Latest / CyberPodcast / How Website Fingerprinting Can Break Tor Anonymity | Paper Breakdown #12 | CyberPodcast

Transcript

How Website Fingerprinting Can Break Tor Anonymity | Paper Breakdown #12 | CyberPodcast · CyberPodcast

• 0:00
  Welcome to today's Explainer. We are heading straight to the
• 0:02
  very edges of cryptography and network security.
• 0:06
  You know, we often think of advanced anonymity networks as
• 0:08
  these impenetrable fortresses. But what happens when brilliant
• 0:11
  minds start looking for the invisible cracks in those walls?
• 0:14
  Today we're going to unpack a really fascinating research
• 0:17
  paper by Yi Shi and Kanta Matsura from the University of
• 0:20
  Tokyo, And we're looking at their highly technical attempts
• 0:23
  to completely break the anonymity of the Tor network.
• 0:26
  Let's start with a very specific #512 In the world of Tor, 512
• 0:31
  bytes is the fixed size of a data cell.
• 0:34
  This standard, uniform block of data is literally the
• 0:36
  foundational building block of Tors supposedly impenetrable
• 0:39
  shield. Everything you send, everything
• 0:41
  you receive, it's all chopped up and packed into these identical
• 0:44
  512 byte boxes to completely obscure what they actually are.
• 0:48
  So let's dive into this Does perfect online anonymity
• 0:52
  actually exist? Or is this 512 byte shield
• 0:55
  really just an illusion of mathematics, one that can be
• 0:58
  completely shattered by a dedicated, clever observer?
• 1:01
  To figure that out, here's our road map for this explainer.
• 1:04
  We'll kick things off with the illusion of privacy, examine the
• 1:07
  absolute limits of traditional fingerprinting, dig deep into
• 1:11
  the technical explanation of the attack itself, evaluate the real
• 1:14
  world results, and finally weigh the possible countermeasures.
• 1:18
  Let's get right to it Section 1 the illusion of privacy.
• 1:23
  Let's establish Tor's gold standard.
• 1:25
  To understand how to break a system, we first need to
• 1:28
  strictly define the battlefield through its technical defenses.
• 1:31
  Tor, which stands for The Onion Router, is a low latency
• 1:35
  anonymity system. It protects user identities
• 1:38
  using multi hop encrypted connections.
• 1:40
  But the two absolutely crucial technical features for our deep
• 1:44
  dive today are multiplexing, which is combining multiple
• 1:47
  connections into one single stream, and its use of those
• 1:50
  quantized 512 byte data cells we just talked about.
• 1:54
  Look at the stark contrast between standard web browsing
• 1:57
  and Tor browsing. Normally when you visit a
• 1:59
  website, your browser downloads an HTML file, maybe some images,
• 2:02
  a video, all via separate TCP connections.
• 2:06
  An observer on the network can easily see the exact file sizes
• 2:09
  crossing the wire, but with Tor it's a totally different story.
• 2:12
  All those separate requests are multiplexed into a single TCP
• 2:16
  stream and chopped into those identical 512 byte cells.
• 2:20
  The unique distinct file sizes of a web page are just
• 2:23
  completely hidden behind this uniform wall of data.
• 2:26
  Moving on to Section 2, the limit of fingerprinting, let's
• 2:31
  look through the attacker's eyes.
• 2:33
  Fingerprinting itself is actually quite an old concept.
• 2:36
  Back in 2003, a researcher named HINTS proved that you could
• 2:40
  identify a website just by looking at the unique
• 2:43
  combination of file sizes it sends to a user.
• 2:46
  If a site sends a 1300 byte file, a 500 byte file, and a
• 2:49
  32,000 byte file, well, that specific combination is its
• 2:53
  fingerprint. But against Tor's multiplexed
• 2:55
  architecture and fixed 512 byte cells, that conventional HINTS
• 2:59
  method totally fails. You literally can't measure
• 3:02
  exact file sizes anymore, because everything just looks
• 3:05
  like a continuous, unbroken stream of identically sized
• 3:07
  blocks. But here's the thing about
• 3:10
  attackers. They adapt.
• 3:12
  The researchers behind this paper designed a highly
• 3:14
  realistic threat model. Unlike end to end confirmation
• 3:17
  attacks, which require an attacker to impossibly control
• 3:20
  both the entry and exit points of the entire global Tor
• 3:22
  network, this adversary only needs to occupy the entry point.
• 3:26
  That's it. From there, they just observe
• 3:28
  the traffic flowing from the user in a simple 2 responder
• 3:31
  scenario. Let's say the user is visiting
• 3:33
  either Alice or Bob. The attacker starts with a
• 3:36
  simple 1/2 probability of guessing correctly, and this
• 3:39
  brilliantly illustrates how the threat model actually scales up.
• 3:42
  Instead of just Alice and Bob, what if the user is visiting one
• 3:45
  of N possible responders? The adversary just uses the
• 3:49
  anonymity system themselves beforehand to visit these N
• 3:52
  responders and build a profile. Because the attacker only needs
• 3:55
  to monitor the user's entry point, this attack requires
• 3:57
  vastly fewer resources than trying to be some omnipotent
• 4:00
  global eavesdropper. Section 3.
• 4:03
  The technical explanation of the attack.
• 4:05
  This right here is the core breakthrough.
• 4:08
  Since the attacker cannot use file sizes at all, they have to
• 4:11
  shift their focus entirely to packet intervals.
• 4:14
  Let's walk through this methodology methodically.
• 4:16
  Step 1. The attacker observes the
• 4:18
  traffic flow right at the entry router.
• 4:21
  Step 2, they identify the outflow packets.
• 4:23
  That's the data sent from the user out to the network.
• 4:26
  Step three, they count all the continuous inflow packets that
• 4:29
  arrive between those outflows. This uninterrupted sequence of
• 4:32
  incoming data, That is exactly what the researchers precisely
• 4:35
  define as an interval. Let's give these intervals some
• 4:38
  real world meaning. If you observe a short interval,
• 4:41
  say just one or two inflow packets, before the user sends
• 4:43
  another outflow packet, that usually represents a small
• 4:47
  protocol transaction or a basic acknowledgement.
• 4:49
  But long intervals, like 5 or more continuous packets, that
• 4:53
  means a larger file is being transferred.
• 4:55
  It's ultimately filling up the data buffer, which is known as
• 4:58
  the TCP sliding window, before the user's machine is forced to
• 5:01
  send an acknowledgement back. These spaces between packets
• 5:05
  essentially act as a structural fingerprint for websites,
• 5:08
  literally turning the rhythm of the traffic into a detectable
• 5:10
  signature. Now let's look at the math and
• 5:13
  see how this builds into an incredibly effective attack.
• 5:16
  The attacker turns a live traffic flow into a mathematical
• 5:19
  vector labeled V Each element in this vector V sub I represents
• 5:24
  the number of intervals that contained exactly I packets.
• 5:28
  They then compare the users live traffic vector against a pre
• 5:31
  recorded fingerprint vector F that the attacker already built
• 5:34
  earlier. They apply a weight W based on
• 5:36
  the total number of intervals and then calculate a similarity
• 5:39
  score S using the specific formula outlined here.
• 5:43
  The website fingerrint with the highest similarity score that is
• 5:46
  the attacker's best calculated guess for what the user is
• 5:48
  currently browsing. Section 4 Evaluation An real
• 5:52
  world results. Let's see how this math holds U
• 5:54
  in the wild. The researchers tested this
• 5:57
  theory on the Alexa top 20 sites in Japan.
• 6:00
  Look at the success rate trend here.
• 6:02
  When the target pool of websites N is small, say at n = 5, the
• 6:07
  success rate is extraordinarily high.
• 6:09
  But as the number of target websites scales up to 1015 and
• 6:13
  20, the success rate drops off significantly.
• 6:16
  So why does the accuracy drop so sharply in a live network
• 6:20
  environment? Well, there are practical
• 6:22
  limitations that cause the false positive and false negative
• 6:24
  rates to spike. First, tours multiplexing means
• 6:28
  the interval data points are fundamentally limited.
• 6:30
  Second, dynamic content completely ruins stable
• 6:33
  fingerprints. Think about YouTube constantly
• 6:35
  changing its video recommendations, or websites
• 6:37
  serving different banner ads every refresh. 3rd, a lot of
• 6:41
  modern home pages just have very similar architectural layouts.
• 6:44
  And finally, standard practical network noise just gets in the
• 6:47
  way of clean interval reading. So the crucial take away here is
• 6:51
  this. Theoretically and practically,
• 6:53
  this interval attack can reliably single out a user's
• 6:56
  destination from a pool of about 20 to 40 specific web pages.
• 7:00
  Beyond that point, the noise overtakes the signal, but think
• 7:04
  about the real world implications of that.
• 7:06
  If an attacker just wants to know if you are visiting one
• 7:08
  specific whistle blowing site or a specific medical forum out of
• 7:11
  a targeted watch list of 30 sites, this low resource attack
• 7:15
  is dangerously effective. Finally, Section 5,
• 7:19
  countermeasures and defenses. Can we actually fix this?
• 7:22
  We can start by immediately dismissing some superficial
• 7:25
  fixes. You might be thinking, well, why
• 7:28
  not just change the torso size from 5:12 to 10/24 bytes?
• 7:32
  Actually, scratch that, it won't work.
• 7:34
  Modifying the fixed cell size won't stop the attack because
• 7:37
  the underlying TCP architecture remains exactly the same.
• 7:40
  It still wraps data into 1500 byte Ethernet packets, so the
• 7:43
  intervals wouldn't even change. OK, what about forcing odd
• 7:47
  requests like having users turn off scripts or manually block
• 7:50
  images? Sure, while that breaks the
• 7:52
  fingerprint, it relies on users actively disabling features.
• 7:55
  You simply cannot base system security on the hope that users
• 7:57
  will behave perfectly. The most technically viable
• 8:00
  defense is something called defensive dropping.
• 8:03
  This involves injecting dummy packets directly into the
• 8:06
  traffic stream that are specifically programmed to be
• 8:08
  dropped before they ever reach the destination.
• 8:11
  The security benefit here is incredibly high.
• 8:13
  It completely disrupts the attackers interval mapping,
• 8:16
  throwing off those exact vector calculations we explored
• 8:18
  earlier. However, you have to weigh that
• 8:21
  against the resource cost. Flooding the network with fake
• 8:23
  traffic is cripplingly prohibitive for a low latency
• 8:26
  network like Tor that relies entirely on volunteer bandwidth.
• 8:30
  Which brings us to a really uncomfortable trade off.
• 8:32
  To truly defeat a sophisticated fingerprinting attack like this,
• 8:36
  you have to inject so much random noise that the network
• 8:38
  slows to an absolute crawl. So we'll leave you with this
• 8:41
  provocative thought. Is absolute, mathematically
• 8:44
  perfect online privacy actually worth a crippled, unusable
• 8:48
  network? Or do we just have to accept
• 8:50
  that as long as data flows and patterns, someone, somewhere is
• 8:53
  going to find a way to read them?
• 8:55
  Thank you for joining us for today's Exlainer and keep
• 8:57
  questioning the limits of technology.