Attack Reveals 81% of Tor Users but, Admins Call for Calm

The Tor Project has Urged Calm after New Research Found 81% of Users, Could be Identified Using Cisco's NetFlow Tool. A Research Effort Led by Professor, Sambuddah Chakravarty, from the Indraprastha Institute of Information Technology in Delhi, Found that, Well-Resourced Attackers such as a Nation-State could Effectively Reveal Tor Users' Identity with a False-Positive Rate of 6%, while an Autonomous System could Reveal about 39% of Users. Chakravarty's Research, Run on a High Performance Research Server within the University, Worked in Part Due to the Low-Latency Design of Tor. "To achieve acceptable quality of service, [Tor] systems attempt to preserve packet interarrival characteristics, such as inter-packet delay", Chakravarty Wrote in the Paper On the Effectiveness of Traffic Analysis Against Anonymity Networks Using, Flow Records. "Consequently, a powerful adversary can mount traffic analysis attacks by observing similar traffic patterns at various points of the network, linking together otherwise unrelated network connections. Although the capacity of current networks makes packet-level monitoring at such a scale quite challenging, adversaries could potentially use less accurate but readily available traffic monitoring functionality, such as Cisco's NetFlow, to mount large-scale traffic analysis attacks."


The Active Traffic Analysis Method was Based on Creating and Monitoring 'Deliberate Perturbances' on Server Side User Traffic and Observing Output on the Client Side through Statistical Correlation. A Team of 5, Tested the Technique with a Public Tor Relay Serving Hundreds of Users. "Our method revealed the actual sources of anonymous traffic with 100 percent accuracy for the in-lab tests, and achieved an overall accuracy of about 81.4 percent for the real-world experiments, with an average false positive rate of 6.4 percent. Tor Project leader Roger Dingledine described the research, first discussed at the Passive and Active Measurement Conference in March, as valuable but pointed out the traffic correlation attacks were not a new area of research. The discussion of false positives is key to this new paper too: Sambuddho's paper mentions a false positive rate of six percent ... It's easy to see how at scale, this 'base rate fallacy' problem could make the attack effectively useless", Dingledine Said in a Post. "I should also emphasize that whether this attack can be performed at all has to do with how much of the internet the adversary is able to measure or control." Dingledine added, "it's great to see more research on traffic confirmation attacks but, traffic confirmation attacks are not a new area so don't freak out without actually reading the papers, and this particular one, while kind of neat, doesn't supersede all the previous papers". Chakravarty Worked along with Marco V. Barbera; Georgios Portokalidis; Michalis Polychronakis and Angelos D. Keromy from Universities Sapienza and Columbia and the Stevens Institute of Technology.




Info Source:

https://blog.torproject.org/blog/traffic-correlation-using-netflows