Security and Performance Implications of BGP Rerouting-Resistant Guard Selection Algorithms for Tor

Abstract

Tor is the most popular anonymization system with millions of daily users and, thus, an attractive target for attacks, e.g., by malicious autonomous systems (ASs) performing active routing attacks to become man in the middle and deanonymize users. It was shown that the number of such malicious ASs is significantly larger than previously expected due to the lack of security guarantees in the Border Gateway Protocol (BGP). In response, recent works suggest alternative Tor path selection methods prefering Tor nodes with higher resilience to active BGP attacks.In this work, we analyze the implications of such proposals. We show that Counter-RAPTOR and DPSelect are not as secure as thought before: for particular users they allow for leakage of user's location. DPSelect is not as resilient as widely accepted as we show that it achieves only one third of its originally claimed resilience and, hence, does not protect users from routing attacks. We reveal the performance implications of both methods and identify scenarios where their usage leads to significant performance bottlenecks. Finally, we propose a new metric to quantify the user's location leakage by path selection. Using this metric and performing large-scale analysis, we show to which extent a malicious middle can fingerprint the user's location and what kind of confidence it can achieve. Our findings shed light on the implications of path selection methods on the users' anonymity and the need for further research.

ShorTor: Improving Tor Network Latency via Multi-hop Overlay Routing

“…Security is another important consideration-incremental deployment inherently creates differences between Tor clients or relays that have adopted a modification and those who have not. This has been an issue for client side proposals as anonymity in Tor relies on all clients behaving uniformly [12,14,36,60,61,74,85].…”

“…There is additionally a large body of work that alters path selection in Tor for purposes of security [13,15,30,40,48,64,73,82,89]. While important, these works are orthogonal to ShorTor and often result in substantially degraded performance [61,74] without clear security advantages over Tor's current protocol [36,85,86].…”

“…Unfortunately, preferentially choosing circuits in this way also selects relays that are correlated with the identity of the user or their destination [12,14,60]. Many attacks show how this can be exploited to deanonymize Tor users, allowing a passive observer to identify information about user locations [12,14,36,60,61,74,85,86].…”

Once is Never Enough: Foundations for Sound Statistical Inference in Tor Network Experimentation

“…The Tor experimentation tools and models described above have assisted researchers in exploring how changes to Tor's path selection [5,7,13,24,28,41,46,52,58,60,61,73,75], load balancing [22,27,31,34,40,53], traffic admission control [2,16,21,23,33,35,37,42,47,74], congestion control [4,20], and denial of service mechanisms [12,26,36,39,59] affect Tor performance and security [3]. The standard practice that has emerged from this work is to sample a single scaled-down Tor network model and use it to run experiments with standard Tor and each of a set of chosen configurations of the proposed performance-enhancing mechanism.…”

“…Researchers have contributed numerous proposals for improving Tor performance in order to support continued growth in the network, including those that attempt to improve Tor's path selection [5,7,13,24,28,41,46,52,58,60,61,73,75], load balancing [22,27,31,34,40,53], traffic admission control [2,16,21,23,33,35,37,42,47,74], and congestion control mechanisms [4,20]. The standard practice when proposing a new mechanism for Tor is to run a single experiment with each recommended configuration of the mechanism and a single experiment with standard Tor.…”