In the Russian segment of the anonymous Tor network, nodes were found capable of intercepting Internet traffic and monitoring user activity on Facebook. The nodes were discovered during an experiment conducted by scientists from the Swedish University in Karlstadt (Karlstad Studentkar Karlstads Universitet).

To conduct the experiment, a special scanner was developed that was capable of identifying suspicious nodes in Tor. In a total of four months, the researchers managed to collect information on all nodes existing in the anonymous network (there are about a thousand of them). After the experiment was completed, the scanner code was made publicly available.

As a result, 25 external nodes turned out to be potentially dangerous. 18 of them had a Russian IP address. At the same time, all Russian nodes and one more located in the United States, according to researchers, belonged to the same network and were controlled by the same group of hackers. Basically, all of them were aimed at collecting information about users’ visits to specific resources, and not at mass surveillance of their actions. For example, attackers tracked visits to Facebook. At the same time, as stated in the study, no surveillance was found on the Russian search engine Mail.ru and the social network VKontakte.

As the authors of the experiment note , the efficiency of the detected nodes does not pose a serious threat to Tor users. “Most often, a person will be directed to the node whose throughput is higher. “Spoiled” nodes have low such ability. The probability of a user getting on them is extremely low,” the scientists explained.

On the other hand, the principle by which nodes operate (signature spoofing in SSL certificates) is not something unique to the Tor network. Similar methods can, for example, be used to monitor the Internet activity of devices connected to open Wi-Fi networks.

Anonymity in the Tor network is achieved due to the fact that the connection to a particular resource goes through a chain of intermediate servers. Thus, determining the IP address and location of a person using Tor becomes quite difficult. Thanks to its anonymity, Tor is popular among Internet activists, hackers, and users living in countries that monitor and filter Internet traffic. In addition, the so-called hidden zone of Tor (Tor Hidden Services) houses control centers for botnets (networks of infected computers), sites with pornographic content, and numerous resources offering illegal goods. In particular, the Silk Road online drug market, closed by the FBI in 2013, was located in such a zone.

Nodes tracking Facebook were found in the Russian segment of the Tor network