Reply
L1 Bithead
Posts: 6
Registered: ‎11-27-2017

Blocking Tor with Toro

[ Edited ]

I recently had to work with local and federal law enforcement to resolve the following.

 

http://www.ktvz.com/news/mtn-view-hs-bomb-threat-traced-to-eugene-14-year-old/653184885

 

Because of this, I've created a small piece of software (MIT Licensed) that caches the ip addresses of Tor exit nodes, and creates configuration files for different services (PaloAlto, Apache, Nginx, Iptables) in order to block Tor. 

 

https://www.toro.tech


https://toro.threathound.com

 

Toro was built with the Go programming language, so consuming the Tor exit node ip addresses, updating the local database, and serving the configuration files over http all happen within a single process served by a single binary.

 

 

I realize that a truly motivated attacker won't be stopped by this but I think it will help weed out certain types of offenders and potentially lead to less wasted resources for certain threat models.

 

Feel free to ask questions.

L0 Member
Posts: 1
Registered: ‎02-06-2012

Re: Blocking Tor with Toro

Okay to point a External Dynamic List entry to your directory for Palo Alto?

L1 Bithead
Posts: 6
Registered: ‎11-27-2017

Re: Blocking Tor with Toro

It is a performant application, so if your threat model allows, feel free to consume the list directly. If things get crazy, I'll rate limit it to once every thirty minutes. Though I do not antipicate this.




L6 Presenter
Posts: 538
Registered: ‎04-03-2014

Re: Blocking Tor with Toro

Thank you.

It looks like the EDL for Palo Alto Networks currently available at:

 

https://www.toro.tech/paloalto/minutes/1440

 

It would also look like the 1440 value in the URL is a value for 'last-n-minutes'. What does this refer to? Would an user benefit in any way by modifying this default value?

 

 

L1 Bithead
Posts: 6
Registered: ‎11-27-2017

Re: Blocking Tor with Toro

[ Edited ]


It would also look like the 1440 value in the URL is a value for 'last-n-minutes'. What does this refer to? 

In plain english.

"Give me all the exit node IP addresses that were part of the network in the last day (1440 minutes)."

 

>  Would an user benefit in any way by modifying this default value?

If you only want the freshest data then append https://toro.threathound.com/paloalto/minutes/15 minutes.

 

If you are paranoid and do not want any known associated node in the last year, append https://toro.threathound.com/paloalto/minutes/15 minutes.

The default of 1440 is simply the last day and seemed reasonable.

 

 

L6 Presenter
Posts: 538
Registered: ‎04-03-2014

Re: Blocking Tor with Toro

Thank you for sharing!

L1 Bithead
Posts: 6
Registered: ‎11-27-2017

Re: Blocking Tor with Toro

You are welcome.

L1 Bithead
Posts: 6
Registered: ‎11-27-2017

Re: Blocking Tor with Toro

By popular demand, a powershell .ps1 script is now an option.

L1 Bithead
Posts: 6
Registered: ‎11-27-2017

Re: Blocking Tor with Toro

[ Edited ]

The domain was going to cost too much for a free project. Added it as a sub domain. Still the same service with the same aggregated IP addresses in the database :-)

 

https://toro.threathound.com

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!