Thoughts on Tor router hardware

Rob van der Hoeven
Tue Feb 23 2016

I recently came across a small travel-router that claimed to provide transparent access to the Tor-network. Just make a wifi connection to its Tor access point and all the TCP and DNS traffic is routed through the Tor-network. For a price of only $25 I could not resist and bought one. Over the last month I have been playing with the device and... it worked flawlessly, it was fun!

So, running the Tor software on cheap router hardware works, but is it a good idea? I believe it is. In this article I will argue that having Tor on the router benefits both security and usability. It opens up new possibilities for expanding the Tor-network and can provide a much needed source of income for the Tor-project.

Setting the stage

In this article I will refer to an ideal Tor router. This router will provide 3 wifi access points (AP) with the following SSID's:

TorOff : This AP does not route through the Tor-network.
TorTransparent: Provides a transparent Tor proxy.
TorSocks: Provides access to the Tor SOCKS interface of the router's Tor daemon. Except for DHCP, all other traffic is blocked.

The software running on the router is based on OpenWRT and signed by the Tor-project. It should not be possible to add additional software.

Security

I strongly believe that running the Tor daemon on the router improves security. This is why:

If a user connects to the TorSocks AP instead of a local Tor daemon, it becomes impossible to bypass the Tor-network. Software that is not configured to use Tor will not be able to use the Internet.
The Tor daemon on the router runs in a much more secure environment. On the router just a few carefully selected processes are running. Processes that are controlled by the Tor-project that signed the firmware. Compare this with the Windows environment where there is no control. If Microsoft wants to replace your Tor daemon with its own version it can do so.
While using the TorSocks AP benefits security, the story for the TorTransparent AP is more complicated. The transparent AP routes all TCP and DNS traffic through the Tor-network. This includes traffic from many chatty background services which may leak information that can de-anonymize the user. An example is a mail program that checks the mail every 10 minutes over an unencrypted connection. To protect users who are unaware of this background traffic I think the transparent AP should only allow HTTP and HTTPS by default.

For strong anonymity the user should use special privacy enhanced software like the Tor browser in combination with the TorSocks AP.

Usability

Having the Tor daemon running on the router improves usability in the following ways:

Better maintainability.
Easier client configuration.
Better client support.

Running Tor on the router means that Tor does not have to be configured and maintained on every device in ones home. Because the router uses an OS that is controlled by the Tor project, it can automatically update the Tor software (improves security too).

No special client configuration is needed if the TorTransparent AP is used. This means that programs that are not Tor-aware can use the Tor-network to gain a privacy benefit. Of course, it must be made clear to the user that the transparent AP does not provide the best possible privacy protection. For the best privacy protection the user should use the TorSocks AP in combination with privacy enhanced software like Tor-browser.

How the Tor-project can benefit

Playing with Tor router hardware convinced me that its time has come. It can improve both security and usability for the users of the Tor-network. But what can it do for the Tor-project? I think the Tor-project can benefit in the following areas:

Resistance against parties that can influence or even shutdown the Tor-network.
A source of independent funding
New possibilities to strengthen the network and improve the anonymity of the users.

The first point has probably surprised you. Which parties am I talking about? How can they influence or even shutdown the Tor-network? The answers are simple. Most Tor software runs on an OS that is under the control of Google (Android), Microsoft or Apple. These companies have the power to remove or modify the Tor software. Will they do this? Probably not, but remember that risk = chance * effect. The effect of removed or modified Tor software is simply not acceptable which makes it a high risk. Currently the Tor-project has no defense against a hostile act of the OS manufacturers.

One of the weak points of the Tor-project is its funding. Roughly 75 percent comes from grants from US government related institutions. These grants are not stable income, and also make people wonder if the Tor-project is not secretly working for the US. The Tor-project needs to diversify its funding.

I am pretty sure that developing Tor router firmware can become a stable source of income for the Tor-project. Why? Because a there is already a company that sells Tor router hardware. The story of this company is very interesting. They misled their customers about the hardware, claiming it was developed in-house while instead they used of-the-shelf hardware from China. For this their crowdfunding campaign on Kickstarter was suspended. Later analysis of their software revealed some serious security flaws. All this did not finish the company, today they are selling different versions of their AnonaBox for prices ranging from $80 to $120 (of which a generous $1 is donated to the Tor-project!)

The last benefit for the Tor-project that I want to mention are the possibilities to strengthen the network. Think about it; each Tor router adds hardware to the Tor-network that runs 24/7. Hardware that is under the control of the Tor-project. What can you do with this hardware? I don't have all the answers here. In the past I have showed that you can use a router as a Tor-bridge with some simple WAN-NAT iptables rules. Another interesting possibility would be to integrate Tor-browser into the router and access it using a remote desktop connection. This may not be possible today, but it will certainly be possible tomorrow.