Blocking Tor with Toro

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Blocking Tor with Toro

L1 Bithead

I recently had to work with local and federal law enforcement to resolve the following.

 

http://www.ktvz.com/news/mtn-view-hs-bomb-threat-traced-to-eugene-14-year-old/653184885

 

Because of this, I've created a small piece of software (MIT Licensed) that caches the ip addresses of Tor exit nodes, and creates configuration files for different services (PaloAlto, Apache, Nginx, Iptables) in order to block Tor. 

 

https://www.toro.tech


https://toro.threathound.com

 

Toro was built with the Go programming language, so consuming the Tor exit node ip addresses, updating the local database, and serving the configuration files over http all happen within a single process served by a single binary.

 

 

I realize that a truly motivated attacker won't be stopped by this but I think it will help weed out certain types of offenders and potentially lead to less wasted resources for certain threat models.

 

Feel free to ask questions.

8 REPLIES 8

L0 Member

Okay to point a External Dynamic List entry to your directory for Palo Alto?

It is a performant application, so if your threat model allows, feel free to consume the list directly. If things get crazy, I'll rate limit it to once every thirty minutes. Though I do not antipicate this.




Thank you.

It looks like the EDL for Palo Alto Networks currently available at:

 

https://www.toro.tech/paloalto/minutes/1440

 

It would also look like the 1440 value in the URL is a value for 'last-n-minutes'. What does this refer to? Would an user benefit in any way by modifying this default value?

 

 


It would also look like the 1440 value in the URL is a value for 'last-n-minutes'. What does this refer to? 

In plain english.

"Give me all the exit node IP addresses that were part of the network in the last day (1440 minutes)."

 

>  Would an user benefit in any way by modifying this default value?

If you only want the freshest data then append https://toro.threathound.com/paloalto/minutes/15 minutes.

 

If you are paranoid and do not want any known associated node in the last year, append https://toro.threathound.com/paloalto/minutes/15 minutes.

The default of 1440 is simply the last day and seemed reasonable.

 

 

Thank you for sharing!

You are welcome.

L1 Bithead

By popular demand, a powershell .ps1 script is now an option.

L1 Bithead

The domain was going to cost too much for a free project. Added it as a sub domain. Still the same service with the same aggregated IP addresses in the database 🙂

 

https://toro.threathound.com

 

 

  • 10483 Views
  • 8 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!