4 ms·
Relays haven't increased correspondingly, so it's not a straightforward correlation attack. Here's a list of hypotheses: 1. The recent Russian censorship crac
by s_q_b 13y ago
Relays haven't increased correspondingly, so it's not a straightforward correlation attack.
Here's a list of hypotheses:
1. The recent Russian censorship crackdown.
2. Botnets using Tor to search for vulnerable systems and to hide the C&C server.
3. US publicity following the recent NSA news events.
4. The Pirate Browser's use of Tor.
5. An OP (client) based vulnerability in the network.
If you have upstream collection on the backbones, then you might be able to fingerprint hidden services with staggered connection floods (watermarking.) Also, you may be able to do stream watermarking on the OP->Hidden Service traffic through the Tor cell delay side channel. That seems very possible.
Edit: Another possibility just occurred to me. You could use the OP clients to overload the relays you don't control, driving traffic to the attacker's hostile relays.
Something in my gut says that's not right though... Mostly because this is so very amateurish, with no slow ramp up of nodes, etc. Then again, the Freedom Host takedown wasn't exactly a model of subtlety either.
Botnets have started to use Tor in a major way for C&C. Of all the above, (2) seems most likely.
If someone really wants to find out, stand up a couple exit nodes on EC2 and watch the exit traffic pcap. That might be a bit dodgy in light of ECPA, but after all it's just metadata, right? ;)
- praptak 13y ago> If someone really wants to find out, stand up a couple exit nodes on EC2 and watch the exit traffic pcap. Ideally it would be someone who has had such set up from before the spike, so that there is a baseline for computing the increase. Also, an arbitrary set of exit nodes is obviously not guaranteed to capture the spike. In fact there might be no spike at all in exit traffic (quote:) "So while there are a bunch of new Tor clients running, it would seem they're not doing much."
- s_q_b 13y agoSo while there are a bunch of new Tor clients running, it would seem they're not doing much. Huh, didn't notice that. Should have seen it from the network bandwidth graph. It's even more odd in some ways than the OP spike. I've got a fairly good understanding of the mechanics of the Tor network having studied it down to the packet level, modified the source for academic experiments, etc. I can't think of any reason that would compromise anonymity where it would help to have a whole bunch of mostly idle OPs idling on the network. Maybe a botnet C&C with low bandwidth staggered command orders, or maybe it's infrastructure building for something that hasn't been activated yet. Or of course the more mundane explanation that lots of people downloaded the clients after the recent publicity, and don't really use the browser bundles.