Stealthy traffic analysis of low-latency anonymous communication using throughput fingerprinting

Abstract

Anonymity systems such as Tor aim to enable users to communicate in a manner that is untraceable by adversaries that control a small number of machines. To provide efficient service to users, these anonymity systems make full use of forwarding capacity when sending traffic between intermediate relays. In this paper, we show that doing this leaks information about the set of Tor relays in a circuit (path). We present attacks that, with high confidence and based solely on throughput information, can (a) reduce the attacker's uncertainty about the bottleneck relay of any Tor circuit whose throughput can be observed, (b) exactly identify the guard relay(s) of a Tor user when circuit throughput can be observed over multiple connections, and (c) identify whether two concurrent TCP connections belong to the same Tor user, breaking unlinkability. Our attacks are stealthy, and cannot be readily detected by a user or by Tor relays. We validate our attacks using experiments over the live Tor network. We find that the attacker can substantially reduce the entropy of a bottleneck relay distribution of a Tor circuit whose throughput can be observed-the entropy gets reduced by a factor of 2 in the median case.Such information leaks from a single Tor circuit can be combined over multiple connections to exactly identify a user's guard relay(s). Finally, we are also able to link two connections from the same initiator with a crossover error rate of less than 1.5% in under 5 minutes. Our attacks are also more accurate and require fewer resources than previous attacks on Tor.

On the Effectiveness of Traffic Analysis against Anonymity Networks Using Flow Records

“…Our method assumed that the adversaries were in a position to perturb the victim traffic by colluding with the server, and are in control of various network vantage points, from where they can remotely observe variations in network bandwidth. Mittal et al [16] demonstrated a modified version of the Murdoch and Danezis' attack that relies on path bandwidth variation.…”

“…tacker could follow a more focused approach by employing existing techniques [7,16] to identify the actual relays used by the victim's circuit, and only monitor those.…”

CellFlood: Attacking Tor Onion Routers on the Cheap

“…Most of the research on Tor has focused on techniques aimed at degrading user's anonymity by means of congestion attacks (Evans et al [7], Murdoch and Danezis [19]), web page fingerprints (Shi and Matsura [23]), observations of the throughput of Tor streams (Mittal et al [16]), or by means of colluding nodes (Fu et al [9], Levine et al [14]). Other attacks study the potential threat of a (semi) global adversary (Murdoch and Zieliński [17], Edman and Syverson [6], Chakravarty et al [3]), although this does not fit into Tor's original adversary model.…”

How Low Can You Go: Balancing Performance with Anonymity in Tor

“…For example, several attacks have been proposed [12,17,24,27] that rely on measuring the latency or throughput of a Tor circuit to draw inferences about its source and destination. If an algorithm improves the throughput or responsiveness of Tor circuits this can improve the accuracy of the measurements used by these attacks either directly or by averaging a larger sample.…”