1. Introduction
Tor Server Detection indicates a Tor proxy service is running on a remote host. Tor protects user anonymity and supports hidden services, but its presence may violate corporate security policies. This affects systems running the Tor software, typically servers used for privacy-focused networking or access to the dark web. A successful compromise could impact confidentiality if sensitive data traverses the Tor network without authorisation.
2. Technical Explanation
The vulnerability is the presence of a listening Tor service. An attacker may use this as an indicator of potential unauthorised activity, or attempt to exploit misconfigurations in the Tor setup. There are no specific CVEs associated with simply running Tor; however, vulnerabilities exist within the Tor software itself that could be exploited if the server is exposed and not kept up-to-date. For example, an attacker might try to identify users accessing hidden services hosted on the detected Tor server.
- Root cause: The Tor service is running without explicit policy controls or monitoring.
- Exploit mechanism: An attacker could attempt to fingerprint the Tor version and exploit known vulnerabilities in older versions, or monitor traffic for sensitive information.
- Scope: Any platform supporting the Tor software (Linux, Windows, macOS).
3. Detection and Assessment
Confirming a running Tor service can be done with network checks and process listings. A thorough assessment involves checking the Tor configuration file for potentially insecure settings.
- Quick checks: Use `netstat -tulnp | grep 9050` on Linux to check if port 9050 (the default Tor SOCKS port) is listening.
- Scanning: Nessus plugin ID 13846 can detect running Tor servers, but results should be verified manually.
- Logs and evidence: Check system logs for Tor startup events or errors. The location varies by platform; on Linux, look in `/var/log/syslog` or `/var/log/daemon.log`.
netstat -tulnp | grep 90504. Solution / Remediation Steps
Remediating this issue involves verifying policy compliance and potentially limiting network access to the Tor server. Only apply these steps if running a Tor service is not authorised by your organisation.
4.1 Preparation
- Ensure you have appropriate permissions to modify network settings and services. A roll back plan involves restoring the backed-up configuration file and restarting the Tor service.
- Change windows may be needed for network firewall changes, requiring approval from the networking team.
4.2 Implementation
- Step 1: Verify that running a Tor server is permitted by your corporate security policy. If not, proceed to step 2.
- Step 2: Stop the Tor service using `sudo systemctl stop tor` on Linux or equivalent command for other platforms.
- Step 3: Disable the Tor service from starting automatically using `sudo systemctl disable tor` on Linux.
- Step 4: Remove the Tor package if it is not required: `sudo apt remove tor` (Debian/Ubuntu) or `sudo yum remove tor` (CentOS/RHEL).
4.3 Config or Code Example
Before
# /etc/systemd/system/tor.service
[Service]
ExecStart=/usr/bin/torAfter
# /etc/systemd/system/tor.service (disabled)
[Unit]
Description=Tor Anonymity Network
ConditionPathExists=!/etc/tor/torrc 4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this issue and similar unauthorised software installations.
- Practice 1: Least privilege – restrict user access to only the necessary services and applications, reducing the potential for installing unapproved software.
- Practice 2: Application whitelisting – allow only approved applications to run on systems, preventing Tor or other unwanted software from executing.
4.5 Automation (Optional)
#!/bin/bash
# This script stops and disables the Tor service on Linux systems.
sudo systemctl stop tor
sudo systemctl disable tor
echo "Tor service stopped and disabled."5. Verification / Validation
Confirming the fix involves checking that the Tor service is no longer running and port 9050 is closed. A smoke test should verify other network services remain operational.
- Post-fix check: Run `netstat -tulnp | grep 9050`. Expected output should be empty, indicating port 9050 is no longer listening.
- Re-test: Re-run the initial detection method (`netstat -tulnp | grep 9050`) to confirm Tor is not running.
- Smoke test: Verify other essential network services (e.g., SSH, HTTP) are still accessible and functioning correctly.
netstat -tulnp | grep 90506. Preventive Measures and Monitoring
Preventive measures include updating security baselines and implementing application control solutions.
- Baselines: Update your system security baseline to explicitly prohibit the installation of Tor or other unauthorised proxy services.
- Pipelines: Implement application whitelisting in CI/CD pipelines to prevent unapproved software from being deployed.
- Asset and patch process: Regularly review installed software on systems to identify and remove any unexpected applications.
7. Risks, Side Effects, and Roll Back
Stopping the Tor service may disrupt access for users who legitimately rely on it (if authorised). Rolling back involves re-enabling the service.
- Roll back: Step 1: Re-enable the Tor service using `sudo systemctl enable tor`. Step 2: Start the Tor service using `sudo systemctl start tor`.
8. References and Resources
- Vendor advisory or bulletin: https://tor.eff.org//