Security News > 2021 > November > Researchers Demonstrate New Fingerprinting Attack on Tor Encrypted Traffic

A new analysis of website fingerprinting attacks aimed at the Tor web browser has revealed that it's possible for an adversary to glean a website frequented by a victim, but only in scenarios where the threat actor is interested in a specific subset of the websites visited by users.

Tor browser offers "Unlinkable communication" to its users by routing internet traffic through an overlay network, consisting of more than six thousand relays, with the goal of anonymizing the originating location and usage from third parties conducting network surveillance or traffic analysis.

While the Tor clients themselves are not anonymous with respect to their entry relays, because the traffic is encrypted and the requests jump through multiple hops, the entry relays cannot identify the clients' destination, just as the exit nodes cannot discern a client for the same reason.

Website fingerprinting attacks on Tor aim to break these anonymity protections and enable an adversary observing the encrypted traffic patterns between a victim and the Tor network to predict the website visited by the victim.

The threat model devised by the academics presupposes an attacker running an exit node - so as to capture the diversity of traffic generated by real users - which is then used as a source to collect Tor traffic traces and devise a machine-learning-based classification model atop the gathered information to infer users' website visits.

The adversary model involves an "Online training phase that uses observations of genuine Tor traffic collected from an exit relay to continuously update the classification model over time," explained the researchers, who ran entry and exit relays for a week in July 2020 using a custom version of Tor v0.4.3.5 to extract the relevant exit information.

News URL

https://thehackernews.com/2021/11/researchers-demonstrate-new.html