5 ms·
That's broadly describing one possible class of attack. It looks more like a combination of attacks may have been used - traffic confirmation via timing of outa
by AlyssaRowan 12y ago
That's broadly describing one possible class of attack. It looks more like a combination of attacks may have been used - traffic confirmation via timing of outages and packets is definitely a strong one, and that's what GCHQ's QUICKANT was gunning for; ONIONBREATH was targeted at hidden service enumeration and distinguishability, and Tor is seemingly not perfect at that. (I gather HSes were due for an overhaul anyway?)
Remember, Tor cannot comprehensively protect against a global passive attacker - which is what GCHQ, DSD, NSA, et al are trying to be, as well as every other kind of attacker of course. (Generally speaking, they try every possible angle at once.)
However, they have still not had much success to date identifying users, especially en masse. We're talking here about highly-targeted attacks, combined with a few OPSEC fails.
(I still prefer garlic routing in general, but Tor has a huge advantage which has little to do with tech - a massive, diverse userbase to hide amongst.)
- s_q_b 12y agoI've studied Tor vulnerabilities for two years. I'm seeing signs of traffic confirmation (active), traffic confirmation (passive), stream watermarking, and a massive willingness to shape control of the network with DoS. Just about every attack on hidden services (active and passive), of which I am aware, was deployed, all at once. The malformed packet DoS was especially clever. And I'm sure a ton more were used that never made it to the academic research. It was almost comical, like the star ship captain saying "now on my mark, fire all photon torpedoes!" They just revealed a massive amount of capability to send a message: Tor is not safe. They want everyone to know that despite that sticker on Snowden's laptop, Tor remains vulnerable. But what remains interesting, and glaringly obviously absent, is user identification. The NSA does not appear to be able to deanonymize users at will. That is, given enough time and enough resources, they can ID hidden services and long-term users, but given an arbitrary Tor exit and and TCP stream, they can't simply follow it back to its origin. A for effort. But in organizaton it looks like a military campaign, not a cyber attack. Straight out of the "total dominance" playbook. But of course it won't work. Tor isn't a country. Its an idea. You can't force the Internet to "submit." All this did was make blindingly obvious holes that many researchers have been asking to be fixed for a while.
- jared314 12y ago> But what remains interesting, and glaringly obviously absent, is user identification. I wonder if using Facebook over Tor would help in that regard. https://www.facebook.com/notes/protect-the-graph/making-connections-to-facebook-more-secure/1526085754298237 https://www.facebook.com/notes/protect-the-graph/making-conn...
- why-el 12y agoThis is very interesting. Are you suggesting that Facebook over Tor could be a step in the wrong direction? Official NSA Facebook partnerships are for now very unlikely, but I am interested to know how Facebook over Tor could in principle solve the user identification problem listed by grand parent.
- xorcist 12y agoPlease correct me if I'm wrong, but if someone is logged in to Facebook while browsing over Tor, aren't you just one CSRF from getting all personal details for the user?
- s_q_b 12y agoYou're corrrect. Fast Tor user attribution is a different, much harder problem, and one they don't appesr to have cracked.
- cbhl 12y agoIf you're using Facebook over Tor, you probably shouldn't be using an account that you created on an non-Tor connection or an account tied to your real-world identity. If you are, and you're concerned about being identified... :/
- psykovsky 12y agoI don't think Facebook will let you register new accounts using a Tor IP.