A Preliminary Look at the Privacy of SSH Tunnels

Dusi, Maurizio; Gringoli, Francesco; Salgarelli, Luca

doi:10.1109/icccn.2008.ecp.122

Cited by 18 publications

(21 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our previous work [8] we reported on a preliminary SSH channel model that can be used to help inferring the application layer protocol that is being encrypted over an SSH tunnel. The effectiveness of the technique was evaluated on clear-text flows previously captured from real links and "artificially" encrypted through the model.…”

Section: Related Workmentioning

confidence: 99%

A Model for the Study of Privacy Issues in Secure Shell Connections

Dusi¹,

Gringoli²,

Salgarelli³

2008

2008 the Fourth International Conference on Information Assurance and Security

View full text Add to dashboard Cite

The Secure Shell protocol strives to protect the privacy of its users in several ways. On one hand, the strong encryption and authentication algorithms that it adopts provide guarantees that the data exchanged between two SSH endpoints remain private to third parties. On the other hand, the type of traffic that each SSH channel transports, such as e-mail, remote shell activity, etc., is also supposed to be hidden from any observer that does not possess the necessary keys. This paper introduces a simple but accurate model of the SSH channel which can be used to study the level of privacy that SSH-protected traffic can achieve with respect to the users' activities. We think that the model can facilitate several types of projects. For example, network managers can detect traffic anomalies hidden by SSH connections more easily by relying on the output of our model. Another example, which we present in this paper, is the use of this model to derive accurate fingerprints of the type of applications run through an SSH channel by simply starting from the statistics of captured clear-text traffic. Such fingerprints can then be used to detect what type of activity, i.e., what type of traffic, is going on within an SSH channel, thereby breaking user privacy.

show abstract

Section: Related Workmentioning

confidence: 99%

A Model for the Study of Privacy Issues in Secure Shell Connections

Dusi¹,

Gringoli²,

Salgarelli³

2008

2008 the Fourth International Conference on Information Assurance and Security

View full text Add to dashboard Cite

show abstract

“…Later in this article, we will illustrate how flow separation yields representations of flows that highly correlate to the ex isting flows. This allows the classification mechanisms described by Dusi et al [2008] to be applied effectively on aggregates of tunneled flows.…”

Section: Flow Separation Attack On Wired Anonymous Communication Netwmentioning

confidence: 99%

“…As a practical example, Dusi et al [2008] describe the difficulty of classifying traffic over SSH tunnels when multiple flows are multiplexed over the same tunnel. Later in this article, we will illustrate how flow separation yields representations of flows that highly correlate to the ex isting flows.…”

Section: Flow Separation Attack On Wired Anonymous Communication Netwmentioning

confidence: 99%

“…The separation of the flows through the mix can recover the traffic pattern of individual flows or small groups thereof. This fine-granularity information can be used to increase the effectiveness of further analysis, such as the frequency spectrum matching attack described in Section 4.2.2 or the time domain cross-correlation attack [Levine et al 2004] for flow reconstruction, or application characterization over encrypted tunnels [Dusi et al 2008], or other flow confidentiality situations. In this article, we are interested in the traffic pattern carried in the time se ries of packet counts during a sequence of identical-length intervals of length T .…”

Section: Flow Separation As a Bss Problemmentioning

confidence: 99%

See 1 more Smart Citation

Compromising anonymous communication systems using blind source separation

Zhu

Bettati

2009

ACM Trans. Inf. Syst. Secur.

View full text Add to dashboard Cite

We propose a class of anonymity attacks to both wired and wireless anonymity networks. These attacks are based on the blind source separation algorithms widely used to recover individual signals from mixtures of signals in statistical signal processing. Since the philosophy behind the design of current anonymity networks is to mix traffic or to hide in crowds, the proposed anonymity attacks are very effective. The flow separation attack proposed for wired anonymity networks can separate the traffic in a mix network. Our experiments show that this attack is effective and scalable. By combining the flow separation method with frequency spectrum matching, a passive attacker can derive the traffic map of the mix network. We use a nontrivial network to show that the combined attack works. The proposed anonymity attacks for wireless networks can identify nodes in fully anonymized wireless networks using collections of very simple sensors. Based on a time series of counts of anonymous packets provided by the sensors, we estimate the number of nodes with the use of principal component analysis. We then proceed to separate the collected packet data into traffic flows that, with help of the spatial diversity in the available sensors, can be used to estimate the location of the wireless nodes. Our simulation experiments indicate that the estimators show high accuracy and high confidence for anonymized TCP traffic. Additional experiments indicate that the estimators perform very well in anonymous wireless networks that use traffic padding.

show abstract

“…vi. SSH Tunnel or Port-Redirector: (Dusi 2008) A Tunnel in Internet means a secure data path through an un-trusted network. Depending upon the software and techniques used, tunneling can be accomplished through many ways.…”

Section: Need For E-mail Forensic Investigationmentioning

confidence: 99%

Technology Corner: Analysing E-Mail Headers for Forensic Investigation

Banday¹

2011

JDFSL

View full text Add to dashboard Cite

Electronic Mail (E-Mail), which is one of the most widely used applications of Internet, has become a global communication infrastructure service. However, security loopholes in it enable cybercriminals to misuse it by forging its headers or by sending it anonymously for illegitimate purposes, leading to e-mail forgeries. E-mail messages include transit handling envelope and trace information in the form of structured fields which are not stripped after messages are delivered, leaving a detailed record of e-mail transactions. A detailed header analysis can be used to map the networks traversed by messages, including information on the messaging software and patching policies of clients and gateways, etc. Cyber forensic e-mail analysis is employed to collect credible evidence to bring criminals to justice. This paper projects the need for e-mail forensic investigation and lists various methods and tools used for its realization. A detailed header analysis of a multiple tactic spoofed e-mail message is carried out in this paper. It also discusses various possibilities for detection of spoofed headers and identification of its originator. Further, difficulties that may be faced by investigators during forensic investigation of an e-mail message have been discussed along with their possible solutions.

show abstract

A Preliminary Look at the Privacy of SSH Tunnels

Cited by 18 publications

References 7 publications

A Model for the Study of Privacy Issues in Secure Shell Connections

A Model for the Study of Privacy Issues in Secure Shell Connections

Compromising anonymous communication systems using blind source separation

Technology Corner: Analysing E-Mail Headers for Forensic Investigation

Contact Info

Product

Resources

About