3 ms·
This is an easier version of a traffic analysis attack, an attack that Tor expressly does not attempt to provide a strong defense against. It relies on a malic
by tedks 12y ago
This is an easier version of a traffic analysis attack, an attack that Tor expressly does not attempt to provide a strong defense against.
It relies on a malicious server and entry node. The contribution of this paper is that if you have the malicious server and entry node, you can use a less expensive data source (Cisco NetFlow data) rather than raw packets to perform a correlation attack.
The correlation they achieve in a private Tor network is impressive; however, if you look at the graphs in the actual paper[0], you can see that the differences in correlations are actually quite small in the wild.
The title of this post and article is actually incorrect; the technique demonstrated has an 81.4% accuracy. This means that the base rate fallacy will make it nearly unusable in practice, and more so as the scale of Tor traffic grows. For more on the Base Rate Fallacy, see [1].
So in summary:
* This is an incremental improvement of an already existing and known attack pattern on low-latency anonymity systems
* The technique presented in this paper is only a threat if your threat model is an adversary that can control your entry guard and the server you are trying to communicate with, but does not have the budget for packet-level correlation attacks
* This technique does not achieve sufficiently high accuracy and sufficiently low false positives to reliably identify arbitrary Tor users, but might be more successful if used in combination with a prior hypothesis that, say, a specific NSA employee is communicating with GlobalLeaks.
[0] https://mice.cs.columbia.edu/getTechreport.php?techreportID=1545&format=pdf https://mice.cs.columbia.edu/getTechreport.php?techreportID=...
[1] http://archives.seul.org/or/dev/Sep-2008/msg00016.html http://archives.seul.org/or/dev/Sep-2008/msg00016.html
- Tepix 12y agoDo they really need to control the entry guard? Or is it "good enough" for this attack if they merely have access to the netflow data?
- tedks 12y agoThey need to be able to access netflow data at the entry point. To put it another way, let's say someone is posting bomb threats over Tor on Google Plus. Google cooperates with the FBI and deterministically perturbs all traffic going into the Tor network. What router does the FBI get netflow data from in order to find the bomber?
- rsync 12y agoCan't the Tor network introduce random perturbations into the traffic flow at every hop, thus defeating this kind of fingerprinting ? I know that it does not do this, but couldn't it ?
- ufo 12y agoFrom what I understood in the OP, Top doesn't add that kind of noise to keep latency down (latency is already high due to the extra hops and would get even worse if you added perturbations)
- tptacek 12y agoYou should be aware that every tier 1 ISP already collects, aggregates, and stores NetFlow, which means they have archives of historical data (though probably not raw flow archives, though it would be possible to do that for "anomalous" traffic --- meaning, not port 80) and, more importantly, the capability to very easily enable filtered high-fidelity collection from most points on their network with very few keystrokes. You can thank DDOS trolls for that, I guess, because that's why the ISPs paid to build that out.
- belorn 12y agoTor can today already use port 80 for all it traffic by using the FascistFirewall setting. If tier 1 ISP differentiate traffic on port level, then switching that setting on should bypass the filter.
- tptacek 12y agoI hope you understood what I was saying. I wasn't saying ISPs are limited to monitoring non-port-80 traffic. They can most certainly do sophisticated monitoring of "HTTP" traffic as well. All I was saying is that it was unlikely that most ISPs had high-fidelity raw flow archives for all traffic, but possible they they might already have them for non-port-80 traffic. Hiding in port 80 will protect you not-at-all from traffic analysis, and all the major ISPs already have the infrastructure to deploy traffic analysis.