full-disclosure - Re: [FD] PoC: End-to-end correlation for Tor connections using an active timing attack

Open Source and information security mailing list archives

Message-ID: <CAJVRA1Q-7W5AqFoF+NhEzPOvP5XEjTDikz5Z=P40hzgGjnxsQA@mail.gmail.com>
Date: Sat, 29 Mar 2014 13:46:35 -0700
From: coderman <coderman@...il.com>
To: Jann Horn <jann@...jh.net>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] PoC: End-to-end correlation for Tor connections using an
 active timing attack

On Sat, Mar 29, 2014 at 1:06 PM, Jann Horn <jann@...jh.net> wrote:
> This is a very simple implementation of an active timing attack on Tor. Please note that
> the Tor developers are aware of issues like this -
> https://blog.torproject.org/blog/one-cell-enough states:...

interesting work; and a good example of the limits of traffic analysis
protection in low latency, stream oriented protocols.

an even more effective approach is using active DoS as a signal for
confirmation, like your sequence of activity:

"Denial of Service or Denial of Security? How Attacks on Reliability
can Compromise Anonymity"
  http://hostmaster.freehaven.net/anonbib/cache/ccs07-doa.pdf

> So, this is a known problem, but I wanted to see how easy it really is to do this,
> and I wanted to try it myself, so I built a PoC.
>
> The requirements are:
>  - The user points his browser to an attacker's webserver and stays on that server
>    long enough (a bit over 4 minutes in my implementation)

one other trick, try hosting the webserver on a common "long lived
port".  not sure if this will make much difference, but it should
improve the odds of your entire few minute sequence staying on the
same circuit...

best regards,

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives