Jump to ContentJump to Main Navigation
Show Summary Details
In This Section

Proceedings on Privacy Enhancing Technologies

4 Issues per year

Open Access
Online
ISSN
2299-0984
See all formats and pricing
Online
Open Access
*Prices in US$ apply to orders placed in the Americas only. Prices in GBP apply to orders placed in Great Britain only. Prices in € represent the retail prices valid in Germany (unless otherwise indicated). Prices are subject to change without notice. Prices do not include postage and handling if applicable. RRP: Recommended Retail Price.
In This Section

Data-plane Defenses against Routing Attacks on Tor

Henry Tan
  • Corresponding author
  • Georgetown University
 / Micah Sherr
  • Georgetown University
 / Wenchao Zhou
  • Georgetown University
Published Online: 2016-07-14 | DOI: https://doi.org/10.1515/popets-2016-0040

Open Access

Download full text pdf

Abstract

Tor is susceptible to traffic correlation attacks in which an adversary who observes flows entering and leaving the anonymity network can apply statistical techniques to correlate flows and de-anonymize their endpoints. While an adversary may not be naturally positioned to conduct such attacks, a recent study shows that the Internet’s control-plane can be manipulated to increase an adversary’s view of the network, and consequently, improve its ability to perform traffic correlation. This paper explores, in-depth, the effects of control-plane attacks on the security of the Tor network. Using accurate models of the live Tor network, we quantify Tor’s susceptibility to these attacks by measuring the fraction of the Tor network that is vulnerable and the advantage to the adversary of performing the attacks. We further propose defense mechanisms that protect Tor users from manipulations at the control-plane. Perhaps surprisingly, we show that by leveraging existing trust anchors in Tor, defenses deployed only in the data-plane are sufficient to detect most control-plane attacks. Our defenses do not assume the active participation of Internet Service Providers, and require only very small changes to Tor. We show that our defenses result in a more than tenfold decrease in the effectiveness of certain control-plane attacks.

References

  • [1] I. C. Avramopoulos and J. Rexford. Stealth Probing: Efficient Data- Plane Security for IP Routing. In USENIX Annual Technical Conference (USENIX-ATC), 2006.

  • [2] CAIDA UCSD IPv4 Routed /24 Topology Dataset. http://www.caida.org/data/active/ipv4_routed_24_topology_dataset.xml.

  • [3] D. L. Chaum. Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms. Communications of the ACM, 24(2):84-90, 1981. [Crossref]

  • [4] S. P. Chung and A. K. Mok. Allergy Attack against Automatic Signature Generation. In International Symposium on Recent Advances in Intrusion Detection (RAID), 2006.

  • [5] CIDR Report 18 Aug 2015. http://www.cidr-report.org/as2.0/.

  • [6] R. Dingledine, N. Mathewson, and P. Syverson. Tor: The Second- Generation Onion Router. In USENIX Security Symposium (USENIX), August 2004.

  • [7] R. Dingledine, N. Hopper, G. Kadianakis, and N. Mathewson. One Fast Guard for Life (or 9 Months). In Privacy Enhancing Technologies Symposium (PETS), 2014.

  • [8] K. P. Dyer, S. E. Coull, T. Ristenpart, and T. Shrimpton. Protocol Misidentification Made Easy with Format-Transforming Encryption. In ACM Conference on Computer and Communications Security (CCS), 2013.

  • [9] M. Edman and P. Syverson. AS-Awareness in Tor Path Selection. In ACM Conference on Computer and Communications Security (CCS), 2009.

  • [10] T. Elahi, K. Bauer, M. AlSabah, R. Dingledine, and I. Goldberg. Changing of the Guards: A Framework for Understanding and Improving Entry Guard Selection in Tor. In ACM Workshop on Privacy in the Electronic Society (WPES), 2012.

  • [11] N. Feamster and R. Dingledine. Location Diversity in Anonymity Networks. In ACM Workshop on Privacy in the Electronic Society (WPES), 2004.

  • [12] D. Fifield. meek. https://trac.torproject.org/projects/tor/wiki/doc/meek.

  • [13] P. Francis, S. Jamin, C. Jin, Y. Jin, D. Raz, Y. Shavitt, and L. Zhang. IDMaps: A Global Internet Host Distance Estimation Service. IEEE/ACM Transactions on Networking, 9(5):525-540, 2001. [Crossref]

  • [14] L. Gao. On Inferring Autonomous System Relationships in the Internet. IEEE/ACM Transactions on Networking (ToN), 9(6):733-745, 2001. [Crossref]

  • [15] S. Hahn and K. Loesing. Privacy-preserving Ways to Estimate the Number of Tor Users. Technical Report 2010-11-001, Tor Project, November 2010.

  • [16] A. Houmansadr and N. Borisov. SWIRL: A Scalable Watermark to Detect Correlated Network Flows. In Network and Distributed System Security Symposium (NDSS), 2011.

  • [17] A. Houmansadr, C. Brubaker, and V. Shmatikov. The Parrot is Dead: Observing Unobservable Network Communications. In IEEE Symposium on Security and Privacy (Oakland), 2013.

  • [18] R. Jansen and N. Hopper. Shadow: Running Tor in a Box for Accurate and Efficient Experimentation. In Network and Distributed System Security Symposium (NDSS), 2012.

  • [19] A. Johnson, C. Wacek, R. Jansen, M. Sherr, and P. Syverson. Users Get Routed: Traffic Correlation on Tor By Realistic Adversaries. In ACM Conference on Computer and Communications Security (CCS), November 2013.

  • [20] A. M. Johnson, P. Syverson, R. Dingledine, and N. Mathewson. Trust-based Anonymous Communication: Adversary Models and Routing Algorithms. In ACM Conference on Computer and Communications Security (CCS), 2011.

  • [21] J. Juen. Protecting Anonymity in the Presence of Autonomous System and Internet Exchange Level Adversaries. Master’s thesis, University of Illinois at Urbana-Champaign, 2012.

  • [22] D. Kedogan, D. Agrawal, and S. Penz. Limits of Anonymity in Open Environments. In Information Hiding Workshop (IH), 2002.

  • [23] S. Kent, C. Lynn, and K. Seo. Secure Border Gateway Protocol (SBGP). IEEE Journal on Selected Areas in Communications, 18(4): 582-592, April 2000.

  • [24] M. Lepinski. BGPSec Protocol Specification. Draft draft-ietf-sidrbgpsec- protocol-04, Internet Engineering Task Force, 2012.

  • [25] MaxMind’s GeoIP Database. https://dev.maxmind.com/geoip/geoip2/geolite2/.

  • [26] H. M. Moghaddam, B. Li, M. Derakhshani, and I. Goldberg. Skype- Morph: Protocol Obfuscation for Tor Bridges. In ACM Conference on Computer and Communications Security (CCS), 2012.

  • [27] S. J. Murdoch and G. Danezis. Low-Cost Traffic Analysis of Tor. In IEEE Symposium on Security and Privacy (Oakland), 2005.

  • [28] V. N. Padmanabhan and D. R. Simon. Secure Traceroute to Detect Faulty or Malicious Routing. ACM SIGCOMM Computer Communication Review, 33(1):77-82, 2003.

  • [29] H. N. Phong, A. Yasuhito, and Y. Masatoshi. Anti-RAPTOR: Anti Routing Attack on Privacy for a Securer and Scalable Tor. In IEEE International Conference on Advanced Communication Technology (ICACT), 2015.

  • [30] Y. Rekhter, T. Li, and S. Hares. A Border Gateway Protocol 4 (BGP-4). RFC 4271, Internet Engineering Task Force, 2006.

  • [31] RIPE Atlas. https://atlas.ripe.net/.

  • [32] Routeviews Prefix to AS mappings Dataset for IPv4 and IPv6. http://www.caida.org/data/routing/routeviews-prefix2as.xml.

  • [33] RouteViews Project. http://www.routeviews.org/.

  • [34] Snakes on a Tor Exit Scanner. https://gitweb.torproject.org/torflow.git/tree/HEAD:/NetworkScanners/ExitAuthority.

  • [35] Y. Sun, A. Edmundson, L. Vanbever, O. Li, J. Rexford, M. Chiang, and P. Mittal. RAPTOR: Routing Attacks on Privacy in Tor. In USENIX Security Symposium (USENIX), Aug. 2015.

  • [36] The CAIDA AS Relationships Dataset, <2014-06-01>. http://www.caida.org/data/as-relationships/.

  • [37] Tor Flow. https://gitweb.torproject.org/torflow.git/.

  • [38] Tor Project, Inc. Tor Metrics Portal. https://metrics.torproject.org/.

  • [39] C. Wacek, H. Tan, K. Bauer, and M. Sherr. An Empirical Evaluation of Relay Selection in Tor. In Network and Distributed System Security Symposium (NDSS), February 2013.

  • [40] T. Wan, E. Kranakis, and P. C. van Oorschot. Pretty Secure BGP, psBGP. In Network and Distributed System Security Symposium (NDSS), 2005.

  • [41] Z. Weinberg, J. Wang, V. Yegneswaran, L. Briesemeister, S. Cheung, F. Wang, and D. Boneh. StegoTorus: A Camouflage Proxy for the Tor Anonymity System. In ACM Conference on Computer and Communications Security (CCS), 2012.

  • [42] R. White. Architecture and Deployment Considerations for Secure Origin BGP (soBGP). Draft draft-white-sobgp-architecture-02, Internet Engineering Task Force, 2006.

  • [43] H. Yu, J. Rexford, and E. Felten. A Distributed Reputation Approach to Cooperative Internet Routing Protection. In Workshop on Secure Network Protocols (NPSec), 2005.

  • [44] J. Zhang, J. Rexford, and J. Feigenbaum. Learning-based Anomaly Detection in BGP Updates. In ACM SIGCOMM Workshop on Mining Metwork Data, 2005.

  • [45] Z. Zhang, Y. Zhang, Y. C. Hu, and Z. M. Mao. Practical Defenses Against BGP Prefix Hijacking. In ACM International Conference on Emerging Networking EXperiments and Technologies (CoNEXT), 2007.

  • [46] C. Zheng, L. Ji, D. Pei, J. Wang, and P. Francis. A Light-weight Distributed Scheme for Detecting IP Prefix Hijacks in Real-time. In Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM), 2007.

About the article

Received: 2016-02-29

Revised: 2016-06-02

Accepted: 2016-06-02

Published Online: 2016-07-14

Published in Print: 2016-10-01

Citation Information: Proceedings on Privacy Enhancing Technologies, ISSN (Online) 2299-0984, DOI: https://doi.org/10.1515/popets-2016-0040. Export Citation

© 2016. This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License. (CC BY-NC-ND 4.0)

Comments (0)

Please log in or register to comment.
Log in