One Cell is Enough to Break Tor’s Anonymity Xinwen Fu University of Massachusetts Lowell Team members Zhen Ling, Southeast University Junzhou Luo, Southeast University Wei Yu, Cisco Systems Inc. Weijia Jia, City Univ. of Hong Kong Wei Zhao, Univ. of Macau

Black Hat DC 2009 Xinwen Lowell 2/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 3/41 Internet Security  Internet has brought convenience to our everyday lives  Internet has many design vulnerabilities Malicious codes (worm and viruses) caused $13.2 billions in financial losses worldwide in 2001  We need to understand these attacks and design corresponding countermeasures  We present our research on a new type of attack against anonymous communication systems

Black Hat DC 2009 Xinwen Lowell 4/41 Traditional Spy Network  Indirectly send secret to Intelligence headquarter through a number of intermediate agents  Protect the intelligence agent (i.e., source of secret) from being identified Intelligence Center

Black Hat DC 2009 Xinwen Lowell 5/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 6/41 Tor  A great Internet anonymous communication network  Volunteer operation model Volunteers around the world donate their computers and network bandwidth Those donated computers form the Tor network based on the Tor protocol Those computers in the Tor network relay user messages down to the destination  Users of Tor Human rights workers Many others: refer to Tor website

Black Hat DC 2009 Xinwen Lowell 7/41 Components of Tor  Client: the user of the Tor network  Server: the target TCP applications such as web servers  Tor (onion) router: the special proxy relays the application data  Directory server: servers holding Tor router information

Black Hat DC 2009 Xinwen Lowell 8/41 How Tor Works? --- Circuits  Alice herself chooses the relay routers and creates circuits through the relay routers Circuit --- communication tunnel from Alice to Bob These circuits are dedicated for Alice  Can the routers along the circuit or a third party find communication relationship by checking the packet header? C1 C2 C3

Black Hat DC 2009 Xinwen Lowell 9/41 How Tor Works? --- Onion Routing Alice Bob OR2 OR1 M √ M  A circuit is built incrementally one hop by one hop  Onion-like encryption Alice negotiates an AES key with each router Messages are divided into equal sized cells Each router knows only its predecessor and successor Only the Exit router (OR3) can see the message, however it does not know where the message is from M OR3 M C1 C2 C3 C1 C2 C3 Port

Black Hat DC 2009 Xinwen Lowell 10/41 Detailed Circuit Setup Steps: One-Hop Circuit Alice (OP) Bob Entry OR (OR1) Middle OR (OR2) Exit OR (OR3) Create C1, E(g^x1) Created C1, g^y1, H(K1) tttt t Legend: E(x) --- RSA encryption {X} --- AES encryption CN --- a circuit ID numbered N (link is TLS-encrypted)

Black Hat DC 2009 Xinwen Lowell 11/41 Two-Hop Circuit Create C1, E(g^x1) Created C1, g^y1, H(K1) Relay C1, {Extend, OR2, E(g^x2)} Create C2, E(g^x2) Created C2 g^y2, H(K2) Relay C1, {Extended, g^y2, H(K2)} tttt t Legend: E(x) --- RSA encryption {X} --- AES encryption CN --- a circuit ID numbered N Alice (OP) Bob Entry OR (OR1) Middle OR (OR2) Exit OR (OR3) (link is TLS-encrypted)

Black Hat DC 2009 Xinwen Lowell 12/41 Three-Hop Circuit Alice (OP) Bob Entry OR (OR1) Middle OR (OR2) Exit OR (OR3) Create C1, E(g^x1) Created C1, g^y1, H(K1) Relay C1, {Extend, OR2, E(g^x2)} Create C2, E(g^x2) Created C2 g^y2, H(K2) Relay C1, {Extended, g^y2, H(K2)} tttt t Relay C1, {{Extend, OR3, E(g^x3)}} Relay C2, {Extend, OR3, E(g^x3)} Relay C2 {Extended, g^y3, H(K3)} Relay C1, {{Extended, g^y3, H(K3)}} Create C3, E(g^x3) Created C3 g^y3, H(K3) Legend: E(x) --- RSA encryption {X} --- AES encryption CN --- a circuit ID numbered N (link is TLS-encrypted)

Black Hat DC 2009 Xinwen Lowell 13/41 Connection Setup Example Alice (OP) Bob Entry OR (OR1) Middle OR (OR2) Exit OR (OR3) Relay C1, {{{Begin }}} Relay C2, {{Begin }} Relay C3, {Begin } TCP Handshake Relay C3, {Connected} Relay C2, {{Connected}} Relay C1, {{{Connected}}} Relay C1, {{{Data, “Hello”}}} Relay C2, {{Data, “Hello”}} Relay C3, {Data, “Hello”} “Hello” Relay C1, {{{End, Reason}}} Relay C2, {{End, Reason>}} Relay C3, {End, Reason} TCP Teardown ttttt (link is TLS-encrypted) (unencrypted) C1 C2 C3 Port

Black Hat DC 2009 Xinwen Lowell 14/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 15/41 Problem Definition of Attacks against Tor  Alice is sending messages to Bob through an encrypted and anonymous circuit, how can Evil confirm the communication relationship between Alice and Bob? Bob Alice Tor Network Evil

Black Hat DC 2009 Xinwen Lowell 16/41 Attack Methodology  If the attacker can determine circuit segments C1 and C3 belong to the same circuit, the attacker confirms the communication relationship for sure Entry knows where the packet comes from and Exit knows where the packet goes C1 C2 C3

Black Hat DC 2009 Xinwen Lowell 17/41 AES Counter – Normal Case  A message comes from Alice through Circuit Segment C1, and goes to Bob after Circuit Segment C3  An AES counter is synchronized through the circuit … … … Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob Entry Router (OR1) Exit Router (OR3) C1C2C3 t tt Middle Router (OR2) t K K t K K K+1

Black Hat DC 2009 Xinwen Lowell 18/41 AES Counter – Replay Attack Case  Replayed message causes a (special) decryption error at the end of circuit C3 at Eve 2 The duplicated message disrupts the counter  Therefore, Circuits C1 and C3 are created by Alice  Claim: Alice is communicating with Bob … … … Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob Eve 1 at Entry Router Eve 2 at Exit Router C1C2C3 t t t t Middle Router K K+1 t K K K M

Black Hat DC 2009 Xinwen Lowell 19/41 AES Counter – Deletion Attack Case  The cell after the deleted cell causes decryption error … … … Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob Eve 1 at Entry Router Eve 2 at Exit Router C1C2C3 t t t t Middle Router K+1 t K+2 K K K K K+1

Black Hat DC 2009 Xinwen Lowell 20/41 AES Counter – Insert Attack Case  The inserted cell causes decryption error … … … Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob Eve 1 at Entry Router Eve 2 at Exit Router C1C2C3 t t t t Middle Router K+1 t K K K K

Black Hat DC 2009 Xinwen Lowell 21/41 AES Counter – Modify Attack Case  The modified cell causes decryption error … … … Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob, Message M KBKB KAKA … KnKn Alice K1K1 Bob Eve 1 at Entry Router Eve 2 at Exit Router C1C2C3 t t t t Middle Router t K K K K

Black Hat DC 2009 Xinwen Lowell 22/41 Issues in Attacks Above  Which cells and when to manipulate The circuit is torn down when there is decryption error  How to make attack stealthy Broken circuits may render Alice’s attention

Black Hat DC 2009 Xinwen Lowell 23/41 Which Cells and When to Manipulate  Target data cells after the circuit is built  Identify protocol status by counting cells Alice (OP) Bob Entry OR (OR1) Middle OR (OR2) Exit OR (OR3) Relay C1, {{{Begin }}} Relay C2, {{Begin }} Relay C3, {Begin } TCP Handshake Relay C3, {Connected} Relay C2, {{Connected}} Relay C1, {{{Connected}}} Relay C1, {{{Data, “Hello”}}} Relay C2, {{Data, “Hello”}} Relay C3, {Data, “Hello”} “Hello” Relay C1, {{{End, Reason}}} Relay C2, {{End, Reason>}} Relay C3, {End, Reason} TCP Teardown tt tt t (link is TLS-encrypted) (unencrypted)

Black Hat DC 2009 Xinwen Lowell 24/41 How to Make Attack Stealthy  Insert and replay attacks are very flexible and can be made stealthy can be applied freely  When there is no traffic and a circuit is idle (the circuit already carried target traffic)  At the end of the lifetime of a circuit Default lifetime is 10 minutes Before teardown While holding teardown commands

Black Hat DC 2009 Xinwen Lowell 25/41 Experiment Setup  One computer was setup as an exit router  It takes two days for our second computer to become an entry router

Black Hat DC 2009 Xinwen Lowell 26/41 26/15 Decryption Error Time v.s. Duplication Time

Black Hat DC 2009 Xinwen Lowell 27/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 28/41 Impact  Metrics: probability that a circuit chooses malicious Tor routers A circuit chooses a malicious entry and exit, it is done  Attackers can do the following in order to increase the probability Scheme 1: Inject (donate) high-bandwidth routers into the Tor network Scheme 2: Compromise high-bandwidth Tor routers into the Tor network

Black Hat DC 2009 Xinwen Lowell 29/41 Big Impact: 9% v.s. 60%

Black Hat DC 2009 Xinwen Lowell 30/41 Protocol-level Attack v.s. Brute Force Attack  Brute force attack: attackers occupy all routers on a circuit

Black Hat DC 2009 Xinwen Lowell 31/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 32/41 Hard to Defend  No easy way to defend against replay, insert, delete and modify attacks because of the anonymity maintained here The attacks are flexible can be deployed at any moment during the life time of a connection What if attackers just attack for DoS?  Careful routing protocols Choose routers in different countries or regions in order to prevent a single organization from deploying the attack

Black Hat DC 2009 Xinwen Lowell 33/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 34/41 Many Attacks Packet level [ WCJ07 ] Traceback over Anonymity networks Flow level [YFG+07] Content Level [ Chr06 ] Protocol Level [ PYFW08 ] Host Level [Mur06]

Black Hat DC 2009 Xinwen Lowell 35/41 Tagging Attacks  Outside attackers mark attacks: use TLS to guarantee integrity  Protocol-level attacks are by inside attackers

Black Hat DC 2009 Xinwen Lowell 36/41 Outline  Introduction  Basic components and operation of Tor  Protocol-level attacks  Impact of protocol-level attacks  Guideline of countermeasures  Related work  Summary

Black Hat DC 2009 Xinwen Lowell 37/41 Summary  We identified a class of new attack, protocol-level attack, against anonymous communication network Tor Need only one cell to confirm the communication relationship One attack can confirm multiple connections using the same circuit Confirmation is a sure thing (100%)  Our experiments validate the feasibility and effectiveness of all attacks  The impact is huge Given 9% percent of Tor routers are malicious, over 60% of the connections can be compromised

Black Hat DC 2009 Xinwen Lowell 38/41 Future Work  Develop countermeasure against the protocol-level attack Tor is a pioneer software for on-line privacy  Fight the abuse of Tor (forensic traceback) Anonymous networks may be abused Government has resource and donates high- performance routers and bandwidth to Tor in exchange of necessary surveillance The abuse of Tor threatens Tor

Black Hat DC 2009 Xinwen Lowell 39/41 Acknowledgment  Tor developers  Other Tor researchers

Black Hat DC 2009 Xinwen Lowell 40/41 References [Chr06]A. Christensen, Practical Onion Hacking: finding the real address of Tor clients, advisories/Practical_Onion_Hacking.pdf, Oct [DMP04]R. Dingledine, N. Mathewson, and P. Syverson, Tor: The second-generation onion router, in Proceedings of the 13th USENIX Security Symposium, 2004 [Mur06]Steven J. Murdoch, Hot or Not: Revealing Hidden Services by their Clock Skew, In Proceedings of ACM CCS, 2006 [PNR05]P. Peng, P. Ning, and D. S. Reeves, On the secrecy of timing-based active watermarking trace-back techniques, in Proceedings of the IEEE Security and Privacy Symposium (S&P), 2006 [PYFW08 ] Ryan Pries, W. Yu, Xinwen Fu and W. Zhao, A New Replay Attack Against Anonymous Communication Networks, In Proceedings of the IEEE International Conference on Communications (ICC), China, May 19-23, 2008 (Best paper award) [WCJ07]X. Wang, S. Chen, and S. Jajodia, Network flow watermarking attack on low-latency anonymous communication systems, in Proceedings of the IEEE Security and Privacy Symposium (S&P), 2007 [YFG+07]W. Yu, Xinwen Fu, S. Graham, Dong Xuan, and W. Zhao, DSSS-based flow marking technique for invisible traceback, in Proceedings of the IEEE Security and Privacy Symposium (S&P), 2007

Black Hat DC 2009 Xinwen Lowell 41/41 Xinwen Fu41/15 Thank you! Xinwen Fu

Black Hat DC 2009 Xinwen Lowell 42/41 Cell Format in Tor