Proceedings of the First International Workshop on Information Hiding
Traffic Analysis Attacks and Trade-Offs in Anonymity Providing Systems
IHW '01 Proceedings of the 4th International Workshop on Information Hiding
Proceedings of the 10th ACM conference on Computer and communications security
Web tap: detecting covert web traffic
Proceedings of the 11th ACM conference on Computer and communications security
Tracing Anonymous Packets to Their Approximate Source
LISA '00 Proceedings of the 14th USENIX conference on System administration
Low-Cost Traffic Analysis of Tor
SP '05 Proceedings of the 2005 IEEE Symposium on Security and Privacy
Hot or not: revealing hidden services by their clock skew
Proceedings of the 13th ACM conference on Computer and communications security
Tor: the second-generation onion router
SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
Network Flow Watermarking Attack on Low-Latency Anonymous Communication Systems
SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
iPlane: an information plane for distributed services
OSDI '06 Proceedings of the 7th symposium on Operating systems design and implementation
Low-resource routing attacks against tor
Proceedings of the 2007 ACM workshop on Privacy in electronic society
How much anonymity does network latency leak?
Proceedings of the 14th ACM conference on Computer and communications security
Compromising Anonymity Using Packet Spinning
ISC '08 Proceedings of the 11th international conference on Information Security
Measuring Anonymity: The Disclosure Attack
IEEE Security and Privacy
Identifying Proxy Nodes in a Tor Anonymization Circuit
SITIS '08 Proceedings of the 2008 IEEE International Conference on Signal Image Technology and Internet Based Systems
An improved clock-skew measurement technique for revealing hidden services
SS'08 Proceedings of the 17th conference on Security symposium
A practical congestion attack on tor using long paths
SSYM'09 Proceedings of the 18th conference on USENIX security symposium
Improving tor using a TCP-over-DTLS tunnel
SSYM'09 Proceedings of the 18th conference on USENIX security symposium
ExperimenTor: a testbed for safe and realistic tor experimentation
CSET'11 Proceedings of the 4th conference on Cyber security experimentation and test
Stealthy traffic analysis of low-latency anonymous communication using throughput fingerprinting
Proceedings of the 18th ACM conference on Computer and communications security
Malice versus AN.ON: possible risks of missing replay and integrity protection
FC'11 Proceedings of the 15th international conference on Financial Cryptography and Data Security
Spying in the dark: TCP and tor traffic analysis
PETS'12 Proceedings of the 12th international conference on Privacy Enhancing Technologies
Instant degradation of anonymity in low-latency anonymisation systems
AIMS'12 Proceedings of the 6th IFIP WG 6.6 international autonomous infrastructure, management, and security conference on Dependable Networks and Services
| Hi-index | 0.00 |
We introduce a novel remotely-mounted attack that can expose the network identity of an anonymous client, hidden service, and anonymizing proxies. To achieve this, we employ single-end controlled available bandwidth estimation tools and a colluding network entity that can modulate the traffic destined for the victim. To expose the circuit including the source, we inject a number of short or one large burst of traffic. Although timing attacks have been successful against anonymity networks, they require either a Global Adversary or the compromise of substantial number of anonymity nodes. Our technique does not require compromise of, or collaboration with, any such entity. To validate our attack, we performed a series of experiments using different network conditions and locations for the adversaries on both controlled and real-world Tor circuits. Our results demonstrate that our attack is successful in controlled environments. In real-world scenarios, even an under-provisioned adversary with only a few network vantage points can, under certain conditions, successfully identify the IP address of both Tor users and Hidden Servers. However, Tor's inherent circuit scheduling results in limited quality of service for its users. This at times leads to increased false negatives and it can degrade the performance of our circuit detection. We believe that as high speed anonymity networks become readily available, a well-provisioned adversary, with a partial or inferred network "map", will be able to partially or fully expose anonymous users.