Announcing: Slashdot Deals - Explore geek apps, games, gadgets and more. (what is this?)

Thank you!

We are sorry to see you leave - Beta is different and we value the time you took to try it out. Before you decide to go, please take a look at some value-adds for Beta and learn more about it. Thank you for reading Slashdot, and for making the site better!

Ryan Lackey, Marc Rogers Reveal Inexpensive Tor Router Project At Def Con

timothy posted about 5 months ago | from the widespread-and-easy-are-tightly-linked dept.

Communications 38

An anonymous reader writes Ryan Lackey of CloudFlare and Marc Rogers of Lookout revealed a new OPSEC device at Def Con called PORTAL (Personal Onion Router to Assure Liberty). It "provides always-on Tor routing, as well as 'pluggable' transport for Tor that can hide the service's traffic signature from some deep packet inspection systems." In essence, PORTAL is a travel router that the user simply plugs into their existing device for more than basic Tor protection (counterpoint to PogoPlug Safeplug and Onion Pi). On the down side, you have to download PORTAL from Github and flash it "onto a TP-Link compatible packet router." The guys behind the device acknowledge that not many people may want to (or even know how to) do that, so they're asking everyone to standby because a solution is pending. The project's GitHub page has a README file that lists compatible models, with some caveats: "It is highly recommended to use a modified router. The modified MR11U and WR703N provide a better experience than the stock routers due to the additional RAM. The severe space constraints of the stock router make them very challenging to work with. Due to the lack of usable space, it is necessary to use an external disk to store the Tor packages. The stock router has only a single USB port, and the best option is to use a microSD in a 3G modem." (Note: Lackey is no stranger to helping people secure internet privacy.)

Sorry! There are no comments related to the filter you selected.

Calling TP-Link (0)

Anonymous Coward | about 5 months ago | (#47670149)

Your routers are well supported by OpenWRT, and that is the reason for a good chunk of your sales, but you're not without competition. Your routers could easily become the router of choice for geeks if you offered them with more RAM and flash memory, even if the stock firmware doesn't need it. 16MB flash and 128MB RAM shouldn't be that much more expensive, but more memory would make all the difference to a lot of people who find new uses for your products.

Re:Calling TP-Link (1)

Thud457 (234763) | about 5 months ago | (#47670271)

hell, just socket your flash & ram. Be sure to slap as penguin sticker on the box.

Re:Calling TP-Link (1)

mrchaotica (681592) | about 5 months ago | (#47671055)

I bet using a socket would cost more than soldering on higher-capacity chips.

Re:Calling TP-Link (1)

theshowmecanuck (703852) | about 5 months ago | (#47671255)

You'll get into too much trouble with an America vs the rest of the world between SAE and metric sockets.

Re:Calling TP-Link (1)

gweihir (88907) | about 5 months ago | (#47674629)

WTF? Do you even know what an IC socket is?

Re:Calling TP-Link (1)

theshowmecanuck (703852) | about 5 months ago | (#47674809)

No why don't you fill me in.

Re:Calling TP-Link (1)

gweihir (88907) | about 5 months ago | (#47676491)

Too lazy to google for 60 seconds, but not for making clueless comments. You must be a slashdot poster.

Re:Calling TP-Link (1)

theshowmecanuck (703852) | about 5 months ago | (#47676759)

I've worked in engineering and computer technology for 25 years. Of course I know what an integrated circuit is. I wanted to see if you knew what a joke was. Sorry you are so literal.

Re:Calling TP-Link (1)

unrtst (777550) | about 5 months ago | (#47670601)

Why TP-Link? There are lots of models of routers that are that are readily available, have enough onboard flash and ram, and support DD-WRT (some even come with it out of the box). Why start with two models from TP-Link which do not meet the minimum requirements without physical modification?!?

Re:Calling TP-Link (0)

Anonymous Coward | about 5 months ago | (#47670761)

You want OpenWRT support, not DD-WRT. OpenWRT is designed to be extended, whereas DD-WRT is more like a stock firmware. DD-WRT has more features than the stock firmware, but it's not an "install what you need" kind of firmware.

Routers which come with enough flash and RAM for this application are usually bulky home routers with built-in four-port switches, external power supplies, etc. The TP-Link routers mentioned in the Readme file are compact travel routers. They're USB powered, one even has a battery.

Re:Calling TP-Link (1)

unrtst (777550) | about 5 months ago | (#47671747)

Thank you. That makes a lot more sense.
EG. The TP-Link routers mentioned are small travel routers (good for this purpose), low power (even usb or battery powered), and have onboard ethernet, 802.11n, usb, easily accessible serial consoles, and good openwrt support.

So yes, a travel router with a bit more ram and/or flash + openwrt support would be nice.

That said, if they're trying to market to the public, then it might be easier to go with a larger model that has the necessary ram/flash than one that is a desirable size but requires... uh... something the summary says is difficult.

Can't trust the hardware. (1)

Anonymous Coward | about 5 months ago | (#47670325)

Don't trust the hardware itself.

Routers, specifically home routers, were a huge target of NSA attacks.

I'd highly assume the actual hardware itself is rigged,bugged, or worse.

How much you wanna bet "magical" packets delivered to it's ethernet port from the WAN could be interpreted specially to allow the machine to reply with packets of it's internal memory (passwords, ssh keys, tor keys, etc).

All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any OS running on top of that router.

Buy a non-router based piece of hardware and use that. You seriously cannot trust what you'll find inside a Linksys router people. The bug is below the software level so your fancy firmware does *nothing*.

Re:Can't trust the hardware. (4, Insightful)

causality (777677) | about 5 months ago | (#47670361)

All you need a ethernet firmware that speaks to the CPU over DMA and reads out memory allowing the NSA to attack any OS running on top of that router.
Buy a non-router based piece of hardware and use that. You seriously cannot trust what you'll find inside a Linksys router people. The bug is below the software level so your fancy firmware does *nothing*.

There certainly are countermeasures you can (and should) take, but generally, applying technical solutions to political and social problems doesn't work long-term.

Re:Can't trust the hardware. (0)

Anonymous Coward | about 5 months ago | (#47671105)

Printing press
Proof of work

These things are all technical solutions to political and social problems, but after they were adopted we simply stopped calling them political and social problems. Rome wasn't overcrowded; they just needed a better water supply. Gutenberg wasn't censored; he just needed an easier way to make bibles. Might didn't make right; it's just that a grown man can use a longbow better than an old lady. Women weren't prevented from assembling; it was just hard to get around town. We could have switched to the gold standard at any time; proof of work just lets us use a p2p program for money.

There is no such thing as a "social problem" or a "technical problem" - just problems with different solutions.

Re:Can't trust the hardware. (0)

Anonymous Coward | about 5 months ago | (#47671823)

OH. THAT IS JUST.. LIKE, SO .. LIAR PANTS ON FIRE LIKE.. D000d .. so sooooooooooo s1llyz!


Re:Can't trust the hardware. (1)

Em Adespoton (792954) | about 5 months ago | (#47672057)

Roman roads
Terraced farming
The railroad
The internet

At the heart of most political and social problems, you'll find an issue with a technical solution that obviates the debate.

Of course, such solutions usually open up a whole new universe of political and social problems to be explored.

Re:Can't trust the hardware. (1)

causality (777677) | about 5 months ago | (#47672601)

There's no reason the populace cannot both a) harden against as many security vulnerabilities as you reasonably can, and b) take back the political power from the ruling elite and institute oversight against massive surveillance and other governmental abuses, including severe criminal penalties against officials supporting them.

Re:Can't trust the hardware. (1)

Em Adespoton (792954) | about 5 months ago | (#47673973)

Yeah; what I can't figure out is what happened to criminal cases being thrown against public servants proven to be intentionally serving someone other than the public. It's even beyond cronyism, and it seems to have hit all levels of government to one degree or another (excluding the alderman recently arrested for documenting police brutality).

Re:Can't trust the hardware. (2)

bobbied (2522392) | about 5 months ago | (#47671151)

Don't trust the hardware itself.

No just stop it right now, stop with this craziness. Exploits of *hardware* over the network, or building in some monitoring directly in the hardware are extremely rare, not to mention difficult (read expensive) to do. Unless you are a high value target, you needn't worry about such theories over possible attack vectors. The hardware is going to be cheap but it's not going to be compromising your data.

Manufacturers of Consumer level devices are concerned about one thing, making a profit. That means they want CHEAP hardware and they want to sell a lot of it. Same with the chip vendors, they want to make a profit, that means they want high yields using the cheapest process and selling as many units as they can. Nobody has time to engineer in all the stuff that would be required for your proposed attack vectors to work. It's too hard, to expensive and flies in the face of their #1 priority, profit. So please stop with this "You gota worry about the hardware ratting you out!" theory, it's not true for consumer devices. It's also not true with commercial stuff for the most part, although exploits at this level have been demonstrated for less than main stream vendors, but all of these involve software, at least the one's I've heard about.

What IS true and what DOES fit is getting crappy firmware/software from consumer product vendors. Worry about that because it's a LOT more likely to be compromised with back doors, security holes and known vulnerabilities. So buying of the shelf hardware and loading your own software on it makes perfect sense security wise. You needn't worry about the hardware.

Re: Can't trust the hardware. (0)

Anonymous Coward | about 5 months ago | (#47672767)

Intel vPro

Well then don't trust your computer (1)

theshowmecanuck (703852) | about 5 months ago | (#47671341)

By extension they can do this to all your computing device(s). Better switch to microfilm dots on snail mail. Or look at RFC 2549. Encrypted of course.

bad idea (1)

nurb432 (527695) | about 5 months ago | (#47670357)

i know *I* would never run an out-node.. i dont want the feds coming to my door due to what someone else was accessing.

Re:bad idea (0)

Anonymous Coward | about 5 months ago | (#47670447)

It's not an "out-node", or exit node as they're called. This is a router which makes all traffic that normal routers would send to the internet directly go through the TOR network instead. Someone else's exit node will release the packets onto the internet. By moving the TOR functionality into the router, you can ensure that all traffic is routed through TOR, without relying on software components on the PC. A router like that could also be used to shield yourself from trouble if you want to provide wireless internet access to others, because your public IP address will not appear in their traffic.

Re:bad idea (1)

bobbied (2522392) | about 5 months ago | (#47671547)

The poster was saying he would NOT run a Thor exit node, and his reasons where perfectly valid.

I too do not want to try and answer questions about why my IP address was being used to distribute say kiddie porn. Saying, well, I run a Thor exit node doesn't matter to the cops, it was your IP address so they assume it came from your household. Same with the MPAA and somebody seeding a torrent of a DVD image. The courts are NOT going to care about the exit node, you agreed to allowing the traffic by setting the node up, so you pay for it.

Re:bad idea (0)

Anonymous Coward | about 5 months ago | (#47671683)

None of that has anything to do with the topic. The modified router is not an exit node. You not wanting to run a TOR exit node (The Onion Router, not a Norse god) is completely irrelevant and does not make this TOR router a "bad idea" (see subject), because it's not an exit node. Now take your FUD and shove it where the sun don't shine.

Poor documentation (1)

Andy Dodd (701) | about 5 months ago | (#47670375)

"It is highly recommended to use a router configuration we're not going to document or even provide you a link to".

The document implies that at least one modification is a flash and RAM upgrade - but they don't even provide links to details of this modification and/or whether any other techniques are needed (how do you populate the bootloader in the new flash? Or does the SoC itself have a built-in recovery mode?)

Re:Poor documentation (0)

Anonymous Coward | about 5 months ago | (#47670509)

Not documenting the RAM and flash upgrade is probably intentional, to prevent people from trying this haphazardly. All information to perform this procedure is available online, but it's definitely not something that anyone should try without enough previous knowledge to find the necessary information on their own. People are afraid to brick their routers by simply flashing firmware (that doesn't even touch the boot loader). This is not just in a different league, it's a different sport. (Nothing you couldn't learn, but it's a steep curve.)

Re:Poor documentation (1)

theshowmecanuck (703852) | about 5 months ago | (#47671499)

This sounds like a bunch of bullshit by obfuscation. It doesn't matter the expected level of the end user. If they need documentation they need it. There is no excuse for shitty documentation even if this isn't the only project plagued with it. Telling people to comb the Internet for how to use a non-trivial piece of software is the surest way to see it implemented wrong in the largest number of ways. And this applies really, to anything requiring instructions. In this case it is very important to the user that it be done right.

Re:Poor documentation (0)

Anonymous Coward | about 5 months ago | (#47671617)

They're not telling you to do it and not how, just that it can be done. The upgrade isn't really necessary to make the TOR router either. They're not hiding anything from you, they're just not handing you the gun to shoot yourself in the foot with. The surest result of telling a novice how to make explosives is that they blow themselves up in the process. It takes experience to do these things right, and if you have gained that experience doing easier things, you don't need someone to tell you where to look for instructions. Besides, a TOR howto isn't really the right place for detailed instructions on soldering SMT parts: It would detract from the actual topic.

Isn't this an oxymoron? (0)

Anonymous Coward | about 5 months ago | (#47670611)

Yes, let's put our trust in Chinese made hardware instead. No chance of backdoors or anything, right? Right??

Huge increase of SSL usage? (1)

NotInHere (3654617) | about 5 months ago | (#47670689)

“Before the Snowden leaks, about one percent of Internet traffic was SSL protected,” he said. “Now it’s about three percent.”

Is that a result of google, facebook and so on to use SSL in their fibers between datacenters, or can I trust I a statistic I haven't faked myself?

Privacy is over rated. Pursuit of Liberty is key. (0)

NemoinSpace (1118137) | about 5 months ago | (#47670961)

Privacy is a derived right and invokes unwritten rules of human nature such as judging other peoples actions. My freedom really should not be limited by your pea brained assessment of my actions or motives. Privacy is insidious and a bastion of cowards that are afraid their own morals won't stand up to scrutiny. No my freinds, I have the inarguable right to do whatever the hell I want to the point of death. The real debate should be whether the government should have the right to keep and bear arms rather than I. Governments really shouldn't be alllowed near guns, they have murdered a lot more innocent people than me, or my crackhead commie neighbor combined.

There is an upside to this (1)

jcrb (187104) | about 5 months ago | (#47671407)

Getting lots of people running Tor even if they don't need to, even if the implementation may not be the "best" possible, for various definitions of best, is that it dilutes the number of users using Tor for "bad" things.

I don't know what the percent of users of Tor are using it for the standard list of things the government needs to save us from, but you know that eventually the argument will get made, which owing to the nature of Tor will be almost impossible to disprove, that basically everyone using it is doing something illegal and thus running a node makes you an accomplice, and using Tor is probable cause for the government to come and search your stuff.

If that argument has not already been made in court you know it is only a matter of time before it is.

I can see the NSA (sub)version now (1)

Mister Liberty (769145) | about 5 months ago | (#47671439)

MORTAL (Modified Onion Router To Annul Liberty).

Re:I can see the NSA (sub)version now (1)

AHuxley (892839) | about 5 months ago | (#47674443)

Yes with most projects just follow the years of funding. Good enough tech to fund a distant color revolution https://en.wikipedia.org/wiki/... [wikipedia.org] but the entry end end points are still gov friendly.

Except Ryan Lackey & Marc Rogers = NSA agents (0)

Anonymous Coward | about 5 months ago | (#47671841)

And it's a known fact in the blackhat world that tor is completely compromised by the NSA and CIA. The project receives direct funding through them.

I'm sure the "plugin" is designed to specifically help these said agencies too.

Then again Def con was long ago compromised by the CIA.. do real blackhats really still go to that shit?

Neatest feature: wan scanning engine (1)

mad_psych0 (991712) | about 5 months ago | (#47672091)

Speaking as an attendee, I thought the neatest feature covered in the presentation itself that I haven't seen many articles covering this touch on was a rather ambitious development goal Marc Rogers spoke to for about the last 15 minutes of their talk at Defcon. In addition to all of the security features the firmware is capable of doing, as well as having the ability to enable/disable specific features based on your needs and limitations of whatever hardware you flash it onto, the team's long-term goal is for the router to have an engine that is capable of examining the wan side of it's connections and, based on the potential security risks it identifies on the connection, make smart recommendations about which specific features a user should be using to ensure maximum privacy. Having a large suite of tools available is awesome and all, but when you're talking about running it on a pocket-sized piece of hardware you're going to be limited by the amount of horsepower and on-board memory of the hardware pretty severely. Thus, having an engine that can make smart recommendations for non-technical people that have a strong need for this level of anonymity like journalists or political dissidents is an absolutely huge feature and IMO trumps everything else this project can do.


Anonymous Coward | about 5 months ago | (#47673953)

Jesus guys.
Its a honeypot, .IT'S A FUCKING HONEYPOT.
for filter

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?