Defending Tor from Network Adversaries: A Case Study of Network Path Prediction

Abstract

Abstract:The Tor anonymity network has been shown vulnerable to traffic analysis attacks by autonomous systems (ASes) and Internet exchanges (IXes), which can observe different overlay hops belonging to the same circuit. We evaluate whether network path prediction techniques provide an accurate picture of the threat from such adversaries, and whether they can be used to avoid this threat. We perform a measurement study by collecting 17.2 million traceroutes from Tor relays to destinations around the Internet. We compare the collected traceroute paths to predicted paths using state-of-the-art path inference techniques. We find that traceroutes present a very different picture, with the set of ASes seen in the traceroute path differing from the predicted path 80% of the time. We also consider the impact that prediction errors have on Tor security. Using a simulator to choose paths over a week, our traceroutes indicate a user has nearly a 100% chance of at least one compromise in a week with 11% of total paths containing an AS compromise and less than 1% containing an IX compromise when using default Tor selection. We find modifying the path selection to choose paths predicted to be safe lowers total paths with an AS compromise to 0.14% but still presents a 5-11% chance of at least one compromise in a week while making 5% of paths fail, with 96% of failures due to false positives in path inferences. Our results demonstrate more measurement and better path prediction is necessary to mitigate the risk of AS and IX adversaries to Tor.

Systematizing Decentralization and Privacy: Lessons from 15 Years of Research and Deployments

“…Once routing alternatives are known the question remains: Which route to choose? Thus typically, a centralized server is considered that can "rank" routing options to allow for path optimization with respect to adversaries [2,12,61,86], performance [143,144,159], or with respect to users' reputation [165]. Such a centralized ranking approach has been shown to be vulnerable to attacks [14,22].…”

DeNASA: Destination-Naive AS-Awareness in Anonymous Communications

“…Similar to several prior works [11,20,21], we use Qiu and Gao's method for AS-level path inference [27]. Comparably to the recent work of Starov et al, we assume that adversaries can perform asymmetric traffic analysis attacks to deanonymize users.…”

“…The accuracy of Qiu and Gao AS-level path inference with regards to assessing Tor has been recently questioned by Juen et al [21]. They find that only 20% of inferred paths match paths acquired from traceroute measurements and that Qiu and Gao path inference significantly overestimates the number of ASes traversed by Tor traffic.…”

“…Another method is to infer the ASlevel path using traceroute measurements [23]. Recently, Juen et al found that Qiu and Gao AS-level path inference significantly overestimates the number of ASes traversed by Tor traffic; thus, this method directly is not suitable for predicting or mitigating the risk of AS-level adversaries to Tor [21].…”

Measuring and Mitigating AS-level Adversaries Against Tor

“…We use the routing policies and algorithmic simulations [22] as described above to compute routes between pairs of ASes using the AS-level topology published by CAIDA [23]. AS-level path prediction between a source and destination is a thorny issue, for example the recent work from Juen, et al [26] shows that the paths predicted by BGP-based path prediction vary significantly from traceroute-based path prediction. However, our BGP-based path prediction toolkit makes use of the state-of-the-art in path inference and ASrelationship inference that have both been extensively validated with empirical measurements by Anwar et al [10] and Giotsas et al [23].…”