Understanding the Sniper Attack on Tor Network
Explore the implications of the Sniper attack, which aims to anonymously deanonymize and disable the Tor network. Learn about defense strategies against this threat and delve into the background of large-scale internet censorship that drives the development of privacy-enhancing tools like Tor.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
The Sniper Attack: Anonymously Deanonymizing and Disabling the Tor Network Rob Jansen et. al NDSS 2014 Presenter: Yue Li Part of slides adapted from R. Jansen
Outline Background & Motivation Tor Network Sniper Attack Hidden Service Deanonymization Defense against Sniper Attack Defense against DoS-based Deanonymization
Outline Background & Motivation Tor Network Sniper Attack Hidden Service Deanonymization Defense against Sniper Attack Defense against DoS-based Deanonymization
Background & Motivation Large scale Internet censorship. Degree of Internet censorship by country
Background & Motivation Large scale Internet censorship. Degree of Internet censorship by country This is not what we want...
Background & Motivation As a result, people develop new privacy enhancing techniques that Increase the cost of detection.
Background & Motivation As a result, people develop new privacy enhancing techniques that Increase the cost of detection. The most popular deployed system: Tor
Outline Background & Motivation Tor Network Sniper Attack Hidden Service Deanonymization Defense against Sniper Attack Defense against DoS-based Deanonymization
Tor Tor Application-layer overlay network Enables anonymous communication between clients and arbitrary Internet destination.
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination
How does Tor work? Deploys Onion Routing - Like an Onion Transmit a package from the user to a destination Blue: Entry Red: Relay Yellow: Exit
Outline Background & Motivation Tor Network Sniper Attack Hidden Service Deanonymization Defense against Sniper Attack Defense against DoS-based Deanonymization
Sniper Attack Vulnerabilities in Tor: Tor relies on underlying TCP to guarantee reliability and in- order delivery. Tor is an application-layer system. Tor does not drop or reorder cells(packets in Tor).
Sniper Attack Vulnerabilities in Tor: Tor relies on underlying TCP to guarantee reliability and in- order delivery. Tor is an application-layer system. Tor does not drop or reorder cells.
Sniper Attack Sniper Basic Attack Attacker controls the client and the exit. Exit keeps sending cells ignoring package window limit. Client does not read cells from entry. The entry memory will be used up for queuing cells.
Sniper Attack Sniper Basic Attack - a second version Attacker controls the client and the server. Client keeps sending cells to server ignoring package window limit. Server does not read cells from exit. The exit memory will be used up for queuing cells.
Sniper Attack Recall how Tor does flow control Exit has a window size of 1000 cells Client sends SENDME signal to exit to increase the window by 100 cells. Vice versa when packages are from client to exit
Sniper Attack Sniper Basic Attack - Efficient Attack Attacker controls only the client. Client downloads a large file and keeps sending SENDME signal to exit. Client does not read cells from exit. The entry memory will be used up for queuing cells.
Sniper Attack Avoid detection Tor detects protocol violation by checking the circuit window (>1000) If violation detected, close the circuit and send a DESTROY signal backward How to avoid detection? o Estimate the circuit throughput by probing o Send SENDME signal according to estimation
Sniper Attack The attack can be parallelized to accelerate memory consumption in target Hide the Sniper Use Tor itself exit1 will use up the 1000 cell limit and stops reading from entry 2 Other method (public wireless network, botnet, etc)
Sniper Attack Implemented Sniper Attack Prototype Tested in Shadow o simulated Tor network Measured o Victim Memory Consumption o Adversary Bandwidth Usage
Sniper Attack - Result Target Memory
Sniper Attack - Result Mean BW consumed at Adversary
Sniper Attack - Result Speed of Sniper Attack
Outline Background & Motivation Tor Network Sniper Attack Hidden Service Deanonymization Defense against Sniper Attack Defense against DoS-based Deanonymization
HS Deanonymization Hidden Service Allows users to hide their locations while offering various of services. (web publishing, instant messaging etc) Sniper Attack can be deployed to deanonymize hidden services.
Hidden Services Client chooses RP Service chooses IP Client and Service communicate through RP and IP
Deanonymizing HS Three steps: Cause HS to build new rendezvous circuits to learn its guard Snipe HS guard to force reselection Repeat until HS chooses adversarial guard Guard = Entry
Deanonymizing HS Try establishing new connections until adversarial relay is chosen Identify HS entry using methods proposed by A. Biryukov from S&P 13. A.Biryukov, I. Pustogarov, and R.-P. Weinmann, Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization , in SP 13, May 2013
Deanonymizing HS A.Biryukov, I. Pustogarov, and R.-P. Weinmann, Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization , in SP 13, May 2013
Deanonymizing HS - Result Speed of Deanonymization
Outline Background & Motivation Tor Network Sniper Attack Hidden Service Deanonymization Defense against Sniper Attack Defense against DoS-based Deanonymization
Defense against Sniper Attack How can we defend Sniper Attack?
Defense against Sniper Attack How can we defend Sniper Attack? Naturally Authenticated SENDMEs o Sending SENDMEs without receiving the cells not allowed o However, each circuit is still able to queue 1000 cells in target Queue Length Limit o limit the queue length o Still can be attacked by parallel Sniper Attack
