Blocking Tor with Toro

Reply
L1 Bithead

Blocking Tor with Toro

I recently had to work with local and federal law enforcement to resolve the following.

 

http://www.ktvz.com/news/mtn-view-hs-bomb-threat-traced-to-eugene-14-year-old/653184885

 

Because of this, I've created a small piece of software (MIT Licensed) that caches the ip addresses of Tor exit nodes, and creates configuration files for different services (PaloAlto, Apache, Nginx, Iptables) in order to block Tor. 

 

https://www.toro.tech


https://toro.threathound.com

 

Toro was built with the Go programming language, so consuming the Tor exit node ip addresses, updating the local database, and serving the configuration files over http all happen within a single process served by a single binary.

 

 

I realize that a truly motivated attacker won't be stopped by this but I think it will help weed out certain types of offenders and potentially lead to less wasted resources for certain threat models.

 

Feel free to ask questions.

L0 Member

Re: Blocking Tor with Toro

Okay to point a External Dynamic List entry to your directory for Palo Alto?

L1 Bithead

Re: Blocking Tor with Toro

It is a performant application, so if your threat model allows, feel free to consume the list directly. If things get crazy, I'll rate limit it to once every thirty minutes. Though I do not antipicate this.




L6 Presenter

Re: Blocking Tor with Toro

Thank you.

It looks like the EDL for Palo Alto Networks currently available at:

 

https://www.toro.tech/paloalto/minutes/1440

 

It would also look like the 1440 value in the URL is a value for 'last-n-minutes'. What does this refer to? Would an user benefit in any way by modifying this default value?

 

 

L1 Bithead

Re: Blocking Tor with Toro


It would also look like the 1440 value in the URL is a value for 'last-n-minutes'. What does this refer to? 

In plain english.

"Give me all the exit node IP addresses that were part of the network in the last day (1440 minutes)."

 

>  Would an user benefit in any way by modifying this default value?

If you only want the freshest data then append https://toro.threathound.com/paloalto/minutes/15 minutes.

 

If you are paranoid and do not want any known associated node in the last year, append https://toro.threathound.com/paloalto/minutes/15 minutes.

The default of 1440 is simply the last day and seemed reasonable.

 

 

L6 Presenter

Re: Blocking Tor with Toro

Thank you for sharing!

L1 Bithead

Re: Blocking Tor with Toro

You are welcome.

L1 Bithead

Re: Blocking Tor with Toro

By popular demand, a powershell .ps1 script is now an option.

L1 Bithead

Re: Blocking Tor with Toro

The domain was going to cost too much for a free project. Added it as a sub domain. Still the same service with the same aggregated IP addresses in the database :-)

 

https://toro.threathound.com

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!