Website Fingerprinting with Website Oracles

Abstract

Website Fingerprinting (WF) attacks are a subset of traffic analysis attacks where a local passive attacker attempts to infer which websites a target victim is visiting over an encrypted tunnel, such as the anonymity network Tor. We introduce the security notion of a Website Oracle (WO) that gives a WF attacker the capability to determine whether a particular monitored website was among the websites visited by Tor clients at the time of a victim’s trace. Our simulations show that combining a WO with a WF attack—which we refer to as a WF+WO attack—significantly reduces false positives for about half of all website visits and for the vast majority of websites visited over Tor. The measured false positive rate is on the order one false positive per million classified website trace for websites around Alexa rank 10,000. Less popular monitored websites show orders of magnitude lower false positive rates.We argue that WOs are inherent to the setting of anonymity networks and should be an assumed capability of attackers when assessing WF attacks and defenses. Sources of WOs are abundant and available to a wide range of realistic attackers, e.g., due to the use of DNS, OCSP, and real-time bidding for online advertisement on the Internet, as well as the abundance of middleboxes and access logs. Access to a WO indicates that the evaluation of WF defenses in the open world should focus on the highest possible recall an attacker can achieve. Our simulations show that augmenting the Deep Fingerprinting WF attack by Sirinam et al. [60] with access to a WO significantly improves the attack against five state-of-the-art WF defenses, rendering some of them largely ineffective in this new WF+WO setting.

De-Anonymisation Attacks on Tor: A Survey

“…[118] asserted that attacks that link the entry and exit are very difficult to execute in practice, although they are theoretically possible. The blog article in [123] discusses the practicality of a WF attack with WOs [92]. While agreeing with the fact that some WOs may present a threat to the Tor network, this article also provides insights about the fact that WF attacks are not very realistic.…”

“…As the development of DL and AI are constantly evolving, we believe that there will be more effective WF attacks in the future. It should also be noted that entities such as Website Oracles [92], when integrated with WF attacks, may present a significant threat to the Tor network in the future.…”

“…In a follow-up article [123] to the WF attack with WO by Pulls et al [92], the Tor development team mentions that they are concerned about the use of low cost, high coverage WOs such as DNS and RTB [96] to assist attackers. In [123], the authors suggest some precautions that various user groups can take to mitigate the risks of this situation.…”

“…The attack can be carried out by observing the links or running a compromised entry node and a DNS resolver or server. Two DefecTor classifiers are proposed by extending Wang et al's k-NN classifier[83].In a very recent publication, Pulls et al[92] introduce the security notion of a Website Oracle (WO), which can be combined with a WF attack to increase its effectiveness. A WO provides information on whether a particular monitored website was visited via Tor at a given time.…”

Hidden Service Website Response Fingerprinting Attacks Based on Response Time Feature

“…Although fingerprinting classifiers based on deep learning are in the mainstream of improving the recognition accuracy, they often lack characteristic interpretability and thus unable to express the differences between fingerprints compared with the traditional machine learning algorithms. In other words, deep learning weakens the statistical feature exposed by the encrypted traffic and prioritizes the accuracy of the classifier [23]. erefore, in order to explore the degree of characteristic influence of response fingerprints, the following three representative machine learning classifiers are chosen for testing and comparison with the algorithm proposed in this paper.…”