Refine
Document Type
Language
- English (14)
Keywords
- Onion routing (2)
- Privacy (2)
- Tor (2)
- Anonymity (1)
- Anonymous Communication (1)
- BGP routing attacks (1)
- DHT (1)
- Node lookup (1)
- Onion Routing (1)
- Traffic Analysis (1)
Institute
Users of an onion routing network, such as Tor, depend on its anonymity properties. However, especially malicious entry nodes, which know the client’s identity, can also observe the whole communication on their link to the client and, thus, conduct several de-anonymization attacks. To limit this exposure and to impede corresponding attacks, we propose to multipath traffic between the client and the middle node to reduce the information an attacker can obtain at a single vantage point. To facilitate the deployment, only clients and selected middle nodes need to implement our approach, which works transparently for the remaining legacy nodes. Furthermore, we let clients control the splitting strategy to prevent any external manipulation.
Security and Performance Implications of BGP Rerouting-resistant Guard Selection Algorithms for Tor
(2020)
Website fingerprinting (WFP) aims to infer information about the
content of encrypted and anonymized connections by observing
patterns of data flows based on the size and direction of packets. By
collecting traffic traces at a malicious Tor entry node — one of the
weakest adversaries in the attacker model of Tor — a passive eavesdropper can leverage the captured meta-data to reveal the websites visited by a Tor user. As recently shown, WFP is significantly more effective and realistic than assumed. Concurrently, former WFP defenses are either infeasible for deployment in real-world settings or defend against specific WFP attacks only.
To limit the exposure of Tor users to WFP, we propose novel
lightweight WFP defenses, TrafficSliver, which successfully counter
today’s WFP classifiers with reasonable bandwidth and latency
overheads and, thus, make them attractive candidates for adoption
in Tor. Through user-controlled splitting of traffic over multiple
Tor entry nodes, TrafficSliver limits the data a single entry node
can observe and distorts repeatable traffic patterns exploited by
WFP attacks.We first propose a network-layer defense, in which we
apply the concept of multipathing entirely within the Tor network.
We show that our network-layer defense reduces the accuracy from
more than 98% to less than 16% for all state-of-the-art WFP attacks
without adding any artificial delays or dummy traffic. We further
suggest an elegant client-side application-layer defense, which is
independent of the underlying anonymization network. By sending
single HTTP requests for different web objects over distinct Tor
entry nodes, our application-layer defense reduces the detection
rate of WFP classifiers by almost 50 percentage points. Although it
offers lower protection than our network-layer defense, it provides
a security boost at the cost of a very low implementation overhead and is fully compatible with today's Tor network.
Node discovery is a fundamental service for any overlay network, including anonymization networks. Although anonymization and node discovery are two disjoint services, the node discovery has a direct impact on the anonymization. Centralized methods require a trusted third party, limit the network scalability, and are vulnerable to intersection (statistical disclosure) attacks. Therefore, several distributed node discovery methods were proposed to meet the security requirements of anonymization networks through additional structures within Distributed Hash Tables (DHTs). However, they require a high management overhead, a strict cooperation between nodes, and are susceptible to active and passive attacks.We propose WhisperChord—an alternative distributed node discovery approach, which incorporates gossiping into structured overlays. WhisperChord is based on a Chord DHT and neither creates any additional structures within the DHT nor requires any trusted third party. Via simulations, we show that our method provides superior protection against active attacks than prior methods and can effectively thwart information leakages.
Node discovery is a fundamental service for any overlay network. It is a particular challenge to provide unbiased discovery in untrustworthy environments, e.g., anonymization networks. Although a major line of research focused on solving this problem, proposed methods have been shown to be vulnerable either to active attacks or to leak routing information, both threatening the anonymity of users. In response, we propose GuardedGossip—a novel gossip-based node discovery protocol—that achieves an unbiased random node discovery in a fully-decentralized and highly-scalable fashion. It is built on top of a Chord distributed hash table (DHT) and relies on witness nodes and bound checks to resist active attacks. To limit routing information leakages, GuardedGossip uses gossiping to create uncertainty in the process of node discovery. By incorporating the principles of DHTs with the unstructured nature of gossiping in a subtle way, we profit from the strengths of both techniques while carefully mitigating their shortcomings. We show that GuardedGossip provides a sufficient level of security for users even if 20% of the participating nodes are malicious. Concurrently, our system scales gracefully and provides an adequate overhead for its security and privacy benefits.
Security and Performance Implications of BGP Rerouting-resistant Guard Selection Algorithms for Tor
(2023)
Tor is the most popular anonymization network with millions of daily users. This makes it an attractive target for attacks, e.g., by malicious autonomous systems (ASs) performing active routing attacks to become man in the middle and deanonymize users. It was shown that the number of such malicious ASs is significantly larger than previously expected due to the lack of security guarantees in the Border Gateway Protocol (BGP). In response, recent works suggest alternative Tor path selection methods preferring Tor nodes with higher resilience to active BGP attacks.
In this work, we analyze the implications of such proposals and demonstrate that two state-of-the-art path selection methods, namely Counter-RAPTOR and DPSelect, are not as secure as thought before. First, we show that DPSelect achieves only one third of its originally claimed resilience and, thus, is not as resilient as widely accepted. Second, we reveal that the resilience to active BGP attacks on the way back, i.e., from the first anonymization node to a given Tor user, provided by both methods is significantly lower than on the forward path. Beside their lower resilience in specific cases, we show that for particular users the usage of Counter-RAPTOR and DPSelect also leads to leakage of user’s location. Furthermore, we uncover the performance implications of both methods and identify scenarios where their usage leads to significant performance bottlenecks. Finally, we propose a new metric to quantify the user’s location leakage by path selection. Using this metric and performing large-scale analysis, we show to which extent a malicious Tor middle node can fingerprint the user’s location and the confidence it can achieve. Our findings shed light on the implications of path selection methods on the users’ anonymity and the need for further research.
Website fingerprinting (WFP) is a special type of traffic analysis, which aims to infer the websites visited by a user. Recent studies have shown that WFP targeting Tor users is notably more effective than previously expected. Concurrently, state-of-the-art defenses have been proven to be less effective. In response, we present a novel WFP defense that splits traffic over multiple entry nodes to limit the data a single malicious entry can use. Here, we explore several traffic-splitting strategies to distribute user traffic. We establish that our weighted random strategy dramatically reduces the accuracy from nearly 95% to less than 35% for four state-of-the-art WFP attacks without adding any artificial delays or dummy traffic.