In a digital world where privacy and anonymity are becoming increasingly valuable, technologies designed to protect them are emerging. One of the most well-known and also controversial is the TOR (The Onion Router) network. Created to provide users with near-total anonymity on the Internet, it has become a symbol of freedom of speech for some and synonymous with the “dark side of the Internet,” or Darknet, for others. From a business perspective, the appearance of traffic from the TOR network in a company’s IT infrastructure is a wake-up call that requires special attention.
While TOR has its legitimate and legitimate uses, its architecture and popularity among cybercriminals make it a serious security challenge for any organization. The ability to hide a real IP address and encrypt traffic makes it an ideal tool for launching attacks, exfiltrating data or communicating with Command & Control servers. In this article, we’ll explain what a TOR network is, the specific risks it poses to companies, how to distinguish it from a VPN, and how modern cyber security strategies can help protect your organization from the dangers of anonymous networks.
Shortcuts
- What is the TOR network and why is it so controversial in the business world?
- Does employee use of TOR always mean a threat to the company?
What is the TOR network and why is it so controversial in the business world?
TOR, short for “The Onion Router,” is a global, decentralized network of servers run by volunteers that enables anonymous communication on the Internet. Its main goal is to protect users’ privacy by hiding their location and activity from network traffic analysis. The name “onion” refers to the multi-layered encryption: user data passes through a series of random relays (TOR nodes) before it reaches its destination server on the Internet. Each relay knows only the address of the previous and next node, and the data is encrypted repeatedly, layer by layer. As a result, no single point in this network knows the entire path of communication, making it extremely difficult to trace the original source of traffic.
The controversy surrounding TOR in the business world stems from the dual nature of the technology. On the one hand, it is an invaluable tool for journalists, activists, human rights activists and ordinary users living in countries with regimes that censor the Internet, allowing them to communicate freely and securely. On the other hand, the same level of anonymity has made TOR a favorite tool of cybercriminals. It is through the TOR network that most of the hidden services in the so-called Darknet operate, where illegal goods, data or malware are traded.
From a company’s perspective, network traffic originating from or directed to TOR is a powerful wake-up call. Since the vast majority of legitimate business activity does not require this level of anonymity, the appearance of TOR traffic on a company’s network most often indicates one of two things: either an employee is deliberately bypassing security policies in an attempt to hide his activity, or, worse, there is malware operating inside the network that uses TOR to communicate anonymously with its creators. This duality makes it imperative for security departments to treat TOR as a potential and serious threat.
📚 Read the complete guide: Cyberbezpieczeństwo: Kompletny przewodnik po cyberbezpieczeństwie dla zarządów i menedżerów
Does employee use of TOR always mean a threat to the company?
Although traffic from TOR networks in a corporate environment should always be treated with the utmost care, the answer to this question is not clearly yes. In the vast majority of cases, the use of TOR by employees during working hours and on corporate equipment is a violation of security policies and poses unnecessary risks. However, there are very rare, niche scenarios in which such activity may be justified.
Theoretically, security professionals, threat intelligence analysts or researchers can use TOR to securely investigate Darknet activity, analyze malware or monitor cybercrime forums without revealing their identity or affiliation with the company. In that case, the use of TOR is a conscious and controlled part of their work. Similarly, investigative journalists employed by media companies may use TOR to communicate securely with their sources (informants).
However, it should be emphasized that these are exceptional situations. For 99% of employees in a typical business organization - in finance, marketing, sales or HR - there is no legitimate and justifiable reason to use TOR networks on company devices. Therefore, the default security policy should be to block and monitor such traffic. If an employee who does not belong to the above-mentioned groups uses TOR, this should be considered a potential threat. This could mean an attempt to bypass company content filters, a desire to hide unauthorized activity, or, in the worst case scenario, the unknowing or conscious running of software that installs malicious code using TOR for communication.
What specific risks (e.g., data leakage, malware) are associated with traffic from TOR networks?
Traffic associated with the TOR network, both inbound and outbound from the corporate network, carries a number of specific and serious risks. Simply allowing such communication significantly increases the attack surface and makes the work of security teams more difficult.
The first and most obvious risk is malware (malicious software) infection. Users who use the TOR browser to surf the Internet, especially on its less reputable corners, are much more likely to come into contact with malicious code. To make matters worse, many families of modern malware, including ransomware and banking trojans, are designed to use the TOR network to communicate with their command and control (C2) servers once they infect a system. The anonymity of TOR makes it extremely difficult to locate and block C2 servers, and the encrypted traffic prevents security systems from analyzing transmitted commands.
Another major risk is uncontrolled data leakage (data exfiltration). An employee acting in bad faith can use TOR to anonymously take confidential data - intellectual property, customer databases or business strategies - out of the company. The anonymity of the network makes it difficult or even impossible to prove who sent the data and where it went. A similar mechanism can be used by malware that, after stealing data from company servers, sends it to criminals via an encrypted and anonymous TOR channel.
Finally, inbound traffic from the TOR network is also a threat. Attackers can use TOR exit nodes (exit nodes) to launch automated attacks on corporate servers and web applications, such as brute-force password cracking attempts or scanning for vulnerabilities. The anonymity of TOR makes it pointless to block the attacker’s source IP address, as the next time they try, they will use another exit node from a pool of thousands available worldwide.
How do cybercriminals use TOR to attack corporate networks?
Cybercriminals exploit the unique properties of the TOR network at many stages of the attack lifecycle, from reconnaissance to compromise to the realization of their goals. The anonymity and encryption that TOR provides make it an ideal tool for hiding one’s identity and infrastructure, making it significantly more difficult to defend and investigate after an incident.
One of the most common uses is to use TOR as a communication channel for malware. Once a computer on a company’s network is infected, the malware connects to a Command & Control (C2) server hidden as a service on the TOR network. This allows the attacker to issue commands remotely (e.g., “encrypt disks,” “look for passwords”), and the infected computer can send back stolen data. All this communication is encrypted and anonymous, making traditional security systems that analyze network traffic often unable to block it or even identify it as malicious.
TOR is also commonly used to launch anonymous attacks on external company services. Attackers, using TOR’s pool of thousands of exit nodes, can conduct massive credential stuffing attacks (testing stolen logins and passwords on login portals) or brute-force attacks. Source IP addresses that change every now and then make simple blocking at the firewall level impossible. Moreover, TOR exit nodes are often used to anonymously scan corporate websites and servers for known vulnerabilities, allowing attackers to prepare the ground for a proper attack.
Finally, the TOR network is the backbone of the cybercrime economy. It is on the Darknet, accessible mainly through TOR, that attackers buy and sell stolen data, logins, credit card numbers, as well as ready-made malware kits and services such as “Ransomware-as-a-Service.” This makes it possible for even those with little technical knowledge to launch sophisticated attacks.
Do legitimate business applications of TOR make practical sense?
While the dominant narrative around TOR in a business context focuses on the risks, there are some, albeit very niche and specific, legitimate scenarios for its use. However, they require strict controls, clear policies and advanced technical expertise for the benefits to outweigh the potential risks.
The main legal application is threat analysis and business intelligence (threat intelligence). Security teams can use TOR to securely and anonymously monitor cybercrime forums, Darknet markets and other places where criminals communicate and trade stolen data. This allows them to proactively obtain information about new attack techniques, phishing campaigns targeting a particular industry, and even whether a company’s employee credentials have leaked and are being offered for sale. The anonymity of TOR in this case protects researchers from being exposed by criminal groups.
Another potential use is to protect communications in extremely hostile environments. A company whose employees travel to countries with high levels of state surveillance and censorship could theoretically use TOR as an additional layer of protection to bypass blockades and secure confidential communications. However, this is an extreme scenario, and in most cases a much more secure and manageable solution will be a corporate VPN with strong encryption.
In practice, for the vast majority of companies, the benefits of using TOR legally are negligible compared to the risks generated. Maintaining a secure, controlled environment for such activities is costly and complicated. Therefore, the general and safest rule of thumb is to treat TOR as an undesirable technology on the corporate network and focus on blocking and monitoring traffic related to it, with possible exceptions for specialized teams to be strictly regulated and isolated from the rest of the infrastructure.
What are the technical options for monitoring and blocking access to TOR networks?
Companies have a range of technical capabilities to control traffic associated with the TOR network, whether it is initiated from within or attempts at access from the outside. An effective strategy relies on a multi-layered approach, using a variety of tools and techniques to identify, monitor and ultimately block unwanted activity.
The basic and simplest method is blocking at the firewall level. There are publicly available and regularly updated lists of IP addresses of all known relays (nodes) of the TOR network. Administrators can import these lists into the company’s firewall and create a rule that blocks all traffic coming and going to and from these addresses. This is an effective first line of defense to prevent simple communication with the TOR network. The disadvantages of this approach are the need to constantly update IP lists and the possibility that more advanced techniques, such as TOR bridges, can bypass the blocking.
More advanced capabilities are offered by next-generation firewalls (NGFW) and intrusion prevention systems (IPS). These devices can perform Deep Packet Inspection (DPI) and have built-in signatures to identify TOR traffic even when it is not routed to publicly known nodes. They can recognize the distinctive pattern of the TLS protocol used by TOR and block it based on analysis of the communication itself, not just the IP address.
Finally, Network Monitoring Tools and SIEM (Security Information and Event Management) systems play a key role. They analyze logs from firewalls, proxies and other network devices in search of attempted connections to IP addresses on the TOR reputation list. Even if the attempt is blocked, the mere fact that it was made by a computer inside the network is valuable information for the security department to investigate. Advanced solutions can correlate these events and automatically raise an alarm when they detect suspicious activity related to anonymous networks.
TOR traffic control methods
MethodHow does it work?AdvantagesDisadvantagesBlocking IP listsThe firewall blocks traffic to/from publicly known IP addresses of TOR nodes.Simple to implement, effective against basic connections.Requires constant updating of lists, can be bypassed by bridges (bridges).**Deep Packet Inspection (DPI).**NGFW/IPS analyzes the content of traffic and blocks it based on TOR protocol signatures.More advanced, it can detect movement even to unknown nodes.Requires efficient equipment, can generate false alarms.Monitoring and Analysis of LogsSIEM and monitoring tools analyze logs for connection attempts.It even detects blocked attempts, allows identification of the source inside the network.Reactive (detects after the fact), requires analysis and team response.
What security policies should a company implement in the context of anonymous networks?
Implementing clear and rigorously enforced security policies is the foundation for protecting a company from the dangers of anonymizing networks such as TOR. Technology is only one component; without the right organizational framework and policies, its effectiveness is limited. These policies should be part of an overall Acceptable Use Policy (AUP).
First and foremost, the policy should explicitly prohibit the installation and use of unauthorized software, including the TOR browser and other anonymization tools, on all company devices. This rule should be clearly communicated to all employees, along with an explanation of why it is necessary and the risks involved in breaking it. Technical measures should also be implemented to prevent employees from installing software themselves (revoking local administrator privileges).
The network security policy must define the company’s strategy against traffic to and from TOR networks. By default, it should include blocking all such communications at the level of the company’s firewall and other edge security devices. The policy should also define a procedure for dealing with the detection of an attempted such connection. Any alert from the monitoring system indicating an attempted communication to the TOR network by an employee’s workstation should trigger an internal investigation to identify the cause - whether it is a conscious act by the employee or a symptom of a malware infection.
Finally, the policy must provide for an exception handling procedure. If there are teams within the company (e.g., security analysts) that need to use TOR for legitimate business reasons, the policy must precisely define the rules for such access. It should only be performed on dedicated workstations isolated from the rest of the corporate network, and any such activity must be closely monitored and authorized by a supervisor and the security department.
How is TOR different from a VPN and which solution is safer for business?
Although both TOR and VPN (Virtual Private Network) are used to increase privacy and security on the Internet, they operate on completely different principles and are designed for different purposes. Understanding these differences is key to making the right decision in a business context.
TOR is a decentralized network focused on anonymity. Its main purpose is to hide a user’s identity by repeatedly encrypting and transmitting traffic through a random network of volunteer servers. No one, not even the network operators, can know the entire path from the user to the destination server. The disadvantages of TOR are the low speed (due to multiple data transfers) and the lack of a central authority in charge of the network’s operation. The user has no control over which countries and servers his traffic passes through.
A VPN is a centralized service focused on privacy and connection security. The user connects to one specific server belonging to the VPN service provider. All traffic between the user and the VPN server is encrypted in a secure “tunnel.” The VPN hides the user’s real IP address, replacing it with that of the VPN server, but the VPN service provider technically has insight into who the user is and what they are doing online. Therefore, trusting the provider and its no-logs policy is key. A VPN is much faster than TOR and allows you to choose your server location.
From a business perspective, a VPN is undeniably a more secure, manageable and appropriate solution. A corporate VPN allows remote employees to securely connect to company resources, encrypting all communications on the public network. The company has full control over the VPN server, access policies and activity logging. TOR, due to its anonymity, lack of control and links to criminal activity, is not a tool suitable for business use and should be blocked on corporate networks.
How do you educate employees about the dangers of unauthorized software?
Employee education is one of the most important pillars of defense against the dangers of using unauthorized software, including tools such as TOR. Even the best technical safeguards can be insufficient if employees do not understand the risks and follow basic digital hygiene principles. An effective education program must be ongoing, engaging and tailored to the realities of the job.
A key element is regular cyber security (security awareness) training. They should not be a one-time event, but a cyclical process. Instead of boring lectures, it is worth betting on interactive forms: workshops, webinars and e-learning platforms. It should be shown, using practical, real-life examples, what consequences - both for the company (financial losses, loss of reputation) and for the employee (disciplinary liability) - the installation of software from an untrusted source can have. It should be explained that even a seemingly harmless application can contain hidden malicious code that steals passwords or encrypts a drive.
The education program must clearly communicate the company’s security policies. Employees need to know that installing any software without IT approval is prohibited and why this rule exists. They should be given easy access to a list of authorized software and a simple and quick path to request new tools, so they don’t feel tempted to take “shortcuts.”
A very effective method of consolidating knowledge is continuous communication and testing. It’s a good idea to regularly send short reminders and security alerts to employees (e.g., about new phishing campaigns) and conduct controlled tests, such as sending simulated phishing messages, to test their vigilance. Building a culture in which employees feel comfortable reporting concerns or errors to the security department without fear of punishment is key to creating a truly resilient organization.
What network monitoring tools help detect unwanted activity?
Detecting unwanted activity, such as attempts to connect to TOR networks or the operation of unidentified software, requires specialized tools for monitoring and analyzing network traffic. They provide security teams with insight into what’s happening inside a company’s infrastructure and allow them to react quickly to potential threats.
The primary class of tools are intrusion detection and prevention systems (IDS/IPS). They act like a network alert system - constantly analyzing traffic for known attack signatures and behavioral anomalies. Advanced IPS systems have dedicated signatures for recognizing the TOR protocol and can automatically block such connections while generating an alert for the administrator.
Security Information and Event Management (SIEM) platforms provide an even broader picture. These are central systems that collect, aggregate and correlate logs from hundreds of different sources throughout an organization: firewalls, servers, workstations, antivirus systems, etc. A security analyst can create a rule in the SIEM system that searches the logs for attempted connections to IP addresses belonging to the TOR network. By correlating events, the SIEM can link such an attempt to a specific user and workstation, allowing it to quickly identify the source of the problem.
Finally, Network Detection and Response (NDR) class tools are playing an increasingly important role. They use machine learning and artificial intelligence to build a model of “normal” network behavior. When they detect activity that deviates from this pattern - for example, an accountant’s workstation suddenly starts communicating via an unusual, encrypted protocol with an unknown server on the Internet - they raise the alarm. This approach makes it possible to detect even new, previously unknown threats that use non-standard communication methods.
Do next-generation firewalls effectively protect against threats from TOR?
Next-Generation Firewalls (NGFWs) represent a significant step forward compared to traditional firewalls and are one of the key tools in the defense arsenal against TOR network threats. Their effectiveness comes from their ability to analyze network traffic at a much deeper level than just IP addresses and ports.
The traditional firewall, when filtering traffic, looked mainly at the “address” on the envelope. NGFW can “look inside” and understand what application is generating the traffic, regardless of the port being used. With mechanisms such as deep packet inspection (DPI) and application identification (Application ID), the NGFW firewall has signatures that allow it to recognize the characteristic “fingerprint” of the TOR protocol. This means it is able to identify and block TOR traffic even when it tries to bypass standard blocking, such as by communicating on a non-standard port.
Moreover, NGFWs often integrate intrusion prevention system (IPS) functionality and reputation-based web content filtering. They can use continuously updated lists of IP addresses of known TOR nodes and other malicious hosts, automatically blocking all communication with them. For encrypted traffic (SSL/TLS), many NGFW firewalls offer an SSL inspection function that allows traffic to be decrypted, analyzed and re-encrypted (if in compliance with company policy), making it possible to detect threats hidden in encrypted tunnels.
Note, however, that even the most effective NGFW is not a perfect solution and should be part of a multi-layered defense strategy. Very determined users may try to bypass blockades by using so-called TOR bridges (Tor bridges) or other tunneling techniques. Therefore, in addition to prevention at the firewall level, it is also crucial to monitor activity on endpoints (using EDR systems) and analyze logs in the SIEM system to ensure comprehensive protection.
How can nFlo’s cybersecurity services, including network management, help protect your company from TOR network threats?
Protecting a company from complex threats, such as those associated with the TOR network, requires not only the right tools, but above all, expertise and continuous monitoring. At nFlo, we understand these challenges and offer comprehensive cyber security and network management services that allow our clients to effectively minimize risks and build a resilient IT infrastructure.
Our approach is based on a defense-in-depth strategy. We help select, deploy and configure next-generation firewalls (NGFWs), creating a first, robust line of defense. We implement rules that not only block traffic to and from publicly known TOR nodes based on reputation lists, but also use advanced traffic analysis to identify and block the TOR protocol itself. Our network management service ensures that these rules are always up to date and that network devices are operating at optimal performance.
In addition to protection at the network edge, we deploy and manage advanced monitoring and threat detection solutions. We integrate logs from network devices and security systems into central analytical platforms that allow us to proactively detect attempts at unauthorized communications and other anomalies. As part of our auditing and penetration testing services, we verify the effectiveness of implemented security measures by simulating the actions of attackers and checking for paths around implemented controls.
We also understand that technology is not everything. That’s why we help our clients create and implement effective security policies and create awareness among employees. By working with nFlo, you not only gain access to the latest technology, but most importantly, a partner with years of experience who can help you build a comprehensive and coherent strategy to protect against the entire spectrum of modern cyber threats.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- VPN — VPN (Virtual Private Network) is a technology that creates an encrypted, secure…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- Wireless Networks — Wireless networks are communication systems that enable data transmission…
- NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
Learn More
Explore related articles in our knowledge base:
- 5G network security: What new risks and opportunities does it bring to business?
- AI-NDR: Comprehensive Network Security with AI
- FortiNAC: Advanced Network Access Control
- IDS/IPS systems: Why is a firewall alone not enough to protect your network?
- Network Detection and Response (NDR): why is network visibility critical to security?
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- FortiNAC — Fortinet
Related topics
See also:
