CAT

The Correlation Attacks against Tor (CAT) research project

---

Project maintained by pylls Hosted on GitHub Pages — Theme by mattgraham

The CAT Project

This is the documentation for the Correlation Attacks against Tor (CAT) research project funded by the Internet Foundation in Sweden from fall 2018 until March 2019. The principal investigator is Tobias Pulls at Karlstad University.

The ultimate goal of the project is to contribute to figuring out how to effectively pad network traffic in Tor to better resist some types of traffic analysis attacks. We will contribute towards this goal by further investigating correlation attacks against Tor, a form of traffic analysis.

Traffic Analysis and Anonymity Networks

One type of attack on anonymity networks is so-called traffic analysis attacks where an attacker observes network traffic and based on observed non-content information—such as packet sizes, timing, communication patterns and volume—attempts to break the anonymity (or unlinkability) properties of the anonymity network. Traffic analysis has been around for a long time and in the context of anonymity networks it was a key motivation for their inception with the advent of mixes. We’re going to look at different types of attacks and attackers on anonymity networks based on how strong attackers are (i.e., their capabilities), starting with two extremes and then the grey zone in-between. While some selected papers will be cited, for a more complete list of relevant literature in the area, see Free Haven’s Selected Papers in Anonymity.

Strong Global Attackers

The strongest possible attacker on an anonymity network (in terms of observed network traffic) is a so-called Global Passive Adversary (GPA) that can passively observe all network traffic. (Note that attackers can be stronger than a GPA if we consider active attacks, compromise of network nodes, and computational power, but we exclude this for sake of brevity.) A GPA can perform so-called intersection or (statistical) disclosure attacks: based on the assumption that users are more likely to communicate with some (e.g, their friends) than others (i.e., they have a profile), over time, their profile can be determined by simply intersecting the anonymity sets observed by the GPA in each communication round. There are many many papers on these types of attacks see, e.g., Danezis original paper on statistical disclosure attacks or a more recent take by Perez-Gonzalez and Troncoso.

GPAs are very powerful as many attacks have shown, and a compelling recent result on the Anonymity Trilemma by Das et al. puts it clearly: against a GPA an anonymity network can pick two out of three: strong anonymity, low bandwidth overhead, or low latency. If you’re not that familiar with the design of Tor this might come as a surprise: a clearly stated goal (as part of the threat model) of Tor is to offer both low latency and low bandwidth overhead at the cost of strong anonymity. Tor is designed to protect against weaker attackers than GPAs, and exactly where to draw the line on how much weaker is an ongoing topic for discussion. In a gist, in my opinion the sentiment appears towards real-world practical attacks against high-risk users of Tor, as long as the defences have little to no overhead in terms of latency or bandwidth.

Weak Local Attackers

Significantly weak attackers in close proximity (in the geospatial sense) are squarely within the threat model of Tor. Here you find attackers such as operators of WiFi hotspots and attackers on the same LAN. While weak attackers they can observe the encrypted traffic from a client to the Tor network (guard relay) or the (potentially encrypted) connection from the Tor network (exit relay) to the destination. Since the security of of the connection between the Tor network and destination depends in large on the used transport security protocol like HTTPS, focus has been put on the connection between the client to the Tor network. In terms of mitigations, to name a few, most traffic is padded into 512 or 514 bytes (depending on version), encrypted in several layers, persistent connections are maintained to only a few Tor relays (guards), and extra padding is added for some specific types of attacks.

One relevant and debated type of attack that local attackers can perform are so-called Website Fingerprinting (WF) attacks, where an attacker analyses the encrypted traffic between client and guard relay with the goal of determining the websites visited over Tor by the client. (We wrote another more detailed high-level explanation of WF-attacks for a previous project if you want to read more.) It’s currently believed that in general WF-attacks are too inaccurate for most attackers in realistic settings, even for fingerprinting onion services (see, e.g., Juarez et al., Overdorf et al., and Jansen et al.). That said, it’s far from settled and more targetted use of WF-attacks might still be a real threat to some users. There is ongoing work to get some form of quickly tunable defence into Tor to be able to react as we learn more.

Attackers In-Between

If we make our attackers stronger we can start to consider Internet Service Providers (ISPs), Autonomous Systems (ASes), Internet Exchange Points (IXPs), and even nation state actors. Now we’re still within the threat model of Tor but with many nuances and considerations to take into account, which has been a topic of much research the last decade. Some selected examples:

• Murdoch and Zieliński present correlation attacks by attackers in control of IXPs and other more restricted attackers that observe some but not all traffic in and out of the Tor network. Their attack works by sampling a fraction of observed packets and calculating metrics on total packet counts and observed lengths.

• Chakravarty et al. show how NetFlow and related flow data commonly generated by routers could be used by an active attacker to deanonymize Tor users. To make this type of data less useful in attacks is the motivation behind one form of padding done in Tor.

• Instead of potentially being forced to sampling due to scaling constrains, Nasr et al. show how to efficiently perform traffic analysis on compressed traffic features, which may help powerful attackers deal with the staggering amount of observed traffic for correlation attacks.

• Johnson et al. show the expected time to first compromise (deanonymization of a connection) for different types of Tor users against correlation attacks with varying attacker capabilities (IXPs and ASes). Notably, time to compromise for most users is in the order of a few months even against a modest attacker. They show a direct relation between the fraction of bandwidth (of the entire Tor network) the attacker observes and time to compromise.

• As mentioned before, Tor is designed to be both low-latency and provide low bandwidth overhead. Mittal et al. show how bandwidth estimation of Tor relays can be used to attack Tor users. Similarly, Hopper et al. show how to use latency measurements to attack Tor users. Notable early related work is Murdoch and Danezis and Back et al.. In general, these measurements can be done by anyone, but needs to be combined with other attacks to augment them.

• Greschbach et al. showed how to combine and augment WF attacks with observed DNS traffic from Tor exits. During a six-months period 2015-2016 they showed that Google observed around one-third of all DNS traffic from Tor, and that DNS traffic traverses different network paths than “regular” HTTP(S) traffic, thus making more attackers capable of performing correlation attacks.

• Jansen et al. use WF attacks as a building block for an attacker to learn about onion service popularity when the attacker only controls middle relays. They targetted a popular social network’s onion service (presumably Facebook) and showed that the popularity is almost negligible compared to other onion service traffic, further indicating that WF attacks are too imprecise to target individual websites.

One pressing consideration for most of the works in this area is the impact of false positives, e.g., as aptly summarised by arma in a post on Tor’s blog. If attackers get overwhelmed with false positives in realistic settings, how relevant are really such attacks? The design of efficient and effective defences are closely tied to how we reason about attacks and their impact. This is the area we hope to contribute to in this project.