Latest / CyberPodcast / Detecting Sybils in Tor with SybilHunter | Paper Breakdown #13 | CyberPodcast

Transcript

Detecting Sybils in Tor with SybilHunter | Paper Breakdown #13 | CyberPodcast · CyberPodcast

• 0:00
  Welcome to this technical explainer.
• 0:02
  Today we're diving deep into the forensic mechanics of detecting
• 0:05
  malicious node syndicates within the Tor network.
• 0:08
  We'll be exploring the groundbreaking methodologies
• 0:10
  that researchers have developed to shine a light into the
• 0:13
  darkest corners of decentralized systems, exposing attackers who
• 0:17
  try to gain the network through sheer numbers.
• 0:19
  If you love a good technical deep dive, you are absolutely in
• 0:23
  for a treat today. Here is our road map for the
• 0:26
  breakdown. We're going to look at the Sybil
• 0:27
  threat, the Sybil Hunter architecture, churn analysis,
• 0:31
  the uptime matrix, the nearest neighbor algorithm, and finally,
• 0:35
  the culprits revealed. Let's jump right into it.
• 0:37
  Section 1, the Sybil threat. First, we really need to
• 0:41
  understand exactly why decentralized networks are
• 0:44
  vulnerable in the first place. You see, because decentralized
• 0:48
  systems fundamentally lack a central gatekeeper or, you know,
• 0:51
  a trusted identity authority, an attacker can simply spin up
• 0:54
  multiple fake relays. It's basically like cloning a
• 0:57
  digital army. By doing this, they capture a
• 0:59
  massive slice of the network's traffic flow, all while looking
• 1:02
  like totally independent, unconnected volunteers.
• 1:06
  And that's absolutely crucial to understand because with enough
• 1:09
  nodes under their thumb, attackers can do some real
• 1:11
  damage. They can intercept traffic
• 1:13
  leaving the network to sniff unencrypted credentials.
• 1:16
  They can infer web traffic patterns, harvest hidden bridge
• 1:19
  addresses meant to bypass censorship, or even run end to
• 1:21
  end correlation attacks to just completely deanonymize a user's
• 1:25
  web history. It's a massive, massive
• 1:27
  structural vulnerability. Moving to Section 2, the Sybil
• 1:31
  Hunter architecture. This is the forensic toolkit
• 1:35
  designed to catch these invisible threats.
• 1:37
  So how do we catch them? Well, the architecture starts
• 1:40
  with a huge pile of historical data.
• 1:43
  Sybil Hunter ingests hourly network consensuses, which are
• 1:46
  essentially just snapshots of all the running relays, along
• 1:49
  with router descriptors that detail exactly how each node is
• 1:52
  configured. On top of that, it pulls in
• 1:54
  known malicious nodes found by a separate active scanning tool
• 1:57
  called Exit Map. This whole shebang creates the
• 2:00
  foundational database for the hunt.
• 2:02
  The data pipeline itself is honestly incredibly elegant.
• 2:06
  It takes over 100 gigabytes of raw compressed network data,
• 2:10
  which is a ton of information, filters it all down, and then
• 2:13
  feeds it through highly targeted algorithmic modules.
• 2:16
  These modules work independently to spot different kinds of
• 2:19
  anomalies. Then they cross reference their
• 2:21
  findings to isolate highly suspicious clusters of relays.
• 2:24
  Section 3. Churn analysis or tracking
• 2:28
  network turnover over time. Now the math here is super
• 2:32
  fascinating. Think about it, if you just
• 2:34
  measure net growth, an unusually high number of joining relays
• 2:37
  could perfectly cancel out an unusually high number of leaving
• 2:40
  relays, totally hiding the anomaly, right?
• 2:43
  So to avoid that trap, the formula uses set theory to
• 2:46
  calculate distinct churn values for joins and leaves.
• 2:49
  It finds the relays present in the current consensus, but not
• 2:52
  the previous one, and perfectly bounds that final value between
• 2:56
  zero and 10, meaning no change, and one, meaning complete
• 2:59
  turnover. And that math gives us a stark
• 3:02
  contrast in network realities. On one hand, you might have a
• 3:05
  smooth, flat hill in new relays that represents a natural,
• 3:09
  gradual update across the network over several days, like
• 3:12
  when operators slowly patched their systems after the
• 3:15
  Heartbleed bug. But then look at a sharp, sudden
• 3:17
  spike. There is no way that's natural.
• 3:20
  That is exactly what it looks like when a single attacker
• 3:23
  dumps a massive batch of Sybil notes onto the network, all at
• 3:26
  the exact same hour. Which brings us to Section 4,
• 3:29
  the uptime matrix. This is how we actually
• 3:31
  visualize the evidence. Here's a little secret.
• 3:34
  Sybil operators are lazy. They tend to administer, update,
• 3:38
  and reboot their nodes at the exact same time.
• 3:41
  Sybil Hunter treats the online or offline status of every
• 3:44
  single node as a binary sequence over time.
• 3:47
  It then uses something called single linkage clustering,
• 3:50
  driven by Pearson's correlation coefficient, to mathematically
• 3:53
  measure the distance between these sequences.
• 3:56
  IF2 sequences change together perfectly, their distance is 0.
• 3:59
  And the algorithm neatly places those relays right next to each
• 4:02
  other. The result is basically a
• 4:04
  literal crime scene photo. Imagine a matrix where every
• 4:08
  column is a single relay, and every row represents an hour in
• 4:11
  time. Black means online, white means
• 4:14
  offline. When the algorithm sorts them by
• 4:17
  correlation, the stark bright red blocks emerge out of
• 4:20
  nowhere. Those blocks exposed to stint
• 4:23
  groups of relays going offline and returning online in perfect,
• 4:26
  completely unnatural synchronization.
• 4:29
  For instance, researchers caught a really specific anomaly back
• 4:32
  in 2012. It showed a perfect diurnal step
• 4:35
  pattern, exactly 9 hours on followed by 15 hours off.
• 4:39
  I mean, that's not a random network fluctuation.
• 4:41
  That behavior betrays an automated botnet acting
• 4:44
  identically across roughly 100 infected computers in Russia and
• 4:48
  Germany, switching on and off with rigid daily precision.
• 4:51
  All right, Section 5. The nearest neighbor algorithm.
• 4:55
  How we find an attacker's partners in crime?
• 4:58
  Once we catch 1 bad node, the crucial next step is automating
• 5:01
  the search across thousands of configuration files to find the
• 5:05
  rest. The nearest neighbor algorithm
• 5:07
  does this by concatenating a node's configuration parameters
• 5:11
  like its nickname, IP address, and port into a single
• 5:14
  continuous texturing. Then it compares strings against
• 5:17
  each other to measure the difference.
• 5:20
  It uses the Levenstein distance metric to calculate the absolute
• 5:23
  minimum number of character edits required to match one
• 5:26
  string to another. For those two exact strings we
• 5:28
  just saw, it takes precisely 6 operations, some combination of
• 5:32
  insertions, deletions, or modifications to make them
• 5:34
  identical. By running this calculation
• 5:36
  against every single relay in the network, we get a concrete
• 5:39
  mathematical similarity score. It instantly bubbles up
• 5:42
  identically configured nodes, completely exposing attackers
• 5:45
  who thought they had sufficiently randomized their
• 5:46
  setups. Finally, section 6, the culprits
• 5:50
  revealed. Time to look at the real world
• 5:52
  adversaries. Applying these incredible
• 5:55
  forensic tools over 9 years of historical network data was
• 5:58
  like, well, turning on a black light in a very dirty hotel
• 6:01
  room. We uncovered massive active
• 6:03
  syndicates. There was the rewrite group
• 6:05
  which spun up over 70 nodes. They used brute force partial
• 6:08
  hashes to create fake web domains, actively running man in
• 6:11
  the middle attacks to hijack Bitcoin transactions.
• 6:13
  Then there was a sprawling Windows botnet named Default,
• 6:16
  identified by the nearest neighbor search utilizing
• 6:19
  hundreds of infected consumer PCs.
• 6:21
  And incredibly, the lizard NSA group, which was spotted
• 6:24
  instantly via churn and uptime analysis, actually flooded the
• 6:27
  network with over 4600 identical nodes hosted in the Google
• 6:31
  Cloud. Tools like Sybil Hunter give us
• 6:33
  a massive forensic advantage, mathematically shining a light
• 6:36
  into the shadows. But it leaves us with a huge
• 6:39
  question. As long as the barrier to entry
• 6:41
  remains intentionally low to protect the anonymity of honest
• 6:44
  volunteers, can a decentralized network ever truly be immune to
• 6:48
  Sybils without relying on a centralized, trusted authority?
• 6:52
  It's a lingering fundamental architectural puzzle for the
• 6:54
  future of distributed systems, and honestly, something we all
• 6:58
  need to keep thinking about.