Measuring and Mitigating AS-level Adversaries Against Tor

Abstract

The popularity of Tor as an anonymity system has made it a popular target for a variety of attacks. We focus on traffic correlation attacks, which are no longer solely in the realm of academic research with recent revelations about the NSA and GCHQ actively working to implement them in practice.Our first contribution is an empirical study that allows us to gain a high fidelity snapshot of the threat of traffic correlation attacks in the wild. We find that up to 40% of all circuits created by Tor are vulnerable to attacks by traffic correlation from Autonomous System (AS)-level adversaries, 42% from colluding AS-level adversaries, and 85% from statelevel adversaries. In addition, we find that in some regions (notably, China and Iran) there exist many cases where over 95% of all possible circuits are vulnerable to correlation attacks, emphasizing the need for AS-aware relay-selection.To mitigate the threat of such attacks, we build Astoria-an AS-aware Tor client. Astoria leverages recent developments in network measurement to perform path-prediction and intelligent relay selection. Astoria reduces the number of vulnerable circuits to 2% against AS-level adversaries, under 5% against colluding AS-level adversaries, and 25% against state-level adversaries. In addition, Astoria load balances across the Tor network so as to not overload any set of relays.

DeepCorr

“…For instance, Starov et al [70] recently show that approximately 40% of Tor circuits are vulnerable to ow correlation attacks by a single malicious AS, and Sun et al [72] show that churn in BGP as well as active manipulation of BGP updates can amplify an adversarial AS's visibility on Tor connections. This has lead to various proposals on deploying AS-aware path selection mechanisms for Tor [2,20,54].…”

“…While ow correlation is the core of a multitude of attacks on Tor [3,8,20,22,28,38,39,49,52,54,70,72,72,83], existing ow correlation algorithms are assumed to be ine ective in linking Tor connections reliably and at scale [37,55,66]. This is due to Tor's extremely noisy network that applies large perturbations on Tor ows, therefore rendering tra c features across associated ingress and egress Tor ows hard to get reliably correlated.…”

“…As discussed earlier, recent studies [22,52,72] show that various ASes and IXPs intercept a signi cant fraction of Tor tra c, putting them in an ideal position to perform ow correlation attacks. To counter, several proposals suggest new relay selection mechanisms for Tor that reduce the interception chances of malicious ASes [2,5,41,54,71,73]. None of such alternatives have been deployed by Tor due to their negative impacts on performance, costs, and privacy.…”

The Effect of DNS on Tor's Anonymity

“…By combining TorPS with AS path prediction, Johnson et al could answer questions such as the average time until a Tor user's circuit is deanonymized by an AS or IXP. Most recently in 2016, Nithyanand et al [36] used AS path prediction to evaluate the practical threat faced by users in the top 10 countries using Tor. In 2015, Juen et al [28] examined the accuracy of path prediction algorithms that prior work [25,16] used to estimate the threat of correlation attacks.…”

On the Challenges of Geographical Avoidance for Tor

“…The path of a circuit does not only depend on the choice of relays, but also on the routing conditions between the relays. Adversaries use routing attacks [9], [39] to manipulate such paths, forcing traffic through areas that are under adversarial control.…”