Catching rogue Tor exit relays

This episode explores the hidden dangers lurking at the edges of the Tor network, based on the paper "Spoiled Onions: Exposing Malicious Tor Exit Relays". While Tor is designed to protect user anonymity, the final "exit relay" in a circuit must necessarily act as a bridge to the open Internet, meaning it can see and modify any unencrypted traffic. The podcast explains how malicious volunteer operators exploit this unique position to spy on users, steal credentials, and execute various Man-in-the-Middle (MitM) attacks. Listeners will discover how researchers proactively hunted down these rogue nodes using two custom-built, highly efficient scanning tools. The first, exitmap, systematically probes relays for active manipulation, such as injecting fake HTTPS certificates, censoring DNS requests, or using sslstrip to silently downgrade secure websites into vulnerable HTTP connections. The second tool, HoneyConnector, sets clever digital traps by logging into dummy FTP and IMAP accounts through the Tor network, acting as "bait" to see if snooping relay operators will later attempt to reuse the stolen passwords. The episode details the shocking real-world discoveries from months of continuous scanning, which successfully exposed 65 malicious or misconfigured exit relays. Highlights include the unmasking of a coordinated "Russian HTTPS Group" executing identical encryption-breaking attacks, and an "Indian Sniffer Group" caught systematically logging in with the researchers' decoy passwords. Finally, the discussion covers how the privacy community is fighting back, exploring a clever browser patch designed to automatically thwart these attacks by double-checking suspicious X.509 security certificates across multiple, independent Tor circuits.