Latest / CyberPodcast / How Tor Gets Deanonymized with Replay Attacks | Paper Breakdown #2 | Cyberpodcast

Transcript

How Tor Gets Deanonymized with Replay Attacks | Paper Breakdown #2 | Cyberpodcast · CyberPodcast

• 0:00
  OK, let's dive into this. Welcome to today's Explainer,
• 0:03
  where we're unpacking a really fascinating academic paper
• 0:06
  called A New Replay Attack Against Anonymous Communication
• 0:10
  Networks. Now you know the deal.
• 0:12
  Whenever we talk about online privacy, one name absolutely
• 0:15
  dominates the conversation, right?
• 0:17
  Tor. It's the gold standard for
• 0:19
  anonymous web browsing, used by everyone from journalists
• 0:22
  protecting their sources to, well, just everyday users
• 0:25
  wanting to keep their data locked down.
• 0:27
  But what happens when the very mechanics designed to keep you
• 0:30
  safe are actually turned into a weapon against you?
• 0:34
  Well, that's exactly what we're going to figure out today.
• 0:37
  Think about it like this. Imagine Tor is this massive,
• 0:40
  impenetrable digital bank fault. We just inherently trust it.
• 0:43
  We put our most sensitive digital belongings inside,
• 0:46
  totally believing no one can ever trace them back to us.
• 0:49
  But the researchers behind this paper found something else, a
• 0:53
  really clever kind of hidden flaw.
• 0:55
  They realized you don't actually need to blow the vault doors off
• 0:57
  to get inside. No, you just need to understand
• 1:00
  the locks so incredibly well that you can literally trick it
• 1:03
  into handing over the keys to your identity.
• 1:06
  All right, Section 1, how Tor protects you.
• 1:09
  The blueprint of the vault. So just to establish our
• 1:13
  baseline here, let's take a quick look at the layout of this
• 1:15
  vault when you. Let's go ahead and call you
• 1:17
  Alice. Want to talk to a server?
• 1:19
  We'll call it Bob. Your data doesn't just travel in
• 1:21
  a straight line. That'd be too easy.
• 1:23
  The Tor network is essentially a series of these highly secure
• 1:26
  checkoints called onion routers. Your data gets routed through a
• 1:29
  randomly selected chain of these checkoints, ractically bouncing
• 1:33
  around the globe to totally obscure your physical location
• 1:35
  and your identity. By default, this is a three hop
• 1:39
  process. First, your client connects to
• 1:41
  an entry router, then the data passes along to a middle router,
• 1:45
  and finally it hits the exit router, which is what makes that
• 1:48
  ultimate connection to your destination.
• 1:50
  It's called onion routing because at each of these three
• 1:52
  steps, a layer of encryption is peeled away.
• 1:54
  By the time the data actually reaches the end, no single
• 1:57
  router knows both who you are and what you're looking at.
• 2:00
  The entry router knows you, but hey, not your destination.
• 2:03
  The exit router knows your destination, but has no idea who
• 2:05
  you are. Honestly, it's a beautiful,
• 2:08
  elegant system. Moving on to Section 2, the
• 2:11
  counter mode flaw. Finding the locks weakness.
• 2:16
  To really understand how hypothetical thieves managed to
• 2:18
  pick this digital lock, we have to zero in on the specific
• 2:22
  cryptographic tool that holds the whole shebang together.
• 2:25
  Tor uses an encryption standard called Advanced Encryption
• 2:28
  Standard in Counter Mode, or a ESCTR for short.
• 2:32
  Let's simplify this a bit. Think of a ESCTR like a line of
• 2:36
  perfectly synchronized dancers. For the routine to work, every
• 2:39
  single dancer, meaning the client and all the network
• 2:42
  routers, must be on the exact same beat, counting 1234 in
• 2:47
  absolute perfect unison. If even one dancer misses a
• 2:51
  step, or maybe repeats a beat, the entire routine just
• 2:54
  instantly falls apart into complete chaos.
• 2:57
  Now notice how data in Tor is packed into these standardized
• 3:00
  cells of exactly 512 bytes, and 509 of those bytes make up the
• 3:05
  encrypted payload. Here's the kicker.
• 3:08
  That encrypted portion relies completely on that synchronized
• 3:11
  counter, remaining utterly undisturbed as the cell travels
• 3:14
  from the entry router to the middle router, and finally to
• 3:17
  the exit router. Keep this tucked in the back of
• 3:19
  your mind, because this synchronization is exactly what
• 3:22
  the attackers are going to target.
• 3:24
  Which brings us to Section 3, the replay attack explained
• 3:28
  executing the cyber heist. All right, let's see how this
• 3:32
  all comes together. Imagine a normal Torque
• 3:34
  connection flowing along smoothly.
• 3:37
  But then picture an attack scenario.
• 3:39
  Here. The bad actor actually manages
• 3:41
  to take control of both the entry router and the exit router
• 3:44
  in your circuit. The malicious entry router
• 3:46
  basically waits for a data cell to come from Alice, and then
• 3:49
  does something incredibly simple but absolutely devastating.
• 3:53
  It makes a copy. It literally duplicates a single
• 3:56
  data cell and sends it right down the line, trailing right
• 3:58
  behind the original. Remember our perfectly
• 4:01
  synchronized answers from earlier?
• 4:03
  Well, sending that duplicate cell is exactly like tripping
• 4:05
  one of them right there on stage.
• 4:07
  The duplicate cell forces the AES counter at the middle and
• 4:10
  exit routers to tick forward an extra time.
• 4:13
  And just like that, suddenly the client and the routers are
• 4:15
  completely out of sync. The dominoes are starting to
• 4:18
  fall, which leads us right to a massive protocol failure because
• 4:22
  the counter is completely broken.
• 4:24
  When that stream of data reaches the malicious exit router, the
• 4:27
  decryption just fails. It throws a very recognizable
• 4:30
  protocol error. And you guys here is the
• 4:33
  absolute genius of the attack. The accomplice at the entry
• 4:36
  router logs the exact millisecond they duplicated the
• 4:39
  cell. Meanwhile, the accomplice at the
• 4:41
  exit router logs the exact millisecond they saw the
• 4:44
  decryption error. By just comparing those
• 4:46
  timestamps, they instantly prove that Alice over at the entry
• 4:49
  node is talking to Bob at the exit node.
• 4:52
  They don't even need to decrypt the traffic.
• 4:54
  No way. They just break it, watch for
• 4:56
  the crash, and unmask the users. Traditional attacks require this
• 5:00
  slow, tedious statistical analysis of traffic.
• 5:03
  But this, this is instant. Let's move to Section 4, testing
• 5:08
  the exploit, proving the concept in the real world.
• 5:11
  Of course, we all know it's one thing to map out a grand heist
• 5:14
  on a chalkboard, right? But does it actually work out
• 5:17
  there in the wild? Well, the researchers didn't
• 5:19
  just theorize about this, they went ahead and built a real
• 5:21
  world test bed to prove it. They set up an experiment using
• 5:24
  the actual live Tor network. They placed a malicious entry
• 5:27
  router right on a university campus and set up a malicious
• 5:30
  exit router off campus to simulate a genuinely distributed
• 5:33
  attack environment. Then they ran a client and
• 5:35
  server application through this highly controlled setup to see
• 5:38
  if they could actually reliably detect the communication.
• 5:41
  Now you might be thinking, well surely it's incredibly difficult
• 5:44
  to become an entry router on the Tor network in the 1st place.
• 5:48
  Actually, scratch that, it's not.
• 5:51
  At the time of this research, the median bandwidth for Tor
• 5:54
  Onion routers was a surprisingly low 57 kilobytes per second.
• 5:58
  I mean, think about that. The researcher spun up a node
• 6:01
  with just 200 kilobytes per second, and within five days the
• 6:04
  Tor network automatically promoted it to an entry guard.
• 6:07
  The barrier to entry for an attacker here is shockingly low.
• 6:11
  Now, what's really interesting about this data is the perfectly
• 6:14
  straight diagonal trend line that emerges in cybersecurity.
• 6:18
  Let's be real, you almost never see perfect data.
• 6:20
  There's always some noise. But here, the correlation
• 6:23
  between the exact time the cell was duplicated at the entry and
• 6:27
  the time the error was detected at the exit is utterly flawless.
• 6:30
  The correlation coefficient, or R, is exactly 1.
• 6:34
  It's a perfect match. This absolutely proves the
• 6:37
  replay attack isn't just some academic theory.
• 6:39
  It is 100% accurate, and it's devastatingly fast.
• 6:42
  Why? Because it only requires
• 6:44
  duplicating a single cell to blow a user's cover.
• 6:47
  And finally, Section 5, defending the Tor network.
• 6:51
  Upgrading the vault. So OK, our digital vault clearly
• 6:55
  has a fatal flaw. But thankfully, the researchers
• 6:58
  didn't just break the system and walk away laughing.
• 7:01
  To help close these vault doors, they suggested a few absolutely
• 7:04
  crucial upgrades. First up, implementing much
• 7:07
  stricter authentication for who even gets to become an entry
• 7:09
  router. Second, the network really needs
• 7:12
  to proactively monitor and validate the bandwidth routers
• 7:15
  claimed to have. This prevents attackers from
• 7:17
  just spinning up hundreds of fake nodes, which is a tactic
• 7:20
  known as a Sybil attack. And finally, they suggest
• 7:23
  configuring middle routers to buffer and actively monitor for
• 7:25
  duplicate cells, or maybe having clients monitor for abnormally
• 7:28
  frequent circuit tear bounds. Because as we know now, those
• 7:31
  tear downs are a telltale sign that an AES counter has been
• 7:34
  tripped by an attacker. However, we do have to look at
• 7:37
  this impartially. As the paper itself points out,
• 7:40
  these defenses, they are not silver bullets.
• 7:42
  Stricter bandwidth checks will definitely stop a lazy attacker
• 7:45
  for sure. But if an adversary, say, I
• 7:47
  don't know, a really well funded state actor has the actual
• 7:51
  resources, they can legitimately contribute the high bandwidth
• 7:54
  required to become a trusted node.
• 7:57
  Because at the end of the day, the fundamental architecture of
• 7:59
  Tor still relies on that very delicate AES counter.
• 8:02
  Which really leaves us with a profound final thought.
• 8:05
  This research brilliantly highlights the endless cat and
• 8:08
  mouse game of cybersecurity. Every vault is completely secure
• 8:12
  right up until the exact moment someone builds a better drill.
• 8:15
  So I'll leave you with this question.
• 8:17
  Is true online anonymity a permanent state that we can
• 8:20
  technologically guarantee forever?
• 8:22
  Or is it really just a temporary illusion waiting for the next
• 8:25
  clever exploit to be published? Thank you so much for joining me
• 8:28
  for this explainer, and remember to always keep questioning the
• 8:30
  systems you trust.