The Sniper Attack: Anonymously
Deanonymizing and Disabling the Tor
Network
Rob Jansen et. al
NDSS 2014
Presenter: Yue Li
Part of slides adapted from R. Jansen
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
Background & Motivation
Large scale Internet censorship.
Degree of Internet censorship by country
Background & Motivation
Large scale Internet censorship.
Degree of Internet censorship by country
This is not what we want...
Background & Motivation
As a result, people develop new privacy
enhancing techniques that Increase the cost of
detection.
Background & Motivation
As a result, people develop new privacy
enhancing techniques that Increase the cost of
detection.
The most popular deployed system: Tor
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
Tor
Tor
● Application-layer overlay network
● Enables anonymous communication between clients
and arbitrary Internet destination.
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
How does Tor work?
● Deploys Onion Routing - Like an Onion
● Transmit a package from the user to a destination
Blue: Entry
Red: Relay
Yellow: Exit
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
Sniper Attack
Vulnerabilities in Tor:
Tor relies on underlying TCP to guarantee reliability and inorder delivery.
Tor is an application-layer system.
● Tor does not drop or reorder cells(packets in
Tor).
Sniper Attack
Vulnerabilities in Tor:
Tor relies on underlying TCP to guarantee reliability and inorder delivery.
Tor is an application-layer system.
● Tor does not drop or reorder cells.
Sniper Attack
Sniper Basic Attack
●
●
●
●
Attacker controls the client and the exit.
Exit keeps sending cells ignoring package window limit.
Client does not read cells from entry.
The entry memory will be used up for queuing cells.
Sniper Attack
Sniper Basic Attack - a second version
●
●
●
●
Attacker controls the client and the server.
Client keeps sending cells to server ignoring package window limit.
Server does not read cells from exit.
The exit memory will be used up for queuing cells.
Sniper Attack
Recall how Tor does flow control
● Exit has a window size of 1000 cells
● Client sends SENDME signal to exit to increase the window by 100 cells.
● Vice versa when packages are from client to exit
Sniper Attack
Sniper Basic Attack - Efficient Attack
●
●
●
●
Attacker controls only the client.
Client downloads a large file and keeps sending SENDME signal to exit.
Client does not read cells from exit.
The entry memory will be used up for queuing cells.
Sniper Attack - an illustration
Sniper Attack - an illustration
Sniper Attack - an illustration
Sniper Attack - an illustration
Sniper Attack - an illustration
Sniper Attack - an illustration
Sniper Attack - an illustration
Sniper Attack
Avoid detection
● Tor detects protocol violation by checking the circuit
window (>1000)
● If violation detected, close the circuit and send a
DESTROY signal backward
● How to avoid detection?
o Estimate the circuit throughput by probing
o Send SENDME signal according to estimation
Sniper Attack
● The attack can be parallelized to accelerate
memory consumption in target
● Hide the Sniper
● Use Tor itself
exit1 will use up the 1000 cell limit and stops reading from entry 2
● Other method (public wireless network, botnet, etc)
Sniper Attack
● Implemented Sniper Attack Prototype
● Tested in Shadow
o
simulated Tor network
● Measured
o
o
Victim Memory Consumption
Adversary Bandwidth Usage
Sniper Attack - Result
Target Memory
Sniper Attack - Result
Mean BW consumed
at Adversary
Sniper Attack - Result
Speed of Sniper Attack
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
HS Deanonymization
Hidden Service
● Allows users to hide their locations while offering
various of services. (web publishing, instant messaging
etc)
Sniper Attack can be deployed to deanonymize hidden
services.
Hidden Services
Client chooses RP
Service chooses IP
Client and Service
communicate
through RP and IP
Hidden Services
Hidden Services
Hidden Services
Deanonymizing HS
Three steps:
● Cause HS to build new rendezvous circuits
to learn its guard
● Snipe HS guard to force reselection
● Repeat until HS chooses adversarial guard
Guard = Entry
Deanonymizing HS
Try establishing new connections until adversarial relay is chosen
Identify HS entry using methods proposed by A. Biryukov from S&P 13.
A.Biryukov, I. Pustogarov, and R.-P. Weinmann, “Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization”, in SP ‘13, May
2013
Deanonymizing HS
Deanonymizing HS
A.Biryukov, I. Pustogarov, and R.-P. Weinmann, “Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization”, in SP ‘13, May
2013
Deanonymizing HS - Result
Speed of Deanonymization
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
Defense against Sniper Attack
How can we defend Sniper Attack?
Defense against Sniper Attack
How can we defend Sniper Attack?
Naturally…
● Authenticated SENDMEs
o Sending SENDMEs without receiving the cells not allowed
o However, each circuit is still able to queue 1000 cells in target
● Queue Length Limit
o limit the queue length
o Still can be attacked by parallel Sniper Attack
Defense against Sniper Attack
How can we defend Sniper Attack?
So...
● Adaptive Circuit Killing
o Kill circuits when total memory consumption remains higher than a
threshold
o kill circuits with the earliest time or arrival
o Attacker must read from the Tor network to avoid being killed since
Tor is strictly FIFO
Outline
Background & Motivation
Tor Network
Sniper Attack
Hidden Service Deanonymization
Defense against Sniper Attack
Defense against DoS-based Deanonymization
Defende against Deanonymization
Entry-guard Rate-limiting
● Limit the rate at which clients will add relays to their
entry guard list.
● Hidden Services use 2 levels of guards.
● However, over time the DoS Deanonymization will
eventually succeed unless the guards are limited to a
set of trustworthy routers.
QUESTIONS?