Website fingerprinting

Abstract

Privacy enhancing technologies like OpenSSL, OpenVPN or Tor establish an encrypted tunnel that enables users to hide content and addresses of requested websites from external observers This protection is endangered by local traffic analysis attacks that allow an external, passive attacker between the PET system and the user to uncover the identity of the requested sites. However, existing proposals for such attacks are not practicable yet.We present a novel method that applies common text mining techniques to the normalised frequency distribution of observable IP packet sizes. Our classifier correctly identifies up to 97 % of requests on a sample of 775 sites and over 300,000 real-world traffic dumps recorded over a two-month period. It outperforms previously known methods like Jaccard's classifier and Naïve Bayes that neglect packet frequencies altogether or rely on absolute frequency values, respectively. Our method is system-agnostic: it can be used against any PET without alteration. Closed-world results indicate that many popular single-hop and even multi-hop systems like Tor and JonDonym are vulnerable against this general fingerprinting attack. Furthermore, we discuss important real-world issues, namely false alarms and the influence of the browser cache on accuracy.

Website Detection Using Remote Traffic Analysis

“…If the training and test data are both collected from the same location, a much larger fraction of sites can be accurately detected with low error rates. We find that despite working with a much noisier information source than previous web fingerprinting work [2,11,17], our website detection attack nevertheless shows that remote traffic analysis is a serious threat to Internet privacy.…”

“…Recent research has shown that traffic analysis applied to network communications can be used to compromise users' secrecy and privacy. By using packet sizes, timings, and counts, it is possible to fingerprint websites visited over an encrypted tunnel [2,4,11,17], infer keystrokes sent over a secure interactive connection [27,34] and even detect phrases in VoIP sessions [31][32][33]. These attacks have been explored in the context of a local adversary who can observe the target traffic directly on a shared network link or can monitor a wireless network from a nearby vantage point [25].…”

“…To demonstrate the feasibility of using remote traffic analysis for real malicious attack to learn sensitive information, we adapt the website fingerprinting attack [2,11,17], previously targeted at local victims, to a new scenario and introduce a remote website detection attack. Our attack can find out when a victim user under observation visits a particular target site without directly monitoring the user's traffic.…”

Leveraging USB to Establish Host Identity Using Commodity Devices

“…Fingerprinting has become a popular method for device identification, and has been used to identify home electronics [38], websites [39], [40], [41], [42], [43], [44], the operating system of VMs [45], [46], and the source of phone calls [47]. The concept of fingerprinting stems from leveraging measurable signals caused by hardware imperfections in analog circuitry to uniquely identify devices.…”

StegoTorus

“…This naturally makes the task more difficult because Tor introduces two defenses [24]: combining all network traffic into one TCP stream to the first Tor router, and padding each packet to a fixed size (or a small set of sizes). Herrmann et al [35] use a multinomial naïve Bayes classifier on the histogram of packet sizes and directions successfully against VPN technologies and OpenSSH, but they achieve under 3% accuracy against Tor while classifying on a set of 775 web sites. The work of Panchenko et al [57], however, demonstrates that these defenses are not enough.…”