Latest / CyberPodcast / RAPTOR: How Internet Routing Attacks Can Break Tor | Paper Breakdown #17 | CyberPodcast

Transcript

RAPTOR: How Internet Routing Attacks Can Break Tor | Paper Breakdown #17 | CyberPodcast · CyberPodcast

• 0:00
  Hey everyone, welcome to this explainer.
• 0:02
  Today we're diving into something absolutely wild in the
• 0:05
  world of network security. We're going to break down
• 0:08
  exactly how the fundamental routing infrastructure of the
• 0:11
  Internet itself can actually be exploited to completely bypass
• 0:14
  towards cryptographic anonymity. So gear up for a deep technical
• 0:18
  dive that is definitely going to change how you look at online
• 0:21
  privacy. All right, really quick.
• 0:23
  Here's our road map for today. We'll start with the anonymity
• 0:26
  myth, then breakdown the Raptor attacks themselves, cover
• 0:29
  asymmetric traffic analysis, look at exploiting BGP dynamics,
• 0:33
  shift over to active interception, and finally, we'll
• 0:35
  wrap up with the defense countermeasures.
• 0:38
  OK, Section 1, the anonymity myth, the baseline of Tor
• 0:41
  routing. Let's set the stage here.
• 0:43
  Think about this for a second. How can you deanonymize a
• 0:46
  completely secure, encrypted network without actually
• 0:50
  breaking the encryption itself? You know, we basically just
• 0:53
  assume that SSL or TLS guarantees absolute privacy.
• 0:56
  But actually, scratch that, the application layer is really only
• 1:00
  half the story. To really get this, we have to
• 1:02
  understand what an autonomous system or AS actually is.
• 1:06
  This is the crucial technical vocabulary for everything we're
• 1:08
  about to discuss. Think of an AS as a massive
• 1:11
  network or cluster of networks, usually run by a major Internet
• 1:14
  service provider. These systems talk to each other
• 1:17
  using BGP, the Border Gateway protocol.
• 1:20
  Basically, BGP is the internet's GPS.
• 1:23
  It's the underlying logic deciding the exact physical
• 1:25
  paths that your data packets take around the globe.
• 1:28
  Moving on to Section 2, Raptor attacks, the disruption.
• 1:32
  This is where things get really interesting.
• 1:35
  So traditional traffic analysis attacks are what we call
• 1:38
  symmetric. That means an adversary has to
• 1:40
  physically observe the traffic on both ends of the path at the
• 1:43
  exact same time. So from the user to Tor, and
• 1:46
  then from Tor to the final server.
• 1:49
  Honestly, that's incredibly difficult to pull off in the
• 1:51
  real world. But these novel Raptor attacks,
• 1:54
  they're total game changer. They introduce brand new BGP
• 1:57
  based vectors, proving that symmetric attacks are really
• 2:00
  just the tip of the iceberg compared to asymmetric analysis,
• 2:04
  BGP churn and active hijacks. Section 3.
• 2:07
  Asymmetric traffic analysis, the technical deep dive.
• 2:11
  Let's look at the actual mechanics of how this works.
• 2:14
  Now you might be wondering, doesn't Tor's encryption stop
• 2:17
  this while the payload is encrypted?
• 2:19
  Yes, but the underlying TCP headers?
• 2:21
  Those are just sitting right there in plain text.
• 2:24
  By observing those unencrypted headers, an attacker can simply
• 2:26
  extract the TCP sequence and acknowledgement numbers.
• 2:29
  It's like reading the tracking numbers on a perfectly sealed
• 2:32
  envelope. By correlating those endpoints
• 2:34
  over time, the cumulative TCP acknowledgements leak massive
• 2:37
  amounts of usable data. They can perfectly track the
• 2:40
  connection even though they have zero clue what the actual
• 2:42
  message says. And the result of this
• 2:45
  correlation technique? It's honestly staggering.
• 2:48
  Experimental data shows that this asymmetric traffic analysis
• 2:52
  can deanonymize a Tor user with 95% accuracy.
• 2:56
  And get this, that comes with literally zero false positives.
• 3:01
  All right, Section 4. Exploiting BGP dynamics.
• 3:05
  The threat of natural churn. Let's see how the Internet
• 3:08
  itself helps the attacker. You see, Internet routing isn't
• 3:12
  static. It's actually inherently
• 3:14
  chaotic. We call this phenomenon BGP
• 3:17
  churn. Natural routing changes are
• 3:19
  happening constantly due to routine link failures or ISP
• 3:22
  policy shifts. Because of this, an increasing
• 3:25
  number of Tor users are automatically exposed to AS
• 3:28
  level adversaries over time. Because these BGP paths are
• 3:31
  dynamically shifting around, a passive attacker doesn't even
• 3:34
  have to lift a finger, they literally just have to sit there
• 3:36
  and wait, and eventually the Internet will just naturally
• 3:39
  route that traffic right through their surveillance nodes.
• 3:42
  To put that into perspective, just factoring in the routing
• 3:45
  asymmetry increases an attacker's surveillance capacity
• 3:48
  by 50%, but when you add in that natural chaotic BGP churn, their
• 3:53
  capability grows by a full 100% over the course of a single
• 3:57
  month. That is a massive expansion of
• 3:59
  threat surface for doing absolutely nothing.
• 4:02
  Section 5. Active interception and
• 4:04
  hijacking, escalating the attack.
• 4:07
  This is where the adversary stops being passive.
• 4:10
  The crucial distinction to make here is between a BGP hijack and
• 4:13
  ABGP interception. In a traditional hijack, the
• 4:17
  attacker forcefully reroutes the traffic, but the connection just
• 4:20
  drops or gets black holed. It's noisy interception, on the
• 4:23
  other hand, is so much more insidious.
• 4:26
  The traffic is actively routed to the attacker for analysis,
• 4:29
  and then here's the kicker, it is silently forwarded back to
• 4:32
  the legitimate tour guard relay. It keeps the connection
• 4:35
  perfectly alive, the client gets the anonymized, and nobody
• 4:38
  notices a single thing. So how bad is the exposure here?
• 4:42
  Over 90% of Tor relays are highly vulnerable to these
• 4:45
  specific active manipulations. 9 out of 10, and it all boils down
• 4:49
  to the specific way their IP prefixes are currently
• 4:52
  configured at that fundamental BGP protocol level.
• 4:56
  Finally, section 6 defense countermeasures The patch.
• 5:00
  How do we actually fight back against this?
• 5:03
  To catch these attacks, we absolutely need a 2 pronged
• 5:07
  detection framework. On the theoretical side, we need
• 5:10
  control plane monitoring. This means analyzing massive BGP
• 5:14
  routing tables via services like route views, using specific time
• 5:18
  and frequency heuristics to spot anomalies.
• 5:21
  But that's not enough on its own.
• 5:23
  On the physical side, we need data plane monitoring.
• 5:25
  This involves running constant trace route tests globally,
• 5:28
  using hundreds of Planet Lab nodes to detect the actual
• 5:32
  physical shifts in the data path.
• 5:34
  But detection is one thing, prevention is another.
• 5:37
  The ultimate fix for Tor operators is surprisingly
• 5:40
  straightforward. Configure the relays to
• 5:43
  advertise exactly slash 24 prefixes.
• 5:46
  Right now, most relays use prefixes shorter than a slash
• 5:49
  24. Attackers exploit this because
• 5:51
  in Internet routing, the most specific route always wins.
• 5:54
  However, autonomous systems universally filter out anything
• 5:57
  longer than a slash 24. So if an operator advertises
• 6:00
  exactly that slash 24 prefix, it completely prevents the hijack.
• 6:04
  It mathematically blocks the attacker's ability to broadcast
• 6:07
  a more specific overriding route.
• 6:09
  Boom, attack mitigated. So what do the Raptor attacks
• 6:13
  ultimately teach us? Well, they prove that encryption
• 6:15
  alone just isn't enough. If fundamental Internet routing
• 6:18
  protocols can effortlessly bypass our best application
• 6:21
  level encryption, are any of our current anonymity systems truly
• 6:25
  secure without real network level awareness?
• 6:27
  Security doesn't exist in a vacuum, completely disconnected
• 6:30
  from the actual tracks the data travels on.
• 6:32
  I'll leave you to chew on that one.
• 6:34
  Thanks so much for joining me for this explainer and as always
• 6:36
  keep exploring.