Shining Light in Dark Places: Understanding the Tor Network

McCoy, Damon; Bauer, Kevin; Grunwald, Dirk; Kohno, Tadayoshi; Sicker, Douglas

doi:10.1007/978-3-540-70630-4_5

Cited by 208 publications

(193 citation statements)

References 5 publications

Supporting

Mentioning

174

Contrasting

Unclassified

Order By: Relevance

“…We do not know the exact percentage that is acceptable for use in Tor, but we note the following points. First, approximately 40% of Tor traffic is bulk downloads (from 2008, the last data we know of) [14]. To the extent that this holds today, only the remaining 60% of traffic needs to be covered by this defense.…”

Section: Discussion and Future Workmentioning

confidence: 99%

Toward an Efficient Website Fingerprinting Defense

Juárez

Imani

Perry

et al. 2016

Lecture Notes in Computer Science

185

175

View full text Add to dashboard Cite

Abstract. Website Fingerprinting attacks enable a passive eavesdropper to recover the user's otherwise anonymized web browsing activity by matching the observed traffic with prerecorded web traffic templates. The defenses that have been proposed to counter these attacks are impractical for deployment in real-world systems due to their high cost in terms of added delay and bandwidth overhead. Further, these defenses have been designed to counter attacks that, despite their high success rates, have been criticized for assuming unrealistic attack conditions in the evaluation setting. In this paper, we propose a novel, lightweight defense based on Adaptive Padding that provides a sufficient level of security against website fingerprinting, particularly in realistic evaluation conditions. In a closed-world setting, this defense reduces the accuracy of the state-ofthe-art attack from 91% to 20%, while introducing zero latency overhead and less than 60% bandwidth overhead. In an open-world, the attack precision is just 1% and drops further as the number of sites grows.

show abstract

Section: Discussion and Future Workmentioning

confidence: 99%

Toward an Efficient Website Fingerprinting Defense

Juárez

Imani

Perry

et al. 2016

Lecture Notes in Computer Science

185

175

View full text Add to dashboard Cite

show abstract

“…McCoy et al [3] proposed to use reverse DNS lookups in order to detect exit servers that run packet analyzer software with a host resolution feature. A complete passively adversary is almost undetectable.…”

Section: Countermeasures and Discussionmentioning

confidence: 99%

“…Urlsnarf sniffs HTTP traffic and is able to format it in CLF (Common Log Format), which is a format commonly used by webservers. Compared to other experiments [3] our server was advertising less bandwidth to represent an average node and not to bias the client's Tor path selection algorithm towards our node; only HTTP traffic was allowed in our exit policy. The collection period was from December 2009 till January 2010 with 9 x 10 6 HTTP requests in total resulteding in a logfile of 2.5 gigabytes.…”

Section: Tor Http Sniffing -Ethics and Methodologymentioning

confidence: 99%

“…The security of the Tor network relies on the fact that instead of a single point or entity a user has to trust (for example by using an open proxy server or a dubious VPN service); the trust is distributed among the three Tor relays in a path. Previous research about the usage of Tor has been conducted in the beginning of 2008 [3]: by running a high bandwidth Tor relay and inspecting the communication content it was found that the majority of connections leaving Tor was created by HTTP traffic, in total more than 90 %. However, a disproportional part of the transferred data was caused by BitTorrent, a common file sharing protocol.…”

Section: Tor Security and Threat Modelmentioning

confidence: 99%

“…McCoy et al [3] published a first investigation into how Tor is being used by its end-users. They found that the majority of connections leaving the Tor network are caused by the hypertext transfer protocol (HTTP).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Tor HTTP Usage and Information Leakage

Huber

Mulazzani

Weippl

2010

Communications and Multimedia Security

View full text Add to dashboard Cite

Abstract. This paper analyzes the web browsing behaviour of Tor users. By collecting HTTP requests we show which websites are of interest to Tor users and we determined an upper bound on how vulnerable Tor users are to sophisticated de-anonymization attacks: up to 78 % of the Tor users do not use Tor as suggested by the Tor community, namely to browse the web with TorButton. They could thus fall victim to deanonymization attacks by merely browsing the web. Around 1% of the requests could be used by an adversary for exploit piggybacking on vulnerable file formats. Another 7 % of all requests were generated by social networking sites which leak plenty of sensitive and identifying information. Due to the design of HTTP and Tor, we argue that HTTPS is currently the only effective countermeasure against de-anonymization and information leakage for HTTP over Tor.

show abstract

Breaking Tor anonymity with game theory and data mining

Wagner

Wagener²,

State

et al. 2011

Concurrency and Computation

View full text Add to dashboard Cite

SUMMARY Attacking anonymous communication networks is very tempting, and many types of attacks have already been observed. In the case for Tor, a widely used anonymous overlay network is considered. Despite the deployment of several protection mechanisms, an attack originated by just one rogue exit node is proposed. The attack is composed of two elements. The first is an active tag injection scheme. The malicious exit node injects image tags into all HTTP replies, which will be cached for upcoming requests and allow different users to be distinguished. The second element is an inference attack that leverages a semi‐supervised learning algorithm to reconstruct browsing sessions. Captured traffic flows are clustered into sessions, such that one session is most probably associated to a specific user. The clustering algorithm uses HTTP headers and logical dependencies encountered in a browsing session. A prototype has been implemented and its performance evaluated on the Tor network. The article also describes several countermeasures and advanced attacks, modeled in a game theoretical framework, and their effectiveness assessed with reference to the Nash equilibrium. Copyright © 2011 John Wiley & Sons, Ltd.

show abstract

Shining Light in Dark Places: Understanding the Tor Network

Cited by 208 publications

References 5 publications

Toward an Efficient Website Fingerprinting Defense

Toward an Efficient Website Fingerprinting Defense

Tor HTTP Usage and Information Leakage

Breaking Tor anonymity with game theory and data mining

Contact Info

Product

Resources

About