We maintain a verified and built-in Tor Exit IP External Dynamic List that our customers can use to block connections from Tor Exit nodes. Palo Alto Networks provides two solutions as part of Threat Prevention that are best used together to filter Tor traffic. To avoid these risks, we advise the blocking of Tor in enterprise networks.Įmphasizing the importance of monitoring or blocking Tor traffic in the enterprise, we observed 6,617,473 sessions to or from 691 devices within 204 customer networks in one month. Users can also elude geographic restrictions of services or buy illicit goods unchecked using Tor.

Also, employees can use Tor to bypass content blocking policies (e.g., blocking of adult or gambling sites) such as those provided by the Palo Alto Networks DNS Security and Advanced URL Filtering services. Malware authors regularly use Tor for denial-of-service (DoS) attacks, hidden reconnaissance, exploitation, command and control communication and data exfiltration.įor enterprises concerned about the risks of Tor traffic, the use of Tor for malware, command and control, exfiltration, and hidden reconnaissance are some of the most important security risks. Tor is famous for enabling the operation of dark web marketplaces, such as Silk Road, where customers could procure a wide range of illicit goods, including drugs, weapons and fake identification documents. Cybercriminals use Tor to evade defenses and hide their identity from law enforcement. Political activists use Tor to express their views while staying out of sight of their governments. However, allowing Tor traffic on enterprise networks opens the door to a variety of potential abuses and security risks. People use Tor for many different reasons, both benign and malicious. The Tor project provides one of the most well-known tools that users can leverage to stay anonymous on the internet.

How tor bridge work