Ryan Lackey, Marc Rogers Reveal Inexpensive Tor Router Project At Def Con

An anonymous reader writes Ryan Lackey of CloudFlare and Marc Rogers of Lookout revealed a new OPSEC device at Def Con called PORTAL (Personal Onion Router to Assure Liberty). It "provides always-on Tor routing, as well as 'pluggable' transport for Tor that can hide the service's traffic signature from some deep packet inspection systems." In essence, PORTAL is a travel router that the user simply plugs into their existing device for more than basic Tor protection (counterpoint to PogoPlug Safeplug and Onion Pi). On the down side, you have to download PORTAL from Github and flash it "onto a TP-Link compatible packet router." The guys behind the device acknowledge that not many people may want to (or even know how to) do that, so they're asking everyone to standby because a solution is pending. The project's GitHub page has a README file that lists compatible models, with some caveats: "It is highly recommended to use a modified router. The modified MR11U and WR703N provide a better experience than the stock routers due to the additional RAM. The severe space constraints of the stock router make them very challenging to work with. Due to the lack of usable space, it is necessary to use an external disk to store the Tor packages. The stock router has only a single USB port, and the best option is to use a microSD in a 3G modem." (Note: Lackey is no stranger to helping people secure internet privacy.)

Re:

[Thud457]

hell, just socket your flash & ram. Be sure to slap as penguin sticker on the box.

Re:

[mrchaotica]

I bet using a socket would cost more than soldering on higher-capacity chips.

Re:

[theshowmecanuck]

You'll get into too much trouble with an America vs the rest of the world between SAE and metric sockets.

Re:

[gweihir]

WTF? Do you even know what an IC socket is?

Re:

[theshowmecanuck]

No why don't you fill me in.

Re:

[gweihir]

Too lazy to google for 60 seconds, but not for making clueless comments. You must be a slashdot poster.

Re:

[theshowmecanuck]

I've worked in engineering and computer technology for 25 years. Of course I know what an integrated circuit is. I wanted to see if you knew what a joke was. Sorry you are so literal.

Re:

[unrtst]

Why TP-Link? There are lots of models of routers that are that are readily available, have enough onboard flash and ram, and support DD-WRT (some even come with it out of the box). Why start with two models from TP-Link which do not meet the minimum requirements without physical modification?!?

Re:

[unrtst]

Thank you. That makes a lot more sense.
EG. The TP-Link routers mentioned are small travel routers (good for this purpose), low power (even usb or battery powered), and have onboard ethernet, 802.11n, usb, easily accessible serial consoles, and good openwrt support.

So yes, a travel router with a bit more ram and/or flash + openwrt support would be nice.

That said, if they're trying to market to the public, then it might be easier to go with a larger model that has the necessary ram/flash than one that is a de

Can't trust the hardware.

[Anonymous Coward]

Don't trust the hardware itself.

Routers, specifically home routers, were a huge target of NSA attacks.

I'd highly assume the actual hardware itself is rigged,bugged, or worse.

How much you wanna bet "magical" packets delivered to it's ethernet port from the WAN could be interpreted specially to allow the machine to reply with packets of it's internal memory (passwords, ssh keys, tor keys, etc).

All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any

Re:Can't trust the hardware.

[causality]

All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any OS running on top of that router.
Buy a non-router based piece of hardware and use that. You seriously cannot trust what you'll find inside a Linksys router people. The bug is below the software level so your fancy firmware does *nothing*.

There certainly are countermeasures you can (and should) take, but generally, applying technical solutions to political and social problems doesn't work long-term.

Re:

[Em Adespoton]

Roman roads
Terraced farming
Fracking
Horses
The railroad
The internet

At the heart of most political and social problems, you'll find an issue with a technical solution that obviates the debate.

Of course, such solutions usually open up a whole new universe of political and social problems to be explored.

Re:

[causality]

There's no reason the populace cannot both a) harden against as many security vulnerabilities as you reasonably can, and b) take back the political power from the ruling elite and institute oversight against massive surveillance and other governmental abuses, including severe criminal penalties against officials supporting them.

Re:

[Em Adespoton]

Yeah; what I can't figure out is what happened to criminal cases being thrown against public servants proven to be intentionally serving someone other than the public. It's even beyond cronyism, and it seems to have hit all levels of government to one degree or another (excluding the alderman recently arrested for documenting police brutality).

Re:

[bobbied]

Don't trust the hardware itself.

No just stop it right now, stop with this craziness. Exploits of *hardware* over the network, or building in some monitoring directly in the hardware are extremely rare, not to mention difficult (read expensive) to do. Unless you are a high value target, you needn't worry about such theories over possible attack vectors. The hardware is going to be cheap but it's not going to be compromising your data.

Manufacturers of Consumer level devices are concerned about one thing, making a profit. That means they

Well then don't trust your computer

[theshowmecanuck]

By extension they can do this to all your computing device(s). Better switch to microfilm dots on snail mail. Or look at RFC 2549. Encrypted of course.

bad idea

[nurb432]

i know *I* would never run an out-node.. i dont want the feds coming to my door due to what someone else was accessing.

Re:

[bobbied]

The poster was saying he would NOT run a Thor exit node, and his reasons where perfectly valid.

I too do not want to try and answer questions about why my IP address was being used to distribute say kiddie porn. Saying, well, I run a Thor exit node doesn't matter to the cops, it was your IP address so they assume it came from your household. Same with the MPAA and somebody seeding a torrent of a DVD image. The courts are NOT going to care about the exit node, you agreed to allowing the traffic by setting

Poor documentation

[Andy Dodd]

"It is highly recommended to use a router configuration we're not going to document or even provide you a link to".

The document implies that at least one modification is a flash and RAM upgrade - but they don't even provide links to details of this modification and/or whether any other techniques are needed (how do you populate the bootloader in the new flash? Or does the SoC itself have a built-in recovery mode?)

Re:

[theshowmecanuck]

This sounds like a bunch of bullshit by obfuscation. It doesn't matter the expected level of the end user. If they need documentation they need it. There is no excuse for shitty documentation even if this isn't the only project plagued with it. Telling people to comb the Internet for how to use a non-trivial piece of software is the surest way to see it implemented wrong in the largest number of ways. And this applies really, to anything requiring instructions. In this case it is very important to the user

Huge increase of SSL usage?

[NotInHere]

“Before the Snowden leaks, about one percent of Internet traffic was SSL protected,” he said. “Now it’s about three percent.”

Is that a result of google, facebook and so on to use SSL in their fibers between datacenters, or can I trust I a statistic I haven't faked myself?

There is an upside to this

[jcrb]

Getting lots of people running Tor even if they don't need to, even if the implementation may not be the "best" possible, for various definitions of best, is that it dilutes the number of users using Tor for "bad" things.

I don't know what the percent of users of Tor are using it for the standard list of things the government needs to save us from, but you know that eventually the argument will get made, which owing to the nature of Tor will be almost impossible to disprove, that basically everyone using it

I can see the NSA (sub)version now

[Mister Liberty]

MORTAL (Modified Onion Router To Annul Liberty).

Re:

[AHuxley]

Yes with most projects just follow the years of funding. Good enough tech to fund a distant color revolution https://en.wikipedia.org/wiki/... [wikipedia.org] but the entry end end points are still gov friendly.

Neatest feature: wan scanning engine

[mad_psych0]

Speaking as an attendee, I thought the neatest feature covered in the presentation itself that I haven't seen many articles covering this touch on was a rather ambitious development goal Marc Rogers spoke to for about the last 15 minutes of their talk at Defcon. In addition to all of the security features the firmware is capable of doing, as well as having the ability to enable/disable specific features based on your needs and limitations of whatever hardware you flash it onto, the team's long-term goal is