Tor Users Deanonymized by BGP Hijacks: A Persistent Threat in 2024

By /

Listen to this Post

Featured Image
Tor’s anonymity has been compromised twice in recent history—first in 2014 and again in 2023—due to real Border Gateway Protocol (BGP) hijacks. These attacks rerouted Tor traffic through malicious nodes, exposing users’ real IP addresses. The threat remains active in 2024, making BGP hijacks a critical concern for privacy-focused individuals.

Reference:

You Should Know: How BGP Hijacks Work & How to Mitigate Them

BGP hijacks manipulate internet routing tables to redirect traffic. Attackers falsely announce ownership of IP blocks, intercepting data meant for legitimate servers. Tor users are particularly vulnerable because exit nodes can be compromised.

Detecting & Preventing BGP Hijacks

1. Monitor BGP Routes

Use BGPStream or RIPE RIS to detect suspicious route changes: 

 Install bgpstream (Linux) 
sudo apt-get install bgpstream-tools

Fetch recent BGP updates 
bgpreader -w -t ribs -c route-views2

Check for unexpected AS path changes 
bgpreader -j | jq '.elements[].fields.as_path'
  1. Use VPN + Tor (Tor over VPN)
    Adding a VPN before Tor prevents direct exposure if an exit node is hijacked: 

    Connect to a VPN (OpenVPN example) 
sudo openvpn --config /path/to/config.ovpn

Then launch Tor Browser 
./start-tor-browser

3. Enable Tor’s Entry Guards

Entry guards reduce exposure to malicious relays:

 Edit torrc (Linux/macOS) 
sudo nano /etc/tor/torrc

Add these lines: 
UseEntryGuards 1 
NumEntryGuards 3

4. Verify Tor Circuits

Check your current Tor path for anomalies:

 In Tor Browser, visit: 
about:tor

Or via terminal (if running Tor service) 
echo -e "GET /tor/status-vote/current/consensus HTTP/1.0\r\n" | nc 127.0.0.1 9051

5. Block Malicious Exit Nodes

Use nyx (Tor’s CLI monitor) to blacklist suspicious nodes: 

sudo apt-get install nyx 
nyx --interface

What Undercode Say

BGP hijacks remain a severe threat to Tor’s anonymity. While Tor provides strong privacy, its reliance on global routing makes it susceptible to interception. Combining Tor with VPNs, monitoring BGP routes, and enforcing entry guards can mitigate risks. However, the core issue lies in BGP’s lack of cryptographic validation—until RPKI (Resource Public Key Infrastructure) is universally adopted, such attacks will persist.

Expected Output:

  • A hardened Tor setup with VPN fallback.
  • Real-time BGP monitoring alerts.
  • Reduced exposure to malicious exit nodes.

Prediction

By 2025, BGP hijacks will evolve to target not just Tor but also VPN providers and cloud networks, pushing wider adoption of RPKI and decentralized routing alternatives like SCION.

Relevant Commands Recap:

 BGP monitoring 
bgpreader -w -t ribs

Tor entry guards 
echo "UseEntryGuards 1" >> /etc/tor/torrc

VPN over Tor 
openvpn --config client.ovpn

Expected Output:

[+] Tor circuit verified: Guard Node (Trusted) 
[+] BGP routes stable: No unexpected AS path changes 
[+] VPN tunnel active: 198.51.100.1 (Secure)

IT/Security Reporter URL:

Reported By: Sam Bent – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: