One Cell is Enough to Break Tor’s Anonymity Cell is Enough to Break Tor’s Anonymity Xinwen Fu...
Transcript of One Cell is Enough to Break Tor’s Anonymity Cell is Enough to Break Tor’s Anonymity Xinwen Fu...
One Cell is Enough to
Break Tor’s Anonymity
Xinwen Fu University of Massachusetts Lowell
Team members Zhen Ling, Southeast University
Junzhou Luo, Southeast University Wei Yu, Cisco Systems Inc.
Weijia Jia, City Univ. of Hong Kong Wei Zhao, Univ. of Macau
Black Hat DC 2009 Xinwen Fu@UMass Lowell 2/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 3/41
Internet Security
Internet has brought convenience to our everyday lives
Internet has many design vulnerabilities Malicious codes (worm and viruses) caused
$13.2 billions in financial losses worldwide in 2001
We need to understand these attacks and design corresponding countermeasures
We present our research on a new type of attack against anonymous communication systems
Black Hat DC 2009 Xinwen Fu@UMass Lowell 4/41
Traditional Spy Network
Indirectly send secret to Intelligence headquarter through a number of intermediate agents
Protect the intelligence agent (i.e., source of secret) from being identified
Intelligence Center
Black Hat DC 2009 Xinwen Fu@UMass Lowell 5/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 6/41
Tor A great Internet anonymous communication
network
Volunteer operation model Volunteers around the world donate their computers and
network bandwidth Those donated computers form the Tor network based
on the Tor protocol Those computers in the Tor network relay user
messages down to the destination
Users of Tor Human rights workers Many others: refer to Tor website https://
www.torproject.org/torusers.html.en/
Black Hat DC 2009 Xinwen Fu@UMass Lowell 7/41
Components of Tor
Client: the user of the Tor network
Server: the target TCP applications such as web servers
Tor (onion) router: the special proxy relays the application data
Directory server: servers holding Tor router information
Black Hat DC 2009 Xinwen Fu@UMass Lowell 8/41
How Tor Works? --- Circuits Alice herself chooses the relay routers and creates
circuits through the relay routers Circuit --- communication tunnel from Alice to Bob These circuits are dedicated for Alice
Can the routers along the circuit or a third party find communication relationship by checking the packet header?
Black Hat DC 2009 Xinwen Fu@UMass Lowell 9/41
How Tor Works? --- Onion Routing Alice Bob
OR2
OR1
M √ M
A circuit is built incrementally one hop by one hop Onion-like encryption
Alice negotiates an AES key with each router Messages are divided into equal sized cells Each router knows only its predecessor and successor Only the Exit router (OR3) can see the message,
however it does not know where the message is from
M
OR3
M
C1 C2
C2 C3
C3 Port
Black Hat DC 2009 Xinwen Fu@UMass Lowell 10/41
Detailed Circuit Setup Steps: One-Hop Circuit Alice (OP) Bob
Entry OR (OR1)
Middle OR (OR2)
Exit OR (OR3)
Create C1, E(g^x1)
Created C1, g^y1, H(K1)
t t t t t
Legend: E(x) --- RSA encryption {X} --- AES encryption CN --- a circuit ID numbered N
(link is TLS-encrypted)
Black Hat DC 2009 Xinwen Fu@UMass Lowell 11/41
Two-Hop Circuit
Create C1, E(g^x1)
Created C1, g^y1, H(K1)
Relay C1, {Extend, OR2,
E(g^x2)}
Create C2, E(g^x2)
Created C2 g^y2, H(K2)
Relay C1, {Extended,
g^y2, H(K2)}
t t t t t
Legend: E(x) --- RSA encryption {X} --- AES encryption CN --- a circuit ID numbered N
Alice (OP) Bob
Entry OR (OR1)
Middle OR (OR2)
Exit OR (OR3)
(link is TLS-encrypted) (link is TLS-encrypted)
Black Hat DC 2009 Xinwen Fu@UMass Lowell 12/41
Three-Hop Circuit Alice (OP) Bob
Entry OR (OR1)
Middle OR (OR2)
Exit OR (OR3)
Create C1, E(g^x1)
Created C1, g^y1, H(K1)
Relay C1, {Extend, OR2, E(g^x2)}
Create C2, E(g^x2)
Created C2 g^y2, H(K2)
Relay C1, {Extended, g^y2, H(K2)}
t t t t t
Relay C1, {{Extend, OR3,
E(g^x2)}}
Relay C2, {Extend, OR3,
E(g^x2)}
Relay C2 {Extended,
g^y3, H(K3)}
Relay C1, {{Extended,
g^y3, H(K3)}}
Create C3, E(g^x2)
Created C3 g^y3, H(K3)
Legend: E(x) --- RSA encryption {X} --- AES encryption CN --- a circuit ID numbered N
(link is TLS-encrypted) (link is TLS-encrypted)
(link is TLS-encrypted)
Black Hat DC 2009 Xinwen Fu@UMass Lowell 13/41
Connection Setup Example Alice (OP) Bob
Entry OR (OR1)
Middle OR (OR2)
Exit OR (OR3)
Relay C1, {{{Begin<IP, Port>}}}
Relay C2, {{Begin<IP, Port>}}
Relay C3, {Begin<IP, Port>}
TCP Handshake <IP, Port>
Relay C3, {Connected}
Relay C2, {{Connected}}
Relay C1, {{{Connected}}}
Relay C1, {{{Data, “Hello”}}}
Relay C2, {{Data, “Hello”}}
Relay C3, {Data, “Hello”} “Hello”
Relay C1, {{{End, Reason}}}
Relay C2, {{End, Reason>}}
Relay C3, {End, Reason}
TCP Teardown
t t t t t
(link is TLS-encrypted) (link is TLS-encrypted) (link is TLS-encrypted)
(unencrypted) C1 C2 C2 C3 C3 Port
Black Hat DC 2009 Xinwen Fu@UMass Lowell 14/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 15/41
Problem Definition of Attacks against Tor
Alice is sending messages to Bob through an encrypted and anonymous circuit, how can Evil confirm the communication relationship between Alice and Bob?
Bob Alice Tor
Network
Evil
Black Hat DC 2009 Xinwen Fu@UMass Lowell 16/41
Attack Methodology
If the attacker can determine circuit segments C1 and C3 belong to the same circuit, the attacker confirms the communication relationship for sure Entry knows where the packet comes from and Exit knows
where the packet goes
Black Hat DC 2009 Xinwen Fu@UMass Lowell 17/41
AES Counter – Normal Case
A message comes from Alice through Circuit Segment C1, and goes to Bob after Circuit Segment C3
An AES counter is synchronized through the circuit
Alice Bob Entry Router (OR1)
Exit Router (OR3) C1 C2 C3
t t t
Middle Router (OR2)
t
K K
t
K K
K+1 K+1 K+1 K+1
Black Hat DC 2009 Xinwen Fu@UMass Lowell 18/41
AES Counter – Replay Attack Case
Replayed message causes a (special) decryption error at the end of circuit C3 at Eve 2 The duplicated message disrupts the counter
Therefore, Circuits C1 and C3 are created by Alice Claim: Alice is communicating with Bob
Alice Bob Eve 1
at Entry Router Eve 2
at Exit Router
C1 C2 C3
t t t t
Middle Router
K
K+1
t
K+1
K K K
M
Black Hat DC 2009 Xinwen Fu@UMass Lowell 19/41
AES Counter – Deletion Attack Case
The cell after the deleted cell causes decryption error
Alice Bob Eve 1
at Entry Router Eve 2
at Exit Router
C1 C2 C3
t t t t
Middle Router
K+1
t
K+1
K+1
K+2 K+2
K K K K
K+1
Black Hat DC 2009 Xinwen Fu@UMass Lowell 20/41
AES Counter – Insert Attack Case
The inserted cell causes decryption error
Alice Bob Eve 1
at Entry Router Eve 2
at Exit Router
C1 C2 C3
t t t t
Middle Router
K+1
t
K+1
K K K K
Black Hat DC 2009 Xinwen Fu@UMass Lowell 21/41
AES Counter – Modify Attack Case
The modified cell causes decryption error
Alice Bob Eve 1
at Entry Router Eve 2
at Exit Router
C1 C2 C3
t t t t
Middle Router
t
K K K K
Black Hat DC 2009 Xinwen Fu@UMass Lowell 22/41
Issues in Attacks Above Which cells and when to manipulate
The circuit is torn down when there is decryption error
How to make attack stealthy Broken circuits may render Alice’s attention
Black Hat DC 2009 Xinwen Fu@UMass Lowell 23/41
Which Cells and When to Manipulate
Target data cells after the circuit is built Identify protocol status by counting cells
Alice (OP) Bob
Entry OR (OR1)
Middle OR (OR2)
Exit OR (OR3)
Relay C1, {{{Begin<IP, Port>}}}
Relay C2, {{Begin<IP, Port>}}
Relay C3, {Begin<IP, Port>}
TCP Handshake <IP, Port>
Relay C3, {Connected}
Relay C2, {{Connected}}
Relay C1, {{{Connected}}}
Relay C1, {{{Data, “Hello”}}}
Relay C2, {{Data, “Hello”}}
Relay C3, {Data, “Hello”} “Hello”
Relay C1, {{{End, Reason}}}
Relay C2, {{End, Reason>}}
Relay C3, {End, Reason} TCP Teardown
t t t t t
(link is TLS-encrypted) (link is TLS-encrypted) (link is TLS-encrypted) (unencrypted)
Black Hat DC 2009 Xinwen Fu@UMass Lowell 24/41
How to Make Attack Stealthy Insert and replay attacks are very flexible and
can be made stealthy can be applied freely
When there is no traffic and a circuit is idle (the circuit already carried target traffic)
At the end of the lifetime of a circuit Default lifetime is 10 minutes Before teardown While holding teardown commands
Black Hat DC 2009 Xinwen Fu@UMass Lowell 25/41
Experiment Setup
One computer was setup as an exit router It takes two days for our second computer
to become an entry router
Black Hat DC 2009 Xinwen Fu@UMass Lowell 26/41 26/15
Decryption Error Time v.s. Duplication Time
Black Hat DC 2009 Xinwen Fu@UMass Lowell 27/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 28/41
Impact Metrics: probability that a circuit chooses
malicious Tor routers A circuit chooses a malicious entry and exit, it
is done
Attackers can do the following in order to increase the probability Scheme 1: Inject (donate) high-bandwidth
routers into the Tor network Scheme 2: Compromise high-bandwidth Tor
routers into the Tor network
Black Hat DC 2009 Xinwen Fu@UMass Lowell 29/41
Big Impact: 9% v.s. 60%
Black Hat DC 2009 Xinwen Fu@UMass Lowell 30/41
Protocol-level Attack v.s. Brute Force Attack Brute force attack: attackers occupy all routers on a circuit
Black Hat DC 2009 Xinwen Fu@UMass Lowell 31/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 32/41
Hard to Defend No easy way to defend against replay,
insert, delete and modify attacks because of the anonymity maintained here The attacks are flexible can be deployed at any
moment during the life time of a connection What if attackers just attack for DoS?
Careful routing protocols Choose routers in different countries or regions
in order to prevent a single organization from deploying the attack
Black Hat DC 2009 Xinwen Fu@UMass Lowell 33/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 34/41
Many Attacks
Packet level
[WCJ07]
Traceback over Anonymity networks
Flow level
[YFG+07]
Content Level
[Chr06]
Protocol Level
[PYFW08]
Host Level
[Mur06]
Black Hat DC 2009 Xinwen Fu@UMass Lowell 35/41
Tagging Attacks Outside attackers mark attacks: use TLS to
guarantee integrity Protocol-level attacks are by inside attackers
Black Hat DC 2009 Xinwen Fu@UMass Lowell 36/41
Outline Introduction Basic components and operation of Tor Protocol-level attacks Impact of protocol-level attacks Guideline of countermeasures Related work Summary
Black Hat DC 2009 Xinwen Fu@UMass Lowell 37/41
Summary We identified a class of new attack, protocol-level
attack, against anonymous communication network Tor Need only one cell to confirm the communication
relationship One attack can confirm multiple connections using the
same circuit Confirmation is a sure thing (100%)
Our experiments validate the feasibility and effectiveness of all attacks
The impact is huge Given 9% percent of Tor routers are malicious, over
60% of the connections can be compromised
Black Hat DC 2009 Xinwen Fu@UMass Lowell 38/41
Future Work
Develop countermeasure against the protocol-level attack Tor is a pioneer software for on-line privacy
Fight the abuse of Tor (forensic traceback) Anonymous networks may be abused Government has resource and donates high-
performance routers and bandwidth to Tor in exchange of necessary surveillance
The abuse of Tor threatens Tor
Black Hat DC 2009 Xinwen Fu@UMass Lowell 39/41
Acknowledgment
Tor developers Other Tor researchers
Black Hat DC 2009 Xinwen Fu@UMass Lowell 40/41
References [Chr06] A. Christensen, Practical Onion Hacking: finding the real address of Tor
clients, http://packetstormsecurity.org/0610-advisories/Practical_Onion_Hacking.pdf, Oct. 2006
[DMP04] R. Dingledine, N. Mathewson, and P. Syverson, Tor: The second-generation onion router, in Proceedings of the 13th USENIX Security Symposium, 2004
[Mur06] Steven J. Murdoch, Hot or Not: Revealing Hidden Services by their Clock Skew, In Proceedings of ACM CCS, 2006
[PNR05] P. Peng, P. Ning, and D. S. Reeves, On the secrecy of timing-based active watermarking trace-back techniques, in Proceedings of the IEEE Security and Privacy Symposium (S&P), 2006
[PYFW08] Ryan Pries, W. Yu, Xinwen Fu and W. Zhao, A New Replay Attack Against Anonymous Communication Networks, In Proceedings of the IEEE International Conference on Communications (ICC), China, May 19-23, 2008 (Best paper award)
[WCJ07] X. Wang, S. Chen , and S. Jajodia, Network flow watermarking attack on low-latency anonymous communication systems, in Proceedings of the IEEE Security and Privacy Symposium (S&P), 2007
[YFG+07] W. Yu, Xinwen Fu, S. Graham, Dong Xuan, and W. Zhao, DSSS-based flow marking technique for invisible traceback, in Proceedings of the IEEE Security and Privacy Symposium (S&P), 2007
Black Hat DC 2009 Xinwen Fu@UMass Lowell 41/41 Xinwen Fu 41/15
Thank you!
Xinwen Fu
Black Hat DC 2009 Xinwen Fu@UMass Lowell 42/41
Cell Format in Tor