Hello and welcome to another video on this chapter.
This video, we will take a look into
tornado Network traffic and how you can examine it to get valuable information,
depravity, Network Tor short for the Onion Router, is often used by activists and
whistleblowers and people who wish to preserve the anonymity online.
The results are used by citizens of
countries which censor the Internet in order to evade the online censorship
and surveillance systems already in repressive regimes are
therefore actively trying to detect and block traffic,
which makes research frontcourt protocol detection a sensitive subject.
Tor is also often used.
Or rather is misused by hackers and
criminals in order to remotely control computers.
In this video, we will explain why it is so well suited for such malicious
purposes, but also how incident responders can detect traffic in their networks.
Most of the traffic in the Tor
networks are in fact, port scans Hacking attempt exfiltration of stolen
data and other forms of online criminality.
You might remember, if you catch it on the news, the Botnet called Skynet that used
store for its command and control communication.
Tor doesn't just provide Decryption, it is
also designed to look like normal HTTPs traffic.
This makes Tor general blends in
quite well with normal Web surfing traffic, and that makes communication
difficult to identify even for experience incident responders.
If successful method for detecting such traffic like Tor
is to instead utilize statistical analysis of the communication protocol in order to
tell different SSL implementations apart, one of the very few tools that has support
for protocol identification identification via statistical analysis is another.
They have opened a previously captured
door traffic here on my Wireshark and we are going to go through it.
As you can see.
The Port 9150, which is mostly used by the
Tor and you can see some tools are actually going back and forth.
The thing with Wireshark is that the SYN with is, as we said earlier, is
that it makes it difficult for network analysis tools like Wireshark to.
They think the traffic to some more plain and simple information
that we would like to use later on in our investigation or forensic analysis.
So if you just pick a line.
We just go ahead and pick a line from this.
Capture traffic that we had from.
Tor.
You can see the
destination port flags, but if you go ahead and right, click and follow TCP
stream is how you usually view the information that you would like
in order to see any kind of like unencrypted or Plaintext
data that you would like to use later on for investigation purposes.
So, as you see.
There is little to few in plain English language that you can
define, and usually this is information that will tell you the level that kind of
Encryption is being used and everything else.
All the other information is encrypted, as you see.
So it's basically.
No information can be gathered from these
three networks, stream transaction going back and forth, it's only the
certification authority and so on and so forth.
And that is the purpose of Tor network to avoid.
Decrypting the packets.
One tool, though, that I would like to
introduce that can be useful of decrypting such traffic to a very well structured
data and HTML from IoT and also uncover all the.
Images that may have been used or a search queries.
This is the network minor tool.
So there is this Network minor tool.
There is a free version and also a paid
version where you get all the full functionalities.
And potential of these Software but
for this video, we are going to use the free version, which you can go ahead
in their, Website, and you can follow the instructions, the installation
instructions for network minor in Windows system and in Linux systems as well.
In network minor. Let's go let's go ahead and open the same
captured file that has the Tor traffic that we been viewing and going
through earlier in Wireshark and see how will that be translated in network minor,
so a file open and you go ahead and you open the same file
and you see it will take some time to open it up a little bit.
So as long as it opens it, it will provide all the
it will break down all the information to some more familiar human readable
format, and you can so you can expand in the first in the host file.
And you can see the there is some information very well
decrypted, as you can see, comparing to the Wireshark version of it.
You can see how many packets received, the type of windows,
the type of the operating system used to access Tor network.
And you have all this sort of tabs you can go through.
If you go if we go to files, you can see pretty much all the.
Websites.
That they have that the person that was accessing Network.
And was accessing Tor network
and visited, you can see there he was, the duckduckgo.com search the.
Tor version of it, of course, and they search for something, so if you go
by each line, you will probably see some index as you see HTML here as we see.
So we can go ahead and open this file.
As you can see here, it's a search engine and the Tor
network that you can probably search all sorts of things.
We can minimize that.
Go to our network minor, you can go and see maybe we can take
this into the PHP HTML and we can go ahead and open that again, right click.
And you can see that, yeah, we have the search results of the
engine that the guy used and what kind of search query he or she has used.
So this person obviously was searching for
buying fake passports and you can see all the search results and everything.
So if you go to HTML file, it will get you to all the parts that she followed through
and what kind of he access in order to find all the information that he needed.
And also on in the images tab, if you go to the next
tab images, you can see the image results from his search.
You can see all sorts of like passports
and photo and all of that and information or fake IDs and all of that.
You can go ahead and explore all the other credentials if he used.
What kind of concessions have been going on back and forth with which Domain and.
DNS parameters and so on and so forth.
So as you can see, Network minor does a
really good job of decrypting door traffic from the Wireshark captured FILE
where you can go ahead and see available information.
Decrypted information that may be needed
and become very valuable later on in your investigation or forensic analysis.
As we said, Tor disguises itself, a.
Secure encrypted traffic and most companies, organizations allow traffic on
such tunnels through the firewalls without any kind of content inspection.
The privacy provided by Tor additionally makes it easy for a Botnet Hacker to
control infected machines without risking their identity to be revealed.
So these two factors, the traffic allowed by the companies in such
an encrypted and secure channels, together with the.
Or functionality, these two factors make Tor perfect fit for Hackers and
online criminals, we need to control infected machines remotely.
Incident responders will
therefore need to learn how to detect or traffic in their networks,
not just in order to deal with inside this wrong users and so on, but also in order
to counter Malware is using it as part of their command and control infrastructure.
As we discussed earlier, telling.
Tor apart from any other normal traffic is difficult.
But making use of statistical protocol
detection, such as the Port Independent Protocol Authentication
PIPI feature provided with uploader, as also mentioned before, is in fact a very
effective way to detect traffic in your networks.
So that was all for this video.
When you're ready, you can go ahead and click on the next video.
Well, you're going to learn how to detect Brute-force Attack.