How Low Can You Go: Balancing Performance with Anonymity in Tor

Abstract

Abstract. Tor is one of the most popular anonymity systems in use today, in part because of its design goal of providing high performance. This has motivated research into performance enhancing modifications to Tor's circuit scheduling, congestion control, and bandwidth allocation mechanisms. This paper investigates the effects of these proposed modifications on attacks that rely on network measurements as a side channel. We introduce a new class of induced throttling attacks in this space that exploit performance enhancing mechanisms to artificially throttle a circuit. We show that these attacks can drastically reduce the set of probable entry guards on a circuit, in many cases uniquely identifying the entry guard. Comparing to existing attacks, we find that although most of the performance enhancing modifications improve the accuracy of network measurements, the effectiveness of the attacks is reduced in some cases by making the Tor network more homogeneous. We conclude with an analysis of the total reduction in anonymity that clients face due to each proposed mechanism.

An island apart? Risks and prices in the Australian cryptomarket drug trade

“…Research has suggested that the design and regulatory mechanisms of these marketplaces may make drug selling less risky than conventional methods by connecting buyers and sellers via digital systems (principally Tor and Bitcoin) and postal networks (Martin, 2014a;2014b;Van Hout & Bingham, 2013a), rather than through conventional interpersonal networks that are often complex, lengthy and highly stratified (see, for example, Malm & Bichler 2011). Similarly, the risk from law enforcement may be reduced as traditional anti-drug policing operations, such as buy-bust undercover operations and raids on drug retailing hotspots have less success (Martin, 2014b;Décary-Hétu & Giommoni, 2016) and more resource-intensive and unfamiliar modes of investigation such as cyberinvestigations that seek to exploit information leakage in Tor connections (Huber et al, 2010;Geddes et al, 2013), bitcoin transactions (Reynolds & Irwin, 2017) or wider disruption of both the actors and the markets (cf. Hutching & Holt, 2016, and disruptions to the trade in stolen data) are still in their infancy.…”

NavigaTor: Finding Faster Paths to Anonymity

“…Latency Attacks. Geddes, Jansen, and Hopper [33] have found that algorithms which improve throughput or responsiveness of circuits also increase the effectiveness of latencybased attacks; especially those attacks either attempting to identify possible Guards nodes or trying to reduce the set of possible clients. Thus, we concede that the latency improvements resulting from the use of Circuit-RTT would also increase the effectiveness of latency-based attacks, but this issue is inherent to any method that improves latency.…”

Shedding Light on the Dark Corners of the Internet: A Survey of Tor Research

“…Induced Throttling Attacks: Geddes et al [67] proposed a new attack which breaches the Tor network by exploiting its selection bias in favor of high capacity relay nodes. Authors showed that induced throttling at the corrupt exit node by exploiting congestion or traffic shaping algorithms can induce similar traffic patterns at other relays associated with the corrupted exit relay.…”