Investigating Interdomain Routing Policies in the Wild

Anwar, Ruwaifa; Niaz, Haseeb; Choffnes, David; Cunha, Ítalo; Gill, Peter; Katz-Bassett, Ethan

doi:10.1145/2815675.2815712

Cited by 66 publications

(72 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Despite all this, accurate path prediction remains an open challenge. In a related study, we validate the accuracy of this approach and find that measured paths follow this model 65-85% of the time [10]. As a result, the numbers we observe should be taken as an estimate of the threat.…”

Section: B Improving Path-prediction Accuracysupporting

confidence: 53%

“…In addition, we also include the possibility that some sets of ASes may collude with each other to de-anonymize Tor users. Specifically, we consider that an AS may collude with sibling ASes [10] (i.e., other ASes owned by the same organization) and ASes that may collude with each other on behalf of a state-level adversary. Finally, as part of our relay selection algorithms (Section IV), we consider a probabilistic relay selection strategy that minimizes the amount of traffic that is observable by any single attacker over a period of time.…”

Section: Adversary Modelmentioning

confidence: 99%

“…AS-level path prediction between a source and destination is a thorny issue, for example the recent work from Juen, et al [26] shows that the paths predicted by BGP-based path prediction vary significantly from traceroute-based path prediction. However, our BGP-based path prediction toolkit makes use of the state-of-the-art in path inference and ASrelationship inference that have both been extensively validated with empirical measurements by Anwar et al [10] and Giotsas et al [23].…”

Section: A Predicting Potential Attacker Asesmentioning

confidence: 99%

See 2 more Smart Citations

Measuring and Mitigating AS-level Adversaries Against Tor

Nithyanand

Starov

Zair

et al. 2016

Proceedings 2016 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

The popularity of Tor as an anonymity system has made it a popular target for a variety of attacks. We focus on traffic correlation attacks, which are no longer solely in the realm of academic research with recent revelations about the NSA and GCHQ actively working to implement them in practice.Our first contribution is an empirical study that allows us to gain a high fidelity snapshot of the threat of traffic correlation attacks in the wild. We find that up to 40% of all circuits created by Tor are vulnerable to attacks by traffic correlation from Autonomous System (AS)-level adversaries, 42% from colluding AS-level adversaries, and 85% from statelevel adversaries. In addition, we find that in some regions (notably, China and Iran) there exist many cases where over 95% of all possible circuits are vulnerable to correlation attacks, emphasizing the need for AS-aware relay-selection.To mitigate the threat of such attacks, we build Astoria-an AS-aware Tor client. Astoria leverages recent developments in network measurement to perform path-prediction and intelligent relay selection. Astoria reduces the number of vulnerable circuits to 2% against AS-level adversaries, under 5% against colluding AS-level adversaries, and 25% against state-level adversaries. In addition, Astoria load balances across the Tor network so as to not overload any set of relays.

show abstract

Section: B Improving Path-prediction Accuracysupporting

confidence: 53%

Section: Adversary Modelmentioning

confidence: 99%

Section: A Predicting Potential Attacker Asesmentioning

confidence: 99%

See 1 more Smart Citation

Measuring and Mitigating AS-level Adversaries Against Tor

Nithyanand

Starov

Zair

et al. 2016

Proceedings 2016 Network and Distributed System Security Symposium

Self Cite

View full text Add to dashboard Cite

show abstract

“…Since ASes typically are in control of the routers within an AS, it also provides some insight into the information that foreign networks could potentially gain, regardless of the location of the forwarding routers. While the accuracy of the absolute values presented still depends on the accuracy of the IP-to-AS mappings provided by the Cymru database and public IP-to-AS mappings have their shortcomings [17], [18], we note that similar mappings have successfully been used to answer many AS topology related questions [19], [20], identify complex AS relationships [21], and even interdomain routing questions [22].…”

Section: A Limitationsmentioning

confidence: 94%

“…RELATED WORK HTTPS and routing has typically been studied separately. Various traceroute-and BGP-based tools and methods have been used to understand Internet routes [22], [30]. While there are many legitimate reasons why announced AS paths (observed from BGP data) may differ from the actual data paths (observed using traceroute) [30], differences can also be used to understand interception attacks [31].…”

Section: Weak Keysmentioning

confidence: 99%

The hidden mailman and his mailbag: Routing path analysis from a European perspective

Gustafsson

Hiran

Krishnamoorthi

et al. 2017

2017 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Abstract-The postal system is often used as an analogy when describing Internet routing. However, in addition to similarities, there are some significant differences. First, and most importantly, the Autonomous Systems (ASes) that operate the routers along the end-to-end path of a packet can often inspect and manipulate the packet and its content. Second, due to lack of secure routing mechanisms, packet paths can be diverted through additional non-trusted ASes. Although we often know the first network we connect through and the service that we access, we seldom know the networks that forward our packets. We can think of these networks as hidden mailmen. To better understand these networks and their potential access to information, we characterize the ASes along the paths of typical Internet packets between European example clients and the most popular web domains. We also identify ASes and countries with higher path coverage and investigate if there are differences in the HTTPS usage among paths that may take additional detours. Our results highlight the role played by North American (typically US-based) ASes and glean insights into how vulnerable the detoured traffic is to man-in-the-middle attacks compared to regular traffic.

show abstract