Latest / CyberPodcast / How Low-Resource Attackers Can Break Tor Routing | Paper Breakdown #11 | CyberPodcast

Transcript

How Low-Resource Attackers Can Break Tor Routing | Paper Breakdown #11 | CyberPodcast · CyberPodcast

• 0:00
  OK, let's just dive right into this.
• 0:02
  Welcome to today's Explainer, where we're going to unpack a
• 0:05
  brilliant, highly technical, and frankly kind of alarming study
• 0:09
  on computer security. We're looking at how a
• 0:11
  surprisingly elegant low resource heist can be pulled off
• 0:15
  against the world's most famous anonymity network, Tor.
• 0:19
  We're talking about unmasking the identities behind secure
• 0:22
  traffic, and get this not by using massive government
• 0:26
  supercomputers, but literally just using standard residential
• 0:29
  cable and a really clever understanding of how TOR's
• 0:32
  underlying algorithms actually work.
• 0:35
  So to really grasp this attack, we first need to quickly touch
• 0:38
  on TOR's core mechanism, which is onion routing.
• 0:41
  When you send data through Tor, your proxy wraps your messages
• 0:44
  in layers of encryption. You know, exactly like the
• 0:46
  layers of an onion. As your data bounces through the
• 0:49
  network, each stop along the way strips off just one single layer
• 0:52
  of encryption, step by step. This hides the user data and
• 0:56
  completely obscures where the traffic originally came from and
• 0:59
  where it's ultimately headed. Here's our quick road map for
• 1:02
  today's explainer. We'll start with Tors
• 1:04
  architecture, look at the load balancing problem, breakdown the
• 1:07
  infiltration and execution phases of the attack, check out
• 1:10
  the actual results, and wrap up with defenses and
• 1:13
  countermeasures. Let's jump into Section 1, Tors
• 1:16
  architecture just to establish our baseline of how things are
• 1:19
  supposed to work. A standard tour circuit relies
• 1:22
  on three very specific hops to obscure your traffic.
• 1:26
  First, your proxy connects to an entry router, also known as a
• 1:29
  guard. Note this one is specifically
• 1:31
  picked from a pool of stable, reliable servers.
• 1:34
  From there, your traffic jumps to a middle router and finally
• 1:37
  to an exit router. That exit router decrypts the
• 1:40
  very last layer and sends the unencrypted packet to its final
• 1:44
  destination. The whole genius of this is that
• 1:46
  no single node knows both who you are and what website you're
• 1:50
  actually looking at. Which brings us to Section 2,
• 1:53
  the load balancing problem. It's the classic tech battle of
• 1:57
  seed versus anonymity. There is a massive core tension
• 2:01
  here. In Tor's original design,
• 2:03
  routers were selected uniformly at random.
• 2:05
  Now, mathematically, this provided fantastic anonymity.
• 2:09
  But as the network grew, it became agonizingly slow.
• 2:12
  To fix this, Tor introduced an updated design with a load
• 2:15
  balancing mechanism. This new algorithm
• 2:17
  probabilistically favors routers that advertise high bandwidth
• 2:20
  and high up time. It completely optimized the
• 2:23
  network for low latency, making it actually usable for everyday
• 2:26
  browsing. But in doing so, it accidentally
• 2:28
  created a massive structural vulnerability, and this quote
• 2:31
  right here brilliantly captures the attacker's mindset.
• 2:34
  The researchers realize something crazy.
• 2:36
  Tor's trusted directory servers don't actually verify the
• 2:39
  bandwidth and uptime that a node claims to have.
• 2:42
  It's wild, but if a malicious node simply lies to the network
• 2:45
  and exaggerates its resources, Tor's own routing algorithm will
• 2:48
  naturally funnel a totally unfair percentage of the
• 2:50
  network's traffic right to it. So how is this actually executed
• 2:55
  in the real world? Let's move to Section 3 Phase 1
• 2:58
  infiltration and see how these ethical hackers set up the
• 3:01
  heist. The set up is honestly
• 3:03
  remarkably efficient. Step 1.
• 3:06
  The attackers deploy low resource nodes.
• 3:08
  We are literally talking about running these off standard
• 3:10
  residential cable modems. Step 2.
• 3:12
  They configure these cheap nodes to broadcast fake massive
• 3:16
  bandwidth and uptime stats to the directory servers.
• 3:18
  Step 3. And this is the deviously
• 3:20
  brilliant part. If one of their malicious nodes
• 3:23
  ends up on a circuit, but they don't control both the entry and
• 3:26
  the exit, they simply drop the connection.
• 3:28
  This forces a selective path disruption, making the client
• 3:31
  rebuild the circuit over and over until probabilistically,
• 3:34
  the attacker's nodes land in both the entry and exit
• 3:37
  positions. In this attack model, the goal
• 3:40
  is perfect positioning. The attackers want to control
• 3:43
  both the entry guard and the exit nodes simultaneously.
• 3:46
  By doing this, they've successfully tricked the network
• 3:48
  into handing them the two most sensitive critical positions in
• 3:52
  the entire circuit. Once they've infiltrated those
• 3:55
  key spots, we enter Section 4, phase two linking paths.
• 3:59
  This is the execution. Now for a proper technical
• 4:03
  explanation of how this works under the hood, building a
• 4:06
  tourist circuit happens in three distinct chronologically strict
• 4:10
  steps, building to the entry, extending to the middle, and
• 4:14
  extending to the exit. Because this deterministic
• 4:17
  sequence of packets happens with such tight time bounds during
• 4:20
  the handshake phase, it creates a highly distinctive pattern.
• 4:24
  It's basically a perfect readable fingerprint that the
• 4:27
  malicious nodes can easily recognize.
• 4:30
  While observing that exact packet sequence, the malicious
• 4:33
  routers are quietly logging 8 specific data points for every
• 4:36
  single cell received. We're talking local time stamps,
• 4:39
  previous IPS, next top circuit IDs, the whole shebang.
• 4:43
  By logging these specific data points, a centralized malicious
• 4:46
  authority can simply look at the data from the entry node,
• 4:49
  compare it to the data from the exit node, run a quick matching
• 4:52
  algorithm, and definitively link the sender to the receiver.
• 4:55
  Boom, anonymity gone. And here is absolutely the most
• 4:59
  devastating part of the whole thing.
• 5:01
  The exploit correlates the traffic before any payload data
• 5:04
  is even transmitted. Because the attacker is only
• 5:06
  analyzing that initial circuit setup phase, they don't even
• 5:09
  need the bandwidth to handle actual heavy data streams.
• 5:12
  Once they've logged the connection and identified you,
• 5:14
  they can just severely rate limit the connection to preserve
• 5:17
  their own meager cable modem bandwidth while still having
• 5:19
  successfully unmasked. The user theory is great and
• 5:22
  all, but let's look at Section 5, the attack results, and dive
• 5:26
  into the actual hard data from a controlled 60 node Planet Lab
• 5:30
  test network. The data clearly proves that
• 5:33
  load balancing caused this vulnerability to completely
• 5:36
  skyrocket. Mathematically, if routers were
• 5:39
  still selected uniformly at random like in towards old
• 5:41
  design, the predicted compromise rate with this number of
• 5:44
  malicious nodes would be a tiny negligible .7%.
• 5:48
  But in reality, under the newer bandwidth optimized model, this
• 5:52
  experimental attack compromised over 46% of the paths.
• 5:56
  To put that 46% into perspective for a second, just six low
• 6:00
  resource cheap malicious nodes effectively compromised nearly
• 6:04
  half of all circuits requested by new clients on the entire
• 6:07
  test network. That is an absolutely massive
• 6:10
  return on investment for a hacker using minimal computing
• 6:13
  power. Furthermore, the researchers
• 6:15
  pointed out that attackers can escalate this even further.
• 6:18
  They could flood the network with hundreds of fake nodes all
• 6:21
  sitting on a single IP address, which is known as a Sybil
• 6:24
  attack. Because an entry guard is
• 6:26
  required to have a bandwidth above the network median,
• 6:29
  flooding the system with fake high bandwidth nodes
• 6:32
  artificially inflates that median, which completely pushes
• 6:35
  out legitimate entry guards. They can also use denial of
• 6:38
  service attacks to force clients to pick new malicious guards, or
• 6:42
  use time based watermarking if they're trying to monitor
• 6:44
  traffic to 1 specific target website.
• 6:47
  OK, so how do we actually harden the system against this kind of
• 6:52
  manipulation? Let's cover section 6 defenses
• 6:56
  and countermeasures. The researchers outlined a few
• 6:59
  key countermeasures. The most obvious one is forcing
• 7:01
  the network to actually verify bandwidth claims rather than
• 7:04
  just blindly taking routers at their word.
• 7:07
  They also suggested limiting the number of Tor nodes allowed on a
• 7:10
  single IP address, and actually Tor adopted this specific fix
• 7:13
  shortly after this research was published.
• 7:15
  To mitigate those Sybil attacks, they also suggested exploring
• 7:18
  alternative routing strategies, things like proximity routing or
• 7:21
  local reputation based routing. But here's the catch 22 the most
• 7:25
  direct fix, actively auditing the bandwidth of thousands of
• 7:29
  nodes would completely crush towards directory servers.
• 7:32
  It requires continuous monitoring, and the sheer
• 7:35
  traffic load would create a massive performance bottleneck.
• 7:38
  So fixing the security brings us right back to our original
• 7:41
  problem of the network being too slow to actually use.
• 7:45
  Which leaves us with this final, really tough question to ponder,
• 7:49
  bringing this whole technical explainer full circle, Anonymity
• 7:52
  and efficient resource use appear to be in direct
• 7:55
  opposition to one another. If we cannot easily verify trust
• 7:58
  without completely killing the network's performance, are you
• 8:01
  willing to sacrifice your Internet speed for true absolute
• 8:04
  anonymity? Thanks for joining me to unpack
• 8:06
  this fascinating architecture today and keep questioning how
• 8:09
  your data really moves out there.