Background. With increased Internet usage occurring across the world journalists, dissidents and criminals have moved their operations online, and in turn, governments and law enforcement have increased their surveillance of their country’s networks. This has increased the popularity of programs masking users’ identities online such as the Tor Project. By encrypting and routing the traffic through several nodes, the users’ identity is hidden. But how are Tor users utilizing the network, and is any of it in the plain text despite the dangers of it? How has the usage of Tor changed compared to 11 years ago? Objectives. The thesis objective is to analyze captured Tor network traffic that reveals what data is sent through the network. The collected data helps draw conclusions about Tor usage and is compared with previous studies. Methods. Three Tor exit nodes are set up and operated for one week in the US, Germany, and Japan. We deploy packet sniffers performing a deep packet inspection on each traffic flow to identify attributes such as application protocol, number of bytes sent in a flow, and content-type if the traffic was sent in plain text. All stored data is anonymized. Results. The results show that 100.35 million flows were recorded, with 32.47%of them sending 4 or fewer packets in total. The most used application protocol was TLS with 55.03% of total traffic. The HTTP usage was 15.91% and 16% was unknown protocol(s). The countries receiving the most traffic were the US with over45% of all traffic, followed by the Netherlands, UK, and Germany with less than 10%of recorded traffic as its destination. The most frequently used destination ports were 443 at 49.5%, 5222 at 12.7%, 80 with 11.9%, and 25 at 9.3%.Conclusions. The experiment shows that it is possible to perform traffic analysis on the Tor network and acquire significant data. It shows that the Tor network is widely used in the world but with the US and Europe accounting for most of the traffic. As expected there has been a shift from HTTP to HTTPS traffic when compared to previous research. However, there is still unencrypted traffic on the network, where some of the traffic could be explained by automated tools like web crawlers. Tor users need to increase their awareness in what traffic they are sending through the network, as a user with malicious intent can perform the same experiment and potentially acquire unencrypted sensitive data.

The ability to access the Internet while remaining anonymous is a necessity in today's society. Whistleblowers need it to establish contact with journalists, and individuals living under repressive regimes need it to access essential resources. Anonymity also allows malicious actors to evade identification from law enforcement and share ill-intentioned resources. Therefore, digital forensics is an area that needs to stay up to date with these developments. We investigate what artefacts can be discovered by conducting acquisition and analysis of a Windows 11 computer that has used the Tor browser to browse the Dark Web. Our results identify a variety of artefacts acquired from Windows Registry, active memory, storage, and network traffic. Furthermore, we discuss how these can be used in a digital forensic investigation.

This paper discsusses the question: is website oracles in Tor from timing DNS something we have to worry about? This paper builds apon the findings done by Rasmus Dahlberg and Tobias Pulls in thier paper Website Fingerprinting with Website Oracles. A website oracle is a side channel attack that answers the predicate: has this website been visited before? The website oracle is constructed and test are carried out, with great outcome, resulting in that website oracles from timing DNS is not an attack that puts individuals using Tor at risk, but certanly challanges the idea of an anonymity network when such a lot of data can be derived from DNS. / Den här uppsatsen diskuterar frågan: är ett webbplatsorakel från DNS-tidtagning i Tor en attack att oroa sig för? Uppsatsen bygger på tidigare forskning utförd av Rasmus Dahlberg och Tobias Pulls i rapporten Website Fingerprinting with Website Oracles. Ett webbplatsorakel är en sidokanalsattack som svarar på predikatet: är denna webbsida besökt av en specifik delmängd användare? Tor är ett anonymitetsnätverk för gemene man, en viktig teknik för ett utvecklande samhälle där den enskilde individens rätt över sin egen information på internet är under konstant hot. I uppsatsen förklaras vad ett webbplatsorakel är i detalj, hur webbplatsorakel fungerar i Tor-nätverket och hur detta konstrueras i detalj. Resultat presenteras och en diskussion förs med anknytning till dagens teknik och samhälle i stort. Resultaten tyder inte på någon större risk för enskilda användare av Tor men visar på en riskfylld utveckling av perceptionen av hur Tor uppfattas och hur dess rykte kan skadas om attacker likt den presenterad i uppsatsen kan vidareutvecklas. / <p>Presentation utfördes online p.g.a. coronapandemi.</p>