MW-Blog

I decided to do some more digging on the TOR network to see whether there really are exit-nodes doing MITM attacks. As a target site, I picked up my home computer that had an SSL enabled server.

Normally, the SSL Certificate on my server looks like this.

Real SSL Cert

I ran through all the exit-nodes in my current directory cache, connecting to my website and saving the certificate. After that I compared the certificates to see whether I picked up any that were different from the real SSL cert on my site. One certificate differed from the original:

Fake SSL Cert

So, what we have here is an TOR exit-node that is doing Man-In-The-Middle attacks on HTTPS connections. The configuration for the exit-node is as follows:

router LateNightZ 217.233.212.114 9001 0 0
platform Tor 0.1.2.16 on Windows XP Service Pack 2 [workstation] {terminal services, single user}
published 2007-11-20 02:20:19
opt fingerprint E7B6 4257 6A63 A397 5387 C2F4 BBC7 95DB D462 CAF7
uptime 40
bandwidth 32768 65536 38406
onion-key
—–BEGIN RSA PUBLIC KEY—–
MIGJAoGBAPE0d6xoupFYwZVU6pxMVLIVoFpn1sbdhRu6nXGDNqWPEqTcG6IW48lY
WpLJFK0bzkYqCv+X2aDWygXtB6A9m/5mJUr4NwDlTiPrB8auVv6MNXr80DMv4tVo
IpH8VYLZCf89kcaHWTLojX/gKOkizJBLWERPnwKacrvcu/15tiwZAgMBAAE=
—–END RSA PUBLIC KEY—–
signing-key
—–BEGIN RSA PUBLIC KEY—–
MIGJAoGBALmUDcz1zuPMmX2yfKSXWeCH+HLk8vtP11yC2vaarLTdZ8t6+/VIw18w
vYK3JAednH62Gyk9L2dPW+qc/KOe7bxqaRr4d05yE4+d7w9XDxb2KCZCZVbgtcuS
GahamdJoZUh8NLalrJJWHvSQhR8fLAQoaZeHHCdhS9IaiTw4Gt+9AgMBAAE=
—–END RSA PUBLIC KEY—–
opt write-history 2007-11-20 02:13:14 (900 s) 0,147456,122880,0,0,0,0,0,0,0,0,0,0,0,0,0,0,149504,450560,29696,62464,227328,91136,95232,1103872,1854464,656384,1941504,2434048,5716992,7706624,6257664,5371904,7851008,4059136,1441792,1683456,12103680,16930816,5545984
opt read-history 2007-11-20 02:13:14 (900 s) 0,2639872,635904,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1150976,1261568,871424,917504,1077248,954368,955392,1883136,2748416,1459200,2765824,3291136,6401024,9077760,7090176,6006784,8594432,4871168,2713600,2440192,12794880,17001472,6209536
contact <latenightz at truellz dot de>
reject 0.0.0.0/8:*
reject 169.254.0.0/16:*
reject 127.0.0.0/8:*
reject 192.168.0.0/16:*
reject 10.0.0.0/8:*
reject 172.16.0.0/12:*
reject *:25
reject *:119
reject *:135-139
reject *:445
reject *:465
reject *:563
reject *:587
reject *:1214
reject *:4661-4666
reject *:6346-6429
reject *:6699
reject *:6881-6999
accept *:*
router-signature
—–BEGIN SIGNATURE—–
cmjagfFYjtwSVMB1/Yi358Ew/9Z80fgstua1vvuVhi89ImjHInJXorDj4GKfergX
o5SnPOsplASZehjHprTt5mgeHL24TXkZcUBHjZSOIRnljDsaSfTSq7GCBZ10YX1Y
xNrKVsuHCPvOxIx0McSDmap6ngjdLtMcTAQajzA+AqI=
—–END SIGNATURE—–

The exit-node in question resides in Germany:

AS | IP | CC | AS Name
3320 | 217.233.212.114 | DE | DTAG Deutsche Telekom AG

Would be interesting to know what they are doing with stolen information, eh?

Penetration Testing
Fitsec Ltd - The Evil Eye Penetration Testing Service
http://www.fitsec.com/en

This entry was posted on Tuesday, November 20th, 2007 at 12:11 pm and is filed under General InfoSec. You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site.