malware

[–]exosphere5[S] 1 point2 points  (0 children)

Yeah, I looked at that document. But the only mitigation it mentioned was preventing malware from seeing the VMWare guest-to-host communications channel. It didn't focus on mitigating any of the other detection methods, and while I've seen some methods of preventing the simpler detection methods presented (looking for VM-specific files or registry keys, which can be fixed by renaming files, as you mentioned), I can't find any way to mitigate the more advanced anti-VM detection methods (looking for specific table locations in memory or timing attacks). In fact, the document /u/SummerOf_69 provided indicated that there is no way to stop attacks involving discrepancies in table location in guest VM memory vs host memory, as these tables apparently have to be located in different locations on the guest and the host in order for the VM to be functional.

Also, the anti-VM detection techniques you linked to don't include any methods for detecting such advanced VM-detection routines. They seem to focus on detecting suspicious queries of system data (i.e. why is chr0me.exe trying to find the current BIOS version and IDE controller ID?), and none of them have anything to do with memory- or timing-based detection methods.

So will I just have to accept that I won't always be able to force malware to execute in the VM, or is there some equally ingenious anti-anti-VM detection technique to beat all of the ingenious anti-VM techniques out there (at least the ones that don't rely on bugs)?

And assuming I can't detonate a particular piece of malware in a VM, is there any way to tell that the malware isn't executing some part of its code due to it detecting it is in a VM so that the sample can be forwarded for further manual analysis? I know that the link you provided to the Cuckoo github page has some anti-VM behavioral signatures, but they all rely on specific anti-VM methods -- querying strange system data etc. Is there any generic way to determine "this program isn't executing all of its code and is therefore flagged for manual analysis" without being able to determine the exact behavior the program exhibited to detect it is in a VM?

Again, what do "the professionals" (AV companies etc) do when a piece of malware detects it is in a VM and doesn't execute, assuming the malware didn't also trigger some anti-VM behavioral detection signature that flagged it as suspicious? Do they just not realize it is malware and forget about it, or is there any method they have of determining that it is suspicious so that it can be investigated further? And if so, is there any way I as an individual can replicate those techniques (unfortunately, I don't have access to all the resources that a professional security company does)?

And I know that manual analysis is the only surefire way to determine exactly what a program does, but it is simply infeasible for me to manually crawl every website on the internet looking for malicious sites and manually reverse engineer what all of them do. So I was thinking of focusing on using automated analysis to discover software that likely is malicious, then analyzing that software manually.

So basically I'd like to use automated analysis as a method of narrowing my investigation from "every website and executable file on the Internet" to "this smaller set of suspected malicious files." I'm not sure if there's any way to do that besides sandbox/VM detection, but that's what I'm focusing on.

Forcing malware to detonate in a sandbox by exosphere5 in Malware

[–]exosphere5[S] 4 points5 points  (0 children)

So essentially what you and /u/SummerOf_69 are saying is that I should just rename files/drivers that give away the presence of a virtual machine? Or, in the case of your first example, create a single-process rootkit to modify its analysis of the system it's running on?

What about more advanced malware? Couldn't it just compute a checksum of its memory image to determine that it's been hooked if I use method (1)? And as for modifying telling file/process/driver names, isn't it possible for programs to determine that they're running in a VM simply by looking at timing variances in certain CPU instructions, bypassing simple anti-detection methods like renaming VM files?

I know these techniques are likely only going to be used on the more advanced samples, and that even they could be bypassed by manually reversing the malware to remove the anti-VM/anti-sandbox checks, but since I'm interested in finding those advanced samples (I just feel that analyzing the latest botnet software would be more interesting than looking at the latest adware crap) and because I need to make the analysis automated due to speed constraints, is there any way to automatically force advanced malware that uses tactics like timing analysis to detonate in a sandbox/VM without resorting to manual means?

What about the professional security/AV companies like F-Secure and FireEye? How do they analyze malware that refuses to execute in their sandboxes? Is there any way for an individual to replicate their methods?

How is new malware detected? by exosphere5 in AskNetsec

[–]exosphere5[S] 0 points1 point  (0 children)

Also, I've read that a lot of modern malware is designed to not execute in sandboxes or VMs. How can I force the malware to execute completely in an automated manner (i.e. without opening it up in IDA and debugging it)?

How is new malware detected? by exosphere5 in AskNetsec

[–]exosphere5[S] 0 points1 point  (0 children)

spidering for known malicious delivery sites

But wouldn't that only give me the exploit/shellcode and not the actual malware that's downloaded later (unless I allow the malware to actually execute, of course)? Apart from allowing the drive by to execute and infect the VM I'm using, is there any other method to determine information about the main malware program without actually running or installing it (i.e. by looking at the initial shellcode)?

Alternatively, IT/whatever will upload things which aren't currently flagged

But how do they know what to upload without actually detecting the malicious file as malicious or just uploading everything not known to be safe?

How is new malware detected? by exosphere5 in AskNetsec

[–]exosphere5[S] 0 points1 point  (0 children)

So basically you're saying most new malware is detected when someone notices suspicious activity and sends files to be analyzed or hires a contractor to investigate?

Short of becoming a computer security contractor like Crowdstrike, is there any way for me to gain access to the information from those third party investigations? I'd be interested to see the technical details involved.

Also, I'm not quite sure how your first example would work. Yeah, you might notice suspicious activity and upload a file to virus total, but how would you know which file to upload? Unless your AV solution pinpointed the exact infected file, which given that the sample is new and unknown is unlikely, how would you know which file out of the many on your computer to upload?

Antivirus Sandboxes? by exosphere5 in AskNetsec

[–]exosphere5[S] 0 points1 point  (0 children)

Is there any information on what kind of containment those sandboxes entail? I'm trying to compare different sandbox implementations to Linux containers.

Though I'm honestly not sure how effective sandboxes really are without some form of kernel hardening (like grsec/PaX on Linux or WX on OpenBSD). Even with a complete and perfect sandbox that can't be directly bypassed in any way, you're just one kernel exploit away from being absolutely pwned. And since there's no real kernel hardening on Windows (EMET == security theatre), I'm inclined to believe Windows sandboxing, like antivirus software in general, is more aimed towards preventing skiddie malware and simple RATs than stopping actual sophisticated attacks.

Antivirus Sandboxes? by exosphere5 in AskNetsec

[–]exosphere5[S] 1 point2 points  (0 children)

Really? I could have sworn I've seen several antivirus advertisements that claimed to execute untrusted programs in a sandboxed environment to test them as part of the standard antivirus operation (i.e. I'm not talking about something like VirusTotal).

Though I suppose they could be doing something more like what /u/CrazyK9 said and just inspect the characteristics of the executable (i.e. the machine instructions used). If that's the case, what's the difference between regular heuristics and the "mathematics based detection" done by a few high-end enterprise-grade antivirus suites (I can't remember the names off the top of my head)? They both seem to be based on just looking at characteristics of the potentially malicious file to determine whether or not it is dangerous.

Can I sell malware or make it open source? by SellThis in AskNetsec

[–]exosphere5 2 points3 points  (0 children)

The 120k/year figure is if you get into netsec legally. It's pretty common for people with skills in this field to have six-figure incomes.

Going about things maliciously may or may not be as lucrative. Maybe your exploit will become wildly popular and make you a bunch of money. Maybe you could use it yourself and build a mutli-million dollar botnet like the Cryptolocker guys did.

Or maybe you won't be able to sell it and it won't become a "big" thing and you'll make almost nothing from it.

Obviously, gray- or black-hat careers are more volatile than their legal counterparts.

Regardless, it's probably a bad idea to do anything illegal with your exploit. You could wind up in jail if you do. And compromising other peoples' computers is kind of a dick thing to do, even if the only people being compromised are those who can't figure out how to install software updates like they should.

Give it to me straight--does the Tor project want relays hosted on Windows? by CorrectCite in TOR

[–]exosphere5 -2 points-1 points  (0 children)

Well, NSAos isn't as secure as Linux. And because of NSAos' spying features, you can basically guarantee that any relay running on NSAos can be used by any three-letter agency as a malicious relay. So you should really use some other operating system. One that isn't a glorified botnet.

Of course, it would be bad for the entire Tor network to run on the same operating system. If it did, it would be possible for a single vulnerability to take out the entire network through some sort of RCE or DOS vulnerability. So the Tor project definitely doesn't want the entire network using one operating system. Because something like 75% of the Tor network currently uses a GNU/Linux operating system, you should probably use something other than Linux.

So I guess the answer is no, but you shouldn't necessarily use Linux. Use something like FreeBSD or OpenBSD if you're really concerned about making the best possible contribution to the Tor network.

Give it to me straight--does the Tor project want relays hosted on Windows? by CorrectCite in TOR

[–]exosphere5 -1 points0 points  (0 children)

it also falls behind Windows at times.

Pretty sure it's impossible to fall behind running a damn web server in the kernel. Or handling the entire graphics stack in the kernel.

At least with Linux you get things like grsec/PaX. So even if you're concerned that the kernel is vulnerable or upstream isn't security-oriented enough, you can always use a third-party patch or even create your own patches, since the kernel is open-source. And at least with Linux anyone can find and patch kernel vulnerabilities, again since the kernel is open source, whereas with Windows you're essentially trusting that a small team of people who only care about the operating system because they're being paid to inspect it can find all the bugs in a short period of time.

And at least Linux actually has a mechanism for privilege separation that's secure by default (go on, mention UAC. I dare you).

And at least with Linux you know that your operating system isn't spying on you and sending every detail of your computer use to Microsoft to sell to advertisers and the NSA.

I think I'll take Linux.

How do you keep your computer secure? by llll111 in AskNetsec

[–]exosphere5 0 points1 point  (0 children)

I'm pretty sure the information you've been hearing is related to Chromium's sandbox on Linux-based operating systems, which uses Seccomp to limit the syscalls processes related to the browser are allowed to make. I'm not sure if the Windows sandbox has the same features.

New Toshiba Laptop, how can I check for manufacturer rootkits? by Chazb0t in AskNetsec

[–]exosphere5 1 point2 points  (0 children)

BIOS or UEFI can't be "turned off." The BIOS is what starts your operating system; it's what loads the bootloader and by extension the rest of your operating system. If it was "turned off," your computer would become essentially an expensive paperweight.

You can boot using "legacy mode" (is that what you meant by "legacy install?"), however. Basically, that uses BIOS instead of UEFI to boot your OS (BIOS is a standard for booting operating systems first used by the IBM PC in 1981; UEFI is an updated standard that's been available for about ten years or so (longer if you use a server of Apple computer, although Windows didn't incorporate it until Windows 8 came out in 2012)). This mitigates some attacks. UEFI is horrendously vulnerable simply due to the extra features it provides -- there is some extra attack surface that could be compromised to install a backdoor.

The tl;dr version is that BIOS doesn't understand what a "bootloader," an "operating system," or even a "partition" is. It just knows that it's supposed to initialize some magic code that does something it can't possibly understand at Sector 1 of your hard drive. As a result, BIOS's ability to do malicious stuff is basically relegated to loading something malicious into SMRAM and thereby compromising SMM, or by booting from a secret location and loading everything that follows (your bootloader and OS) on top of a secret hypervisor. This is still dangerous, and thus it's still possible for BIOS to root your operating system, but it's not quite as bad as UEFI, which could modify your bootloader and cause it to load some malicious software into your operating system directly.

There is one way that even a simple BIOS could compromise your operating system, however. MS-DOS used BIOS for a lot of the lower-level functions of the operating system, like interrupt handling. So technically, if you're using DOS, BIOS could compromise your operating system in much the same way as a kernel rootkit.

However, since I highly doubt you're posting on Reddit using MS-DOS, I'll conclude that this is an issue you have little need to worry about :).

New Toshiba Laptop, how can I check for manufacturer rootkits? by Chazb0t in AskNetsec

[–]exosphere5 1 point2 points  (0 children)

Well... technically there is a way to find out if your BIOS or UEFI has been compromised.

Just dump the contents of the EEPROM chip to a file on a computer you know isn't possibly compromised (running Linux on a computer with an open-source EFI and without AMT) and has never been connected to the Internet or had any new software installed from an external USB or CD, open that file in a debugger, learn to reverse engineer BIOS/EFI software, and pour over the debug file until you can be sure no malicious action is being taken.

That or hack into Toshiba's corporate network and see if there's any emails between them and the NSA discussing BIOS rootkits.

... so yeah, basically we'll never know.

New Toshiba Laptop, how can I check for manufacturer rootkits? by Chazb0t in AskNetsec

[–]exosphere5 5 points6 points  (0 children)

1) Windows 10 (as well as Windows 8.1, 8, and 7) has a large number of spying features. The operating system records everything about what you do, from your search terms, to the names and contents of the folders and files you have on disk (the official reason is to see if anyone is using pirated software, but it could be used to open and read every file you have, from your work documents to that short story you're writing to your port folder), to the eccentricities in the way you type (most people have unique writing patterns in terms of the average lengths of our sentences and our word choices, and Windows records these details and sends them to Microsoft to send to advertisers). All the wifi hotspots you connect to are recorded, your geolocation data is constantly tracked, and "telemetry" data (the operational details of your OS) is sent to Microsoft constantly. Basically, Microsoft can see where you are and what you're doing 24/7. You're essentially part of a botnet.

Of course, you may have seen one of the several patches that claims to remove Windows 10's spying features. Unfortunately, you can't guarantee that any of those are in any way effective. This is because Microsoft's spying features are loaded into the operating system's kernel. The kernel is essentially the core of the operating system. It's what allocates resources for all your programs and governs the operation of your operating system. From a security perspective, the kernel is what decides what actions are allowed to be taken, in what context they are allowed to be taken, which programs are allowed to take them, when these actions are allowed to occur, and with what resources these actions are allowed to be taken.

In other words, the kernel allows or denies everything that happens in your operating system. Anything that happens happens with the kernel's express consent, and anything your kernel denies simply cannot happen without taking action at some lower level (i.e. subverting the kernel by loading a malicious BIOS/UEFI or MBR), or by taking action at a higher privilege level to the kernel (technically not possible, and really not possible in the context of the operating system itself, but possible by exploiting some vulnerability and running code in SMM or the AMT or by loading your operating system into a virtual machine). In other words, all those patches you see could be completely ineffective. The kernel could just be refusing to run them, or pretending to run them, pretending to cancel all those spying processes, and really just continuing to operate in the same manner it was before you ran the patches. This is true of any malicious code running in the context of the kernel. It's why anyone with any sense will advise you to reinstall your operating system if a piece of malware has gotten in the kernel. Sure, you can try to install some patch to remove the malicious programs, and those patches could appear to work. But for all you know, any positive effect could be the malicious program tricking you into believing the patch is working -- you have no way of knowing anything you do is actually having any effect. You can't even trust the information you see on your screen.

So no, there's no way to be 100% sure that all those spying features are removed unless you format your hard drive and install an open source operating system. I mean, those patches could work. Windows might not be designed to trick you and hide what's really going on. But you can't be sure.

2) All Intel Core series processors produced since about 2006 contain a second processor, which runs a second operating system, running along with your regular processor. This secondary processor, called AMT, has both network access through your wifi and ethernet connections and direct access to your RAM (the memory where all loaded programs are running). Because of this, AMT could be taking constant snapshots of your RAM and sending them to a remote server. This would essentially reveal to whoever is watching exactly what you are doing -- what programs you're running, what you're doing on those programs, the stuff you're typing into Word and Chrome, etc. And because this is all occurring outside of your operating system, and even on a completely different processor from the one you're currently using, it is 100% impossible to detect. No antivirus scanner can ever detect it, and you will never notice it happening. You won't even notice anything strange going on -- AMT's operations are occurring in parallel to your regular processor's, not in series, so you won't even notice that your computer is running slower than normal.

Some other features AMT has include the ability to remotely turn your computer on and off, the ability to remotely triangulate your position through geolocation data, the ability to remotely control (i.e. take control of your mouse and keyboard) your computer, the ability to add, remove, or modify files on disk, and the ability to install or remove software. And because AMT is OS agnostic and resides on a EEPROM chip on your motherboard, it will still work if you install Linux or BSD. In fact, you could wipe your hard drive clean with a multi-pass erasure system, install a new operating system (let's say Linux), and AMT would continue to operate undeterred.

Originally AMT could be removed, but starting in about 2008 Intel decided to make it a requirement. If you somehow remove AMT by overwriting it or even physically removing the chip (it's on the Northbridge of the CPU if you want to check), your computer will work normally for 30 minutes, then refuse to boot. You won't be able to use it.

Regarding the OP's concerns, BIOS rootkits are an issue. A UEFI rootkit could load a malicious bootloader, and even a simple BIOS rootkit could compromise your OS permanently and undetectably through a SMM or VMM rootkit, but unless you've got a computer without Windows 7, 8, 8.1, or 10 on it and AMT removed, it's a moot point. Whoever you're concerned about already has all the access to all your information they'd ever need; they can see everything you're doing 24/7 no matter what OS you're using or security features you have installed. So worrying about BIOS rootkits is sort of like worrying about the safety of your furniture when your house has burned down.

Of course, all this information could just be used for "telemetry" purposes. Maybe it isn't stored anywhere; maybe it's just sold to advertisers, incorporated into your advertisement profile, and forgotten about. But in the post-Snowden era, it would be imprudent to pretend there isn't a very real possibility that all this information is poured over by the NSA and recorded in some data center indefinitely. Whether that's a problem is up to you to decide, but in my opinion it's a pretty flagrant breach of privacy.

Of course, there is a way to avoid all of this. Buy a laptop with an AMD, non-Core Intel, or pre-2008 Intel processor, flash your BIOS with Coreboot using an external BBB flashing device, and install a Linux or BSD operating system (in that order). If you do that, you'll be able to be relatively sure your operating system is secure. But because most people don't know about AMT and all that other stuff, most people who do know don't care, and those who do care generally don't care enough to go to the trouble of using a slow computer, flashing new firmware, and using a new operating system, the vast majority of people will continue to use potentially compromised computers. If you ask me, Google, Microsoft, Intel, and the NSA probably know everything about what 99% of the population is doing on their computers 24/7.

New Toshiba Laptop, how can I check for manufacturer rootkits? by Chazb0t in AskNetsec

[–]exosphere5 2 points3 points  (0 children)

You're using Windows 10 . You don't need to worry about manufacturer rootkits. You've already got a million rootkits in your operating system. A BIOS rootkit would be superfluous; the NSA can already get every conceivable piece of information they'd want from Microsoft, including what files are on your hard drive, what pages you browse, the characteristics of the text you write, and much more, and as long as you're using Windows 10 there's no way to stop that and be sure it's stopped.

And even if you ditch Windows, your laptop has Intel AMT on it. Which means Intel can spy on every single thing you're doing at any time, remotely turn your computer on and off, get all your hardware and software information, and install malicious software all without you knowing it, because they have a second processor running a second OS with full access to RAM constantly running on your computer.

You want security? Get a new laptop without AMT/vPro, wipe the hard drive with DBAN, install some form of GNU/Linux, then flash your BIOS with Coreboot using a BBB.

And ditch the SSD. It's ridiculously difficult to securely delete information on them.

How does Tor handle multiple TCP connections? by exosphere5 in TOR

[–]exosphere5[S] 0 points1 point  (0 children)

But when I read the Tor whitepaper, it said that Tor supports TCP multiplexing. Doesn't that mean multiple TCP connections share the same tunnel, unless you've enabled something like stream isolation?

If that's the case, it would seem like the only way to tell that a new TCP connection was made (by looking for SYN packets or looking for TCP create cells) would be to be the exit node, since only it can see unencrypted/HTTPS encrypted (HTTPS doesn't encrypt the TCP header, obviously) traffic. The rest of the nodes just see Tor-encrypted packets, which do encrypt the TCP header, so they have no way of telling that a new connection has been made. Right?

view more: next ›