Placeholder Image

Subtitles section Play video

  • Let's talk a bit about anonymization, more specifically onion routing, so Max has done a very good video on the Dark web

  • And the deep web and the service web and the differences between them when people talk about the dark web

  • They're mostly talking about Tor and specifically Tor hidden services. Now I'm not talking about that certainly today

  • I might do that in a different video

  • Tor literally stands for the onion router, right, it is an implementation of onion routing right which was developed in the mid 90s by

  • US Naval research.The idea is

  • It bounces around connections between different routers so that they're hard to track and it's and it provides anonymity

  • So this is different from confidentiality which we usually associate with encryption right most of the time, we're encrypting messages

  • So that even if people see that we've sent a message

  • We, they can't read what it is like, but sometimes we don't even want people to see that we sent a message at all

  • So what I'd like to do is focus on onion routing specifically bearing in mind, that Tor is a and implementation of it

  • so in some sense

  • I'm also talking about Tor, okay

  • And maybe we'll focus a little bit more on what it is that Tor does differently a bit later.

  • So this is me and which is my very well drawn computer as always and I want to talk to a server here

  • Which doesn't have a monitor because in my view servers don't have monitors, so normally on this client server setup

  • I want to talk to a server, but in this case

  • I don't want anyone to know that I'm talking to a server at all

  • I'd like to be remain completely anonymous, right, now if I then go onto the server and log on obviously that's not anonymous anymore

  • Right so it's limits to this

  • but this is the idea, now how this works is I'm going to bounce my connection around and

  • Then it's going to go to the server and if in essence the last node on the hop, the last hop on the network is

  • Is going to be the one actually visits that website on my behalf a bit like a proxy we're going to use multiple levels of encryption

  • to try and

  • Essentially confuse people who are trying to work out what's going on right now Tor in it in

  • In its implementation uses three hops three intermediate nodes, so I'm going to limit: one

  • That's not a very good computer

  • Two. Hang on I thought servers didn't have monitors. Oh no, so well. Aw, don't. I mean

  • yeah, so that's a good question right so you can run Tor and you can be an onion router on a client machine on a

  • Laptop you know it doesn't really matter if your net connection is quite good

  • you can do it. The software is free and they

  • Very much want people to sign up and become these intermediate nodes because in some ways that's what the power tor is

  • we'll get to that a little bit but

  • in essence what happens here is I send a message to

  • To this guy he forwarded on to this one he falls it on to this one who then forwards onto the server when a server

  • Responds they simply pass the messages back now this haven't really solved any problems yet

  • Because anyone sniffing here will know well ok we just need to sniff there and then sniff there.

  • and they can kind of reassemble the communication

  • It makes it a bit of a pain, but it doesn't stop anyone from finding out: What's going on?

  • I, even if these were encrypted so what we need to do is have multiple layers of encryption

  • What's clever about onion routing, Is that no one in this network knows anything about the whole connection.

  • They just know what's before them, and what's after them. Alright?

  • so let me show you how this works so I'm going to use different colored pen alright, so let's use this red pen.

  • Let's imagine for a minute that I've established some shared symmetric keys with these three nodes here, right?

  • So just like in previous videos where we talked about encryption

  • We're talking about let's say an AES key

  • And I have one shared with this guy and one shared with him and one shared with this guy no one else knows what they are.

  • like because I used a key exchange to do this, so I had K1 K2 and K3

  • and this router knows K1 this router knows K2, and this router knows catering now that might seem implausible

  • But actually that's quite easy to set up using modern key exchange right DiffieHellman for example performance is quite well

  • If I encrypt something with K1 only this router

  • Can see it all right and if I could encrypt some of K3 only this router can see it right there is no

  • Encryption with the server at the Moment. Now onion Routing

  • Essentially sends messages, encrypted multiple times with different keys in layers, so this message here

  • is encrypted three times, right

  • So this is where we sort of fast forward as I draw a bunch of lines on

  • But we're going to say this [risk route] message here encrypted once with K3. It's encrypted another time with K2

  • And when it's encrypted a final time

  • With K1 now let's think about what that means

  • it means that only

  • This router here

  • Could unlock the first layer. That's the first thing it means it also means that when it's done that it's

  • Got a totally garbled message, but because it's still encrypted twice already right, so it's gibberish it can't possibly know what's going on

  • But what it can do is forward that message on to k2 so k2 takes a message,

  • Which is encrypted by k3 and then again encrypted by k2 and it can strip off a layer as well

  • But again, it then looks at the message

  • And it doesn't make any sense because it's still encrypted by k3 so it forwarded on to this router

  • Encrypted by K3 finally K3

  • Decrypts this message looks at it

  • And it does make sense because it's not encrypted anymore, and it and it says the message says I'd like to go to Facebook please,

  • and it goes I can do that and it connects to Facebook and receives a response now on the way back

  • the exact reverse process happens.

  • This router will add its encryption of k3 and forward the message onto router 2 - who will add K2

  • Route 1 adds k1 and only we can decrypt the whole message because we have all the keys

  • What's really interesting is the property that this gives us, the first thing is that k 2 doesn't need to know anything,

  • except the address of K1 and the address of k3 it doesn't need to know who I am right it receives a message from

  • K1 and all it knows based on the protocol is this is a message that needs to be forwarded to k3

  • After I've removed my layer of encryption

  • That's all it knows when it receives a message from k3 it adds its encryption

  • And then passed it straight out the other door to router 1 so if this was compromised by an attacker

  • They've learnt nothing right. They've learned that two of these guys and running Tor nodes or onion routing nodes

  • They haven't learned who I am they haven't learned who the server is because both times it is encrypted with layers of encryption that they can't remove.

  • This is kind of gives you an insight into what it is

  • That's clever about onion routing they think about some of the other things that it does.

  • K3 knows who the server is because it receives a message. That said I'd like to go to Facebook

  • So it knows that someone on this network in visiting Facebook, and it knows that the next

  • Hop is this chap this router here it knows nothing else. It doesn't know who this client is

  • It doesn't know who router one is so there's no way for it to say: Ahh, Mike's visiting Facebook again, right?

  • He's on there too often, because the way that the Tor protocol works. You don't actually know when you decrypt your layer

  • How many more layers there are there could be 200 nodes and layers they don't tend to be but they could be.

  • so the output node only knows what's going on on the server side and

  • Similarly the input node my external is called a guard node is only aware that this client is browsing Tor any messages

  • It receives are usually encrypted with two other layers of encryption that it can't decrypt so it just says well

  • I've got this message. I need to forward it on to this router. That's all I know right

  • I don't know, but they're on Facebook. I don't know that they are on a forum or they're doing amazon shopping

  • I don't know anything about what they're doing, so this is what Tor does Tor is in essence an implementation of this approach, right?

  • So it has a protocol with you know message lengths and structures that are well defined in its

  • Documentation that specify how you establish these keys how you send these messages

  • How each one should decrypt them and forward them on to the next one, but in essence what you do is

  • This client here will create what we call a circuit

  • Which is this three hops, by

  • first establishing a shared key of him then instructing him to do the same and then him to do the same and

  • adding extending the circuit each time they want to with new nodes on the end and

  • Every time I do that all the previous messages have been encrypted. So nobody knows what's going on, so it's quite interesting

  • Is it slower because of all these hops? It's a lot slower like you've got to consider that

  • These nodes first of all they might be they might be serving a lot of clients at once so there might be other ca-

  • uhh, keys

  • shared with other people coming in here and leaving here and this one might be an exit node sometimes and he's talking to servers and

  • browsing the web for people

  • and so yes

  • You don't want to be signing up to be an onion router if you haven't got quite a lot of bandwidth also consider that they?

  • May not be located very close together, right?

  • So this could be in Germany this one in the united states this over in Japan not really important

  • but a point is that it's making you know large global hops which take in the order of

  • Sub-second but not small amounts of time

  • so you can expect to wait a

  • Little bit longer for your messages to get through, all right, but the benefit you get is that no one knows?

  • What what it is you're doing, right?

  • We've got a situation here where no one really knows anything about what's going on at all, right? Which is very very clever

  • and

  • Has obvious benefits to people who want to remain anonymous.

  • Now there's a few things we've missed out

  • It's a lot of things I've missed out right because because the Tor protocol is quite complicated

  • But this is the general idea the first thing is that if you go, if you if you create this circuit,

  • And then you just go to Facebook and type in your username password and click it

  • You know that's going to give away what you're up to, all right, Facebook will know who you are for a start

  • But if you go to a website, that's not even encrypted at all. This is sent in the clear, right?

  • So someone's sniffing in at this point

  • Let me use my blue pen for sort of eavesdroppers like if someone's eavesdropping in at this position

  • They'll know exactly what you're doing, right?

  • And you type in username and password then they have your username and password. So you still have to use TLS or HTTPS,

  • uhh,

  • connections to the actual servers right, but that's really on you once you've set up this circuit

  • You said normal HTTP requests and responses to servers as you would normally

  • It's just instead of it going through your normal internet connection and your normal ISP router it goes through this circuit

  • and with all the encryption happening

  • so in actual fact the

  • Implementation the Tor uses. It works essentially like a proxy you talk to your own proxy server which handles all this for you and then

  • responses come back so yes your web connection is a little bit slower, but for all you know it's

  • Just a normal connection to a server. That's basically how it works is really not a lot

  • more to it than that right and it's quite elegant, and it works very very well

  • is using tools that like just installing a different kind of browser?

  • Yeah You use a Tor browser or you can use it as a service and then you know pipe other thi- other services through it

  • But Tor is not illegal and nor should it be it's just encryption. There are a few downsides right the first aside from the speed

  • The first is that

  • people can sniff on this network and start to get the pieces of the puzzle the more positions

  • You are you know the more pieces you get right?

  • But so if I'm sniffing here at position A then what you see is you see that I'm using Tor you can't see anything else

  • If I'm sniffing here or here I learn nothing right apart from this encrypted messages going on Tor these onion routers are

  • listed publicly in the directory so finding their identity is not a

  • Great concern of mine if I'm sniffing a position B at the exit node

  • I find out that someone on Tor is visiting this website if it's encrypted

  • Let's say using TLS

  • Then that's all I find out the next question that people be asking is what happens if I control both A and B

  • All right, if I'm at the front of the network going in and at the exit node

  • Can I start to find out?

  • What's going on? And the answer is yes, right?

  • That's the weakness of Tor and something that basically is unsolvable apart from just to be very very vigilant

  • So how would this work, well?

  • You've got to remember that this is the big network. There's lots of users on it

  • C is not the only person talking to this router, right?

  • He's going to be the intermediary for conversations the third node the second node the first node

  • He might be an exit node. He might also be talking to servers

  • There's a lot of traffic going in and out like some of which is Tor some of which is not

  • What we're talking about is looking at a lot of traffic coming from my machine to this router

  • And a lot of traffic going from other routers to websites and trying to correlate them and work out what it was that I did

  • Right, which is not an easy job, but you can imagine that if you've got some time signature of messages

  • But let's say a sort of message, message, message, message, message

  • Then talking to this server coming out here is going to be a kind of mess of lots of messages

  • But you might be able to find the key points that match up

  • With what I sent in like that's the idea this traffic. Analysis is the main

  • Approach to essentially De-Anonymizing people if you found that I sent 15 messages of a certain size and

  • a certain Sort of Tempo should we say and

  • Then you found out that those 50 messages came out somewhere else on the network

  • At the same just shortly after let's say a half a second after, at the exact same tempo

  • That's a little bit interesting.

  • With all these layers of encryption does that change the file size?

  • No, which is a good thing right? This is cleverly designed with that in mind

  • So Tor messages are called cells and cells are 512 bytes long. They're always

  • 512 bytes long the way that a router works out whether it's

  • Reading a message or whether it needs to forward it on it's basically based on a small

  • hash or digest that's held in the message essentially it looks at the tail end of the message,

  • calculates a hash on it and goes well

  • that doesn't match the hash I've got at all it must still be encrypted because it's nonsense

  • So then it knows to forward it on, see. And it does this by basically

  • avoiding changing the size of the message it will be obvious as you say right if if

  • three layers of Encryption added ahead of each time

  • You would know how far along the hops were and the whole attack would be a lot easier

  • Right so onion routing is based around the idea that any message between any node in the network looks like any other message

  • Right it could be the first one could the last one it could be something in the middle

  • Right it could have nefarious information on it. It could have perfectly benign information on it impossible to know all right

  • Which is really really clever.

  • There's a lot of research on Tor that goes into

  • Working out how to minimize a chance for both A and B are nefarious

  • That's the idea, so this is why they sometimes call these guard nodes because usually you select some trusted ones

  • And you only use those for example. We don't pick at random because lots of

Let's talk a bit about anonymization, more specifically onion routing, so Max has done a very good video on the Dark web

Subtitles and vocabulary

Click the word to look it up Click the word to find further inforamtion about it