Detecting Traffic Snooping in Tor Using Decoys

Abstract

Abstract. Anonymous communication networks like Tor partially protect the confidentiality of their users' traffic by encrypting all intraoverlay communication. However, when the relayed traffic reaches the boundaries of the overlay network towards its actual destination, the original user traffic is inevitably exposed. At this point, unless end-toend encryption is used, sensitive user data can be snooped by a malicious or compromised exit node, or by any other rogue network entity on the path towards the actual destination. We explore the use of decoy traffic for the detection of traffic interception on anonymous proxying systems. Our approach is based on the injection of traffic that exposes bait credentials for decoy services that require user authentication. Our aim is to entice prospective eavesdroppers to access decoy accounts on servers under our control using the intercepted credentials. We have deployed our prototype implementation in the Tor network using decoy IMAP and SMTP servers. During the course of ten months, our system detected ten cases of traffic interception that involved ten different Tor exit nodes. We provide a detailed analysis of the detected incidents, discuss potential improvements to our system, and outline how our approach can be extended for the detection of HTTP session hijacking attacks.

Spoiled Onions: Exposing Malicious Tor Exit Relays

“…In 2011, Chakravarty et al [3] attempted to detect exit relays sniffing Tor users' traffic by systematically transmitting decoy credentials over all active exit relays. Over a period of ten months, the authors uncovered ten relays engaging in traffic snooping.…”

“…Our work is the first to give a comprehensive overview of active attacks. We further publish our code under a free license 3 . By doing so, we enable and encourage continuous and crowd-sourced measurements rather than one-time scans.…”

“…Often, relay operators choose to not forward traffic to well-known file sharing ports in order to avoid copyright infringement. 3 hope to discover and remove all "spoiled onions" which might be part of the Tor network.…”

Shedding Light on the Dark Corners of the Internet: A Survey of Tor Research

“…Using Decoy Traffic: Chakravarty et al [68] used decoy traffic on anonymous networks to detect traffic interception. The proposed strategy is based on the idea of injecting traffic containing bait credentials for decoy services requiring user authentication.…”

An Empirical Analysis of the Commercial VPN Ecosystem

“…One of these services is VPN Gate, an open and free service analyzed by Nobori et al [23]. Sporadic evidence so far has shown that traffic manipulation and monitoring also happens in other types of network relays, including open HTTP proxies [36] and even anonymity networks [5,43]. The work by Tsirantonakis et al studied header manipulation performed by over 65,000 open HTTP Proxies [36]: 5% of the tested proxies were found to perform malicious or unwanted modification.…”