Tor Network.

What is the Tor network?

The Tor network is a group of volunteer-operated servers that lets people improve their privacy and security on the Internet. The Tor Project, which runs the software, describes it this way. Users connect through virtual tunnels instead of making a direct connection.

How does the Tor network work?

Tor uses onion routing. The Tor Project says the user’s software, called the client, builds a circuit of encrypted connections through relays on the network. A relay is one of the volunteer servers that passes traffic along.

Each relay knows only the previous and the next hop. No single relay knows the full path. The Tor Project also says the user gets a separate set of encryption keys for each hop, so no single relay can trace the complete path.

What are onion services?

The Tor Project says onion services, formerly called hidden services, are services such as websites that are only reachable through the Tor network. Their addresses end in .onion.

According to the Tor Project, the location and IP address of an onion service are hidden. This makes it difficult for adversaries to censor the service or identify its operators. It also says all traffic between Tor users and onion services is end-to-end encrypted. The address is generated automatically, so operators do not need to buy a domain name.

Who uses Tor?

The Tor Project lists journalists, non-governmental organizations, activists, corporations, law enforcement and individuals, including people protecting themselves from surveillance and censorship. It also says a larger and more varied user base gives each user better anonymity.

Why does Tor matter for security teams?

MITRE ATT&CK describes a technique called Multi-hop Proxy. MITRE says adversaries may build or use onion routing networks, such as the publicly available Tor network, to carry encrypted command-and-control traffic. Command-and-control is the channel an attacker uses to talk to systems they have compromised. MITRE adds that traffic crossing Tor is forwarded to multiple nodes before it leaves the network.

As a simple illustration, a defender who sees an internal system talking to the Tor network may want to ask why. This is generic reasoning, not a rule, because Tor has many ordinary users as well.

What does Tor not protect against?

The Tor Project says Tor cannot solve all anonymity problems. It focuses only on protecting the transport of data. Users must separately protect identifying information. The Tor Project also says Tor does not protect against end-to-end timing attacks.

Is the Tor network the same as the dark web?

No. Tor is a piece of technology. The dark web is a related term that describes a part of the Internet. Onion services are one kind of service that people reach through Tor. See the related terms on the dark web and the deep web for more.

Is Tor only used by attackers?

No. The Tor Project lists many kinds of everyday users, including journalists, activists and ordinary individuals. MITRE documents that adversaries can also use it, which is why security teams often pay attention to it.

Brandefense offers dark web monitoring for organizations that want visibility into this area.