Please create an account to participate in the Slashdot moderation system


Forgot your password?
Communications Encryption Networking Privacy Wireless Networking Hardware

Ryan Lackey, Marc Rogers Reveal Inexpensive Tor Router Project At Def Con 38

An anonymous reader writes Ryan Lackey of CloudFlare and Marc Rogers of Lookout revealed a new OPSEC device at Def Con called PORTAL (Personal Onion Router to Assure Liberty). It "provides always-on Tor routing, as well as 'pluggable' transport for Tor that can hide the service's traffic signature from some deep packet inspection systems." In essence, PORTAL is a travel router that the user simply plugs into their existing device for more than basic Tor protection (counterpoint to PogoPlug Safeplug and Onion Pi). On the down side, you have to download PORTAL from Github and flash it "onto a TP-Link compatible packet router." The guys behind the device acknowledge that not many people may want to (or even know how to) do that, so they're asking everyone to standby because a solution is pending. The project's GitHub page has a README file that lists compatible models, with some caveats: "It is highly recommended to use a modified router. The modified MR11U and WR703N provide a better experience than the stock routers due to the additional RAM. The severe space constraints of the stock router make them very challenging to work with. Due to the lack of usable space, it is necessary to use an external disk to store the Tor packages. The stock router has only a single USB port, and the best option is to use a microSD in a 3G modem." (Note: Lackey is no stranger to helping people secure internet privacy.)
This discussion has been archived. No new comments can be posted.

Ryan Lackey, Marc Rogers Reveal Inexpensive Tor Router Project At Def Con

Comments Filter:
  • by Anonymous Coward

    Don't trust the hardware itself.

    Routers, specifically home routers, were a huge target of NSA attacks.

    I'd highly assume the actual hardware itself is rigged,bugged, or worse.

    How much you wanna bet "magical" packets delivered to it's ethernet port from the WAN could be interpreted specially to allow the machine to reply with packets of it's internal memory (passwords, ssh keys, tor keys, etc).

    All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any

    • by causality ( 777677 ) on Thursday August 14, 2014 @10:31AM (#47670361)

      All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any OS running on top of that router.
      Buy a non-router based piece of hardware and use that. You seriously cannot trust what you'll find inside a Linksys router people. The bug is below the software level so your fancy firmware does *nothing*.

      There certainly are countermeasures you can (and should) take, but generally, applying technical solutions to political and social problems doesn't work long-term.

      • Roman roads
        Terraced farming
        The railroad
        The internet

        At the heart of most political and social problems, you'll find an issue with a technical solution that obviates the debate.

        Of course, such solutions usually open up a whole new universe of political and social problems to be explored.

        • There's no reason the populace cannot both a) harden against as many security vulnerabilities as you reasonably can, and b) take back the political power from the ruling elite and institute oversight against massive surveillance and other governmental abuses, including severe criminal penalties against officials supporting them.
          • Yeah; what I can't figure out is what happened to criminal cases being thrown against public servants proven to be intentionally serving someone other than the public. It's even beyond cronyism, and it seems to have hit all levels of government to one degree or another (excluding the alderman recently arrested for documenting police brutality).

    • Don't trust the hardware itself.

      No just stop it right now, stop with this craziness. Exploits of *hardware* over the network, or building in some monitoring directly in the hardware are extremely rare, not to mention difficult (read expensive) to do. Unless you are a high value target, you needn't worry about such theories over possible attack vectors. The hardware is going to be cheap but it's not going to be compromising your data.

      Manufacturers of Consumer level devices are concerned about one thing, making a profit. That means they

    • By extension they can do this to all your computing device(s). Better switch to microfilm dots on snail mail. Or look at RFC 2549. Encrypted of course.
  • i know *I* would never run an out-node.. i dont want the feds coming to my door due to what someone else was accessing.

  • "It is highly recommended to use a router configuration we're not going to document or even provide you a link to".

    The document implies that at least one modification is a flash and RAM upgrade - but they don't even provide links to details of this modification and/or whether any other techniques are needed (how do you populate the bootloader in the new flash? Or does the SoC itself have a built-in recovery mode?)

  • “Before the Snowden leaks, about one percent of Internet traffic was SSL protected,” he said. “Now it’s about three percent.”

    Is that a result of google, facebook and so on to use SSL in their fibers between datacenters, or can I trust I a statistic I haven't faked myself?

  • Getting lots of people running Tor even if they don't need to, even if the implementation may not be the "best" possible, for various definitions of best, is that it dilutes the number of users using Tor for "bad" things.

    I don't know what the percent of users of Tor are using it for the standard list of things the government needs to save us from, but you know that eventually the argument will get made, which owing to the nature of Tor will be almost impossible to disprove, that basically everyone using it

  • MORTAL (Modified Onion Router To Annul Liberty).

  • Speaking as an attendee, I thought the neatest feature covered in the presentation itself that I haven't seen many articles covering this touch on was a rather ambitious development goal Marc Rogers spoke to for about the last 15 minutes of their talk at Defcon. In addition to all of the security features the firmware is capable of doing, as well as having the ability to enable/disable specific features based on your needs and limitations of whatever hardware you flash it onto, the team's long-term goal is

An egghead is one who stands firmly on both feet, in mid-air, on both sides of an issue. -- Homer Ferguson