About Tor client
0.2.0.7-alpha,when we decided to allow these config options to both be set. Issueraised by bug 3898.· Demote the 'replay detected' log message emitted when a hiddenservice receives the same Diffie-Hellman public key in two differentINTRODUCE2 cells to info level. A normal Tor client can cause thatlog message during its normal operation. Bugfix on 0.2.1.6-alpha;fixes part of bug 2442.· Demote the 'INTRODUCE2 cell is too {old,new}' log message to infolevel. There is nothing that a hidden service's operator can doto fix its clients' clocks. Bugfix on 0.2.1.6-alpha; fixes partof bug 2442.· Clarify a log message specifying the characters permitted inHiddenServiceAuthorizeClient client names. Previously, the logmessage said that "[A-Za-z0-9+-_]" were permitted; that could havegiven the impression that every ASCII character between "+" and "_"was permitted. Now we say "[A-Za-z0-9+_-]". Bugfix on 0.2.1.5-alpha.Build fixes:· Provide a substitute implementation of lround() for MSVC, whichapparently lacks it. Patch from Gisle Vanem.· Clean up some code issues that prevented Tor from building on olderBSDs. Fixes bug 3894; reported by "grarpamp".· Search for a platform-specific version of "ar" when cross-compiling.Should fix builds on iOS. Resolves bug 3909, found by Marco Bonetti.PROSEasy to switch to anonymous modeInstallation takes you clearly step by stepCONSCan't guarantee anonymitySometimes can take a while to connect to Tor networkAlso available in other platformsTor for WindowsTor for AndroidProgram available in other languagesดาวน์โหลด Tor [TH]Ladda ner Tor [SV]Tor 다운로드 [KO]Tải xuống Tor [VI]Download do Tor [PT]Pobierz Tor [PL]下载Tor [ZH]تنزيل Tor [AR]Tor herunterladen [DE]Скачать Tor [RU]Descargar Tor [ES]Tor indir [TR]Scarica Tor [IT]ダウンロードTor [JA]Unduh Tor [ID]
Key features of the Tor client that are enabled through these drivers include:
- How To Install And Use Tor (Client) As A Proxy In - Linux
- OnionFruit Connect [DotNET Tor client] - Portable Freeware
- Advanced TOR Download - Advanced Onion Router is a client for
- Advanced Onion Router: A portable client for OR network (TOR
- A Tor client (onion proxy) implementation in Python - GitHub
- A tiny Tor client implementation (written in C). - GitHub
- LASTor: A Low-Latency AS-Aware Tor Client - University of
Initialization of the TOR connection takes place after checking for an active browser process and injection of TOR client code into the browser process by NtSetContextThread(). Win32/Atrax.A supports code injection techniques for x86 and x64 processes. All communications between the C&C and the bot are made via a special HTTP request function call. The prototype of this function looks like this:If the second parameter request_via_tor setup is in the TRUE state all communications will be initialized by the TOR client. TOR communications have the following call graph:After execution a new thread with the Tor client software will be set up using the following parameters:AUTHENTICATE – password for authentication SIGNAL NEWNYM – change proxy-nodes chainWhen the first connection is made with the C&C, Atrax.A sends collected information about the infected system to an address inside the TOR network: It isn’t possible to ascertain the original C&C IP address or domain with a TOR enabled connection but it is possible to use the address generated in the TOR network for analysis. After we played a little bit with the internal address in the TOR network we found the following login panel for C&C: We recognize the name Atrax on the login screen. It’s the main reason why we chose the name Win32/Atrax.A for detection by ESET products.Win32/Atrax.A supports the execution of remote commands for setting up bot behavior on the infected machine. The main routine for recognizing and executing remote commands looks like this:The list of supported remote command types: dlexec - download and execute filedlrunmem - download file and inject it to browserdltorexec - download TOR executable file and executedltorrunmem - download TOR executable file inject it to browser update - update itself install - download file, encrypt with AES and save to %APPDATA%installexec - download file, encrypt with AES and save to %APPDATA% and execute afterwardkill - terminate all own threadsAfter reconstruction of the structure of remote commands and the execution algorithm we tried playing with the C&C protocol. We tried to send a status to C&C confirming a successful plugin installation process and fortune smiled upon us: we got a path to the next plugin download: Two different type of plugins were downloaded: the first is a form grabber and the second is a password stealer. All downloaded modules were compiled in July according to the compilation time stamp:[Form Grabber][Password stealer]Win32/Atrax.A is interesting example of a TOR-based botnet with AES encryption for additional plugins and a unique encryption key dependent on hardware parameters of the infected machine for its generation. We continue to track activity for this botnet.Win32/Agent.PTAAnother family tracked in July and using a TOR-based communication protocol is Win32/Agent.PTA. This is not a new malware family and has already been tracked by ESET since 2012. But the TOR-based protocol is new functionality detected during this summer. This trojan also uses TOR hidden service protocol for communicating with command control panel. Agent.PTA has embedded configuration information encrypted by RC4 cypher with C&C addresses inside the TOR network. Decrypted configuration
