Some time ago, I wrote an article about how simple techniques can bypass firewall protections: How to Trick a Firewall and Bypass Protections. One of the methods discussed in that post was using Tor (The Onion Router).
Beyond bypassing firewalls, Tor can be leveraged by threat actors to establish persistence in targeted environments. Google Cloud provides excellent details on this in their blog post about APT29 and domain fronting: APT29: Domain Fronting.
In a recent lab exercise, I explored how to effectively block Tor traffic using PAN NGFW. To my surprise, blocking Tor turned out to be more challenging than expected.
When direct access to the Tor network is blocked, users can circumvent this restriction by using bridges
Among the bridge options, Obfs4 and Snowflake are relatively straightforward to block with Palo Alto NGFW. Below are the security policies sufficient to block these bridges:
As demonstrated, the Tor browser dynamically attempts connections using different destination ports. Sometimes, traffic is correctly identified as “tor,” while other times, it appears as “unknown-tcp.”
Best practices suggest that unknown applications should be blocked for traffic to and from the internet.
The most challenging bridge to block is Meek-Azure, described by Tor as: “Makes it look like you’re connected to a Microsoft website instead of using Tor. May work in heavily censored regions, but is usually very slow.”
Meek-Azure leverages a technique called domain fronting, making Tor connections appear as legitimate traffic to Microsoft Azure’s Content Delivery Network (CDN). From the firewall’s perspective, this traffic looks like ordinary browsing to Azure-hosted content.
Palo Alto NGFW includes an anti-spyware signature designed to block domain fronting. However, during testing, I discovered that this signature does not block Tor connections via Meek-Azure.
Blocking Meek-Azure is quite challenging. We cannot block the entire URL category for content delivery networks, as it would disrupt a significant number of websites. Based on my testing, the only viable approach to block it is by deploying SSL decryption, which interrupts the SSL handshake for Meek-Azure, rendering the connection unsuccessful.
2025-01-10 09:42:00.240 [WARN] 2 connections have failed:
2025-01-10 09:42:00.240 [WARN] 2 connections died in state handshaking (TLS) with SSL state SSLv3/TLS write client hello in HANDSHAKE
2025-01-10 09:42:00.264 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150
2025-01-10 09:42:00.264 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2025-01-10 09:42:00.694 [WARN] Managed proxy "N/A" process terminated with status code 0
2025-01-10 09:42:01.239 [NOTICE] Delaying directory fetches: DisableNetwork is set.Considering bridges like obfs4, Snowflake, and Meek-Azure, not every NGFW or UTM vendor has the capability to entirely block Tor.