Guard Placement Attacks on Path Selection Algorithms for Tor

Wan, Gerry; Johnson, Aaron M.; Wails, Ryan; Wagh, Sameer; Mittal, Prateek

doi:10.2478/popets-2019-0069

Cited by 17 publications

(11 citation statements)

References 41 publications

(80 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Compatibility with security-focused path selection: ShorTor is also fully compatible with any modifications to Tor's path selection algorithm. Prior work has shown that existing proposals, overviewed briefly in Section VI, suffer from poor load balancing and non-uniform client behavior, hurting performance and client anonymity [12,14,36,60,61,74,85,86]. However, this does not preclude some future path selection proposal from improving upon Tor's current algorithm.…”

Section: Discussionmentioning

confidence: 99%

“…We quantify this advantage using MATOR by applying ShorTor to LASTor [5], a location-biased path-selection proposal. We emphasize that LASTor is not integrated in Tor and has known security flaws [86]-we include it as an illustrative example of a location-aware path selection scheme.…”

Section: B Differential Advantagementioning

confidence: 99%

“…There is additionally a large body of work that alters path selection in Tor for purposes of security [13,15,30,40,48,64,73,82,89]. While important, these works are orthogonal to ShorTor and often result in substantially degraded performance [61,74] without clear security advantages over Tor's current protocol [36,85,86].…”

Section: Related Workmentioning

confidence: 99%

“…CLAPS (CLient Aware Path Selection) [74] solves a weight-optimization problem to ensure a strict bound on anonymity degradation when selecting location-biased circuits. There additionally exists a large body of work on the security implications of location awareness in path selection as this can make Tor clients more identifiable by creating a correlation between their geographic location and the relays chosen for their circuit [12,14,36,60,61,74,85,86]. As shown in Section V, ShorTor does not share this problem and is able to reduce latency for Tor clients without the security pitfalls of location-aware circuit selection techniques.…”

Section: Related Workmentioning

confidence: 99%

“…Unfortunately, preferentially choosing circuits in this way also selects relays that are correlated with the identity of the user or their destination [12,14,60]. Many attacks show how this can be exploited to deanonymize Tor users, allowing a passive observer to identify information about user locations [12,14,36,60,61,74,85,86].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

ShorTor: Improving Tor Network Latency via Multi-hop Overlay Routing

Hogan¹,

Servan-Schreiber²,

Newman³

et al. 2022

Preprint

View full text Add to dashboard Cite

We present ShorTor, a protocol for reducing latency on the Tor network. ShorTor uses multi-hop overlay routing, a technique typically employed by content delivery networks, to influence the route Tor traffic takes across the internet. In this way, ShorTor avoids slow paths and improves the experience for end users by reducing the latency of their connections while imposing minimal bandwidth overhead.ShorTor functions as an overlay on top of onion routing-Tor's existing routing protocol-and is run by Tor relays, making it independent of the path selection performed by Tor clients. As such, ShorTor reduces latency while preserving Tor's existing security properties. Specifically, the routes taken in ShorTor are in no way correlated to either the Tor user or their destination, including the geographic location of either party. We analyze the security of ShorTor using the AnoA framework, showing that ShorTor maintains all of Tor's anonymity guarantees. We augment our theoretical claims with an empirical analysis.To evaluate ShorTor's performance, we collect a real-world dataset of over 400,000 latency measurements between the 1,000 most popular Tor relays, which collectively see the vast majority of Tor traffic. With this data, we identify pairs of relays that could benefit from ShorTor: that is, two relays where introducing an additional intermediate network hop results in lower latency than the direct route between them. We use our measurement dataset to simulate the impact on end users by applying ShorTor to two million Tor circuits chosen according to Tor's specification.ShorTor reduces the latency for the 99 th percentile of relay pairs in Tor by 148 ms. Similarly, ShorTor reduces the latency of Tor circuits by 122 ms at the 99 th percentile. In practice, this translates to ShorTor truncating tail latencies for Tor which has a direct impact on page load times and, consequently, user experience on the Tor browser.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: B Differential Advantagementioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

ShorTor: Improving Tor Network Latency via Multi-hop Overlay Routing

Hogan¹,

Servan-Schreiber²,

Newman³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

Security and Performance Implications of BGP Rerouting-Resistant Guard Selection Algorithms for Tor

Mitseva

Aleksandrova

Engel

et al. 2020

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Tor is the most popular anonymization system with millions of daily users and, thus, an attractive target for attacks, e.g., by malicious autonomous systems (ASs) performing active routing attacks to become man in the middle and deanonymize users. It was shown that the number of such malicious ASs is significantly larger than previously expected due to the lack of security guarantees in the Border Gateway Protocol (BGP). In response, recent works suggest alternative Tor path selection methods prefering Tor nodes with higher resilience to active BGP attacks.In this work, we analyze the implications of such proposals. We show that Counter-RAPTOR and DPSelect are not as secure as thought before: for particular users they allow for leakage of user's location. DPSelect is not as resilient as widely accepted as we show that it achieves only one third of its originally claimed resilience and, hence, does not protect users from routing attacks. We reveal the performance implications of both methods and identify scenarios where their usage leads to significant performance bottlenecks. Finally, we propose a new metric to quantify the user's location leakage by path selection. Using this metric and performing large-scale analysis, we show to which extent a malicious middle can fingerprint the user's location and what kind of confidence it can achieve. Our findings shed light on the implications of path selection methods on the users' anonymity and the need for further research.

show abstract

Actively Probing Routes for Tor AS-Level Adversaries with RIPE Atlas

Mayer

Merzdovnik

Weippl

2020

IFIP Advances in Information and Communication Technology

View full text Add to dashboard Cite

Tor provides anonymity to millions of users around the globe, which has made it a valuable target for malicious actors. As a low-latency anonymity system, it is vulnerable to traffic correlation attacks from strong passive adversaries, such as large autonomous systems. Estimations of the risk posed by such attackers as well as the evaluation of defense strategies are mostly based on simulations and data retrieved from BGP updates. However, this might only provide an incomplete view of the network and thereby influence the results of such analyses. It has already been acknowledged in previous studies that direct path measurements, e.g. with traceroute, could provide valuable information. But in the past, such measurements were thought to be impossible, because they require the placement of measurement nodes in the same ASes as the respective Tor network nodes. With the rise of new technologies and methodologies, this assumption needs to be re-evaluated. In this paper we present a novel methodology to utilize the RIPE Atlas framework, a network of more than 10,000 probes worldwide, to actively perform traceroute commands from and to Tor guard and exit relays to clients and destinations. Based on multiple global scans our results validate previous results and show the large influence on Tor posed by a limited set of ASes. These are in a strong position to carry out effective correlation attacks on Tor traffic. With this work, we provide an additional source of information that can be used together with BGP route information to increase the accuracy of future models and simulations of Tor and ultimately improve anonymity on the Internet.

show abstract

Guard Placement Attacks on Path Selection Algorithms for Tor

Cited by 17 publications

References 41 publications

ShorTor: Improving Tor Network Latency via Multi-hop Overlay Routing

ShorTor: Improving Tor Network Latency via Multi-hop Overlay Routing

Security and Performance Implications of BGP Rerouting-Resistant Guard Selection Algorithms for Tor

Actively Probing Routes for Tor AS-Level Adversaries with RIPE Atlas

Contact Info

Product

Resources

About