Usage: "Tor Onion routing" to my NAS

Hello Glasswire!
I’ve noticed something unusual recently…
Glasswire is reporting 822.7 K of data transferred (I think to) my Buffalo NAS, with traffic type “Tor Onion routing.”

This is unexpected, and I want to know more about this tool, and what this might mean.
The responsible application is “Device Association Framework Host”

“Device Association Framework Provider Host is an official Microsoft core process that runs under the LOCAL SERVICE account. The process serves as a framework for connecting and pairing both wired and wireless devices with Windows. A separate Device Association Framework Provider Host process will show up in Task Manager for each such connected device.”

I can believe that this application should send traffic to other hosts on the network, but I wouldn’t expect it to be using TOR.

I don’t (knowingly) have TOR installed on my desktop.
There is additional traffic from this application, but it’s in smaller amounts, with type ‘other.’

I appreciate your insight.

We use an API for traffic detection and it’s not always 100% accurate. If you check the responsible application with VirusTotal and everything looks OK then perhaps it’s an incorrect detection of the traffic type.

You may want to also scan your computer for malware just in case.

Thanks Ken!

I think I got to the bottom of it. I’ll share a bit for future visitors with a similar issue.

My concern was that a malware infection may have hijacked system services, and used those for malicious purposes. Just because an executable is trusted (like iexplore.exe) it doesn’t mean that everything it does or can do is safe.

In this case, I continued monitoring my system behavior, and I was able to identify a correlation between this “Tor Onion routing” traffic, and activity from my seldom-used bittorrent client.

To be honest, I don’t know everything about how this client was designed, and it’s very possible that the developers use Tor for something or another. The client is reputable, so I’m willing to give it the benefit of the doubt, and go on with my life.

Thanks for being responsive, and thanks for working on Glasswire. It’s the best.

1 Like