Passive-Logging Attacks Against Anonymous Communications Systems

Abstract

Using analysis, simulation, and experimentation, we examine the threat against anonymous communications posed by passive-logging attacks. In previous work, we analyzed the success of such attacks under various assumptions. Here, we evaluate the effects of these assumptions more closely. First, we analyze the Onion Routing-based model used in prior work in which a fixed set of nodes remains in the system indefinitely. We show that for this model, by removing the assumption of uniformly random selection of nodes for placement in the path, initiators can greatly improve their anonymity. Second, we show by simulation that attack times are significantly lower in practice than bounds given by analytical results from prior work. Third, we analyze the effects of a dynamic membership model, in which nodes are allowed to join and leave the system; we show that all known defenses fail more quickly when the assumption of a static node set is relaxed. Fourth, intersection attacks against peer-to-peer systems are shown to be an additional danger, either on their own or in conjunction with the predecessor attack. Finally, we address the question of whether the regular communication patterns required by the attacks exist in real traffic. We collected and analyzed the Web requests of users to determine the extent to which basic patterns can be found. We show that, for our study, frequent and repeated communication to the same Web site is common.

References

1. <scp>Bächer, P., Holz, T., Kötter, M., and Wicherski, G.</scp> 2005. Know your enemy: Tracking botnets. http://www.honeynet.org/papers/bots. The Honeynet Project and Research Alliance.
2. <scp>Back, A., Goldberg, I., and Shostack, A.</scp> 2000. Freedom 2.0 security issues and analysis. White paper. Zero-Knowledge Systems, Inc.
3. <scp>Baryshnikov, Y., Coffman, E., Pierre, G., Rubenstein, D., Squillante, M., and Yimwadsana, T.</scp> 2005. Predictability of Web-Server traffic congestion. In &lt;it&gt;Proceedings of the International Workshop on Web Content Caching and Distribution (WCW'05)&lt;/it&gt;. 97--103.
4. <scp>Bauer, K., McCoy, D., Grunwald, D., Kohno, T., and Sicker, D.</scp> 2007. Low-resource routing attacks against anonymous systems. Tech. rep. CU-CS-1025-07, University of Colorado at Boulder.
5. <scp>Bellissimo, A., Shenoy, P., and Levine, B. N.</scp> 2004. Exploring the use of BitTorrent as the basis for a large trace repository. Tech. rep. 04-41, Department of Computer Science, University of Massachusetts at Amherst.
6. <scp>Berthold, O., Federrath, H., and Köhntopp, M.</scp> 2000. Project Anonymity and unobservability in the Internet. In &lt;it&gt;Proceedings of Computers Freedom and Privacy Conference (CFP'00)&lt;/it&gt;. 57--65.
7. <scp>Berthold, O. and Langos, H.</scp> 2002. Dummy traffic against long term intersection attacks. In &lt;it&gt;Proceedings of Workshop on Privacy Enhancing Technologies (PET'02)&lt;/it&gt;. 110--128.
8. <scp>Bissias, G. D., Liberatore, M., and Levine, B. N.</scp> 2005. Privacy vulnerabilities in encrypted HTTP streams. In &lt;it&gt;Proceedings of Workshop on Privacy Enhancing Technologies (PET'05)&lt;/it&gt;. 1--11.
9. <scp>Chaum, D.</scp> 1988. The dining cryptographers problem: Unconditional sender and recipient untraceability. &lt;it&gt;J. Crypto. 1,&lt;/it&gt; 1, 65--75.
10. <scp>Chu, J., Labonte, K., and Levine, B. N.</scp> 2002. Availability and locality measurements of peer-to-peer file systems. In &lt;it&gt;Proceedings ITCom: Scalability and Traffic Control in IP Networks II Conference&lt;/it&gt;. Vol. SPIE 4868. 310--321.
11. <scp>Danezis, G.</scp> 2003. Statistical disclosure attacks: Traffic confirmation in open environments. In &lt;it&gt;Proceedings of Security and Privacy in the Age of Uncertainty (SEC'03)&lt;/it&gt;. 421--426.
12. <scp>Danezis, G.</scp> 2004. The Traffic analysis of continuous-time mixes. In &lt;it&gt;Proceedings Workshop on Privacy Enhancing Technologies (PET'04)&lt;/it&gt;. 35--50.
13. <scp>Danezis, G., Dingledine, R., and Mathewson, N.</scp> 2003. Mixminion: design of a type III anonymous remailer protocol. In &lt;it&gt;Proceedings of the IEEE Symposium on Security and Privacy&lt;/it&gt;. 2--15.
14. <scp>Davison, B.</scp> 2002. Predicting Web actions from HTML content. In &lt;it&gt;Proceedings of the ACM Conference on Hypertext and Hypermedia (HT'02)&lt;/it&gt;. 159--168.
15. <scp>Díaz, C., Seys, S., Claessens, J., and Preneel, B. </scp> 2002. Towards measuring anonymity. In &lt;it&gt;Proceedings of the Workshop on Privacy Enhancing Technologies (PET'02)&lt;/it&gt;. 184--188.
16. <scp>Diaz, F. and Allan, J.</scp> 2003. Browsing-based user language models for information retrieval. Tech. rep. CIIR IR-279, University of Massachusetts at Amherst.
17. <scp>Dingledine, R. and Mathewson, N.</scp> 2007. Tor path specification. http://tor.eff.org/svn/trunk/doc/spec/path-spec.txt.
18. <scp>Dingledine, R., Mathewson, N., and Syverson, P.</scp> 2004. TOR: The next-generation onion router. In &lt;it&gt;Proceedings of USENIX Security Symposium&lt;/it&gt;. 303---320.
19. <scp>Douceur, J. R.</scp> 2002. The Sybil attack. In &lt;it&gt;Revised Papers from the 1st International Workshop on Peer-to-Peer Systems&lt;/it&gt;. Springer-Verlag, 251--260.
20. <scp>Duchamp, D.</scp> 1999. Prefetching hyperlinks. In &lt;it&gt;Proceedings of the USENIX Symposium on Internet Technologies and Systems&lt;/it&gt;. 127--138.
21. <scp>Figueiredo, D. R., Nain, P., and Towsley, D.</scp> 2004. On the analysis of the predecessor attack on anonymous protocols. Tech. rep. 04-65, Department of Computer Science. University of Massachusetts.
22. <scp>Freedman, M. and Morris, R.</scp> 2002. Tarzan: A peer-to-peer anonymizing network layer. In &lt;it&gt;Proceedings of the ACM Conference on Computer and Communications Security (CCS'02)&lt;/it&gt;. 193--206.
23. <scp>Goldberg, I. and Wagner, D.</scp> 1998. TAZ servers and the rewebber network: Enabling anonymous publishing on the World Wide Web. &lt;it&gt;First Monday&lt;/it&gt;.
24. <scp>Goldschlag, D., Reed, M., and Syverson, P.</scp> 1996. Hiding routing information. In &lt;it&gt;Proceedings of Information Hiding Workshop (IH'96)&lt;/it&gt;. 137--150.
25. <scp>Gribble, S.</scp> 1997. UC Berkeley home IP HTTP traces. http://www.acm.org/sigcomm/ITA/.
26. <scp>Hintz, A.</scp> 2002. Fingerprinting websites using traffic analysis. In &lt;it&gt;Proceedings of the Workshop on Privacy Enhancing Technologies (PET'02)&lt;/it&gt;. Springer-Verlag, Lecture Notes in Computer Science, vol. 2482, 229--233.
27. Honeynet Project 2005. Know your enemy: Tracking botnets -- spreading. http://www.honeynet.org/papers/bots/botnet-spreading.html. The Honeynet Project and Research Alliance.
28. <scp>Kesdogan, D., Agarwal, D., and Penz, S.</scp> 2002. Limits of anonymity in open environments. In &lt;it&gt;Proceedings of Information Hiding, 5th International Wkshp (IH'02)&lt;/it&gt;. 53--69.
29. <scp>Kesdogan, D., Egner, J., and Büschkes, R.</scp> 1998. Stop-and-go-MIXes providing probabilistic anonymity in an open system. In &lt;it&gt;Information Hiding&lt;/it&gt;. Lecture Notes in Computer Science, vol. 1525. Springer, 83--98.
30. <scp>Köpsellbibt, S.</scp> 2003. JAP --- Web mixes. http://www.petworkshop.org/2003/slides/panels/stefan-PET2003panel.pdf.
31. <scp>Levine, B., Reiter, M., Wang, C., and Wright, M.</scp> 2004. Timing attacks in low-latency mix systems. In &lt;it&gt;Proceedings of Financial Cryptography (FC'04).&lt;/it&gt; (Lecture Notes in Computer Science, vol. 3110). 251---265.
32. <scp>Levine, B. and Shields, C.</scp> 2002. Hordes: A protocol for anonymous communication over the Internet. &lt;it&gt;ACM J. Comput. Secur. 10,&lt;/it&gt; 3, 213--240.
33. <scp>Liberatore, M. and Levine, B. N.</scp> 2006. Inferring the source of encrypted HTTP connections. In &lt;it&gt;Proceedings of the ACM Conference on Computer and Communications Security (CCS'06)&lt;/it&gt;. 255--263.
34. <scp>Margolin, N. B. and Levine, B. N.</scp> 2007. Informant: Detecting sybils using incentives. In &lt;it&gt;Proceedings of Financial Cryptography (FC'07)&lt;/it&gt;.
35. <scp>Mathewson, N. and Dingledine, R.</scp> 2004. Practical traffic analysis: Extending and resisting statistical disclosure. In &lt;it&gt;Proceedings of the Workshop on Privacy Enhancing Technologies (PET'04)&lt;/it&gt;. Lecture Notes in Computer Science, vol. 3424. 17--34.
36. <scp>Murdoch, S. J.</scp> 2006. Hot or not: Revealing hidden services by their clock skew. In &lt;it&gt;Proceedings of the ACM Conference on Computer and Communications Security&lt;/it&gt;. 27--36.
37. <scp>Murdoch, S. J. and Danezis, G.</scp> 2005. Low-cost traffic analysis of Tor. In &lt;it&gt;Proceedings of the IEEE Symposium on Security and Privacy&lt;/it&gt;. 183--195.
38. <scp>Øverlier, L. and Syverson, P.</scp> 2006. Locating hidden servers. In &lt;it&gt;Proceedings of the IEEE Symposium on Security and Privacy&lt;/it&gt;. 100--114.
39. <scp>Raymond, J. F.</scp> 2001. Traffic analysis: Protocols, attacks, design issues and open problems. In &lt;it&gt;International Workshop on Design Issues in Anonymity and Unobservability&lt;/it&gt;. Lecture Notes in Computer Science, vol. 2009. Springer, 10--29.
40. <scp>Reiter, M. K. and Rubin, A. D.</scp> 1998. Crowds: Anonymity for Web transactions. &lt;it&gt;ACM Trans. Inform. Syst. Secur. 1,&lt;/it&gt; 1, 66--92.
41. <scp>Rennhard, M. and Plattner, B.</scp> 2004. Practical anonymity for the masses with MorphMix. In &lt;it&gt;Proceedings of Financial Cryptography (FC'04)&lt;/it&gt;. 233--250.
42. <scp>Saroiu, S., Gummadi, P. K., and Gribble, S.</scp> 2002. A measurement study of peer-to-peer file sharing systems. In &lt;it&gt;Proceedings of the Multimedia Computing and Networking Conference (MMCN'02)&lt;/it&gt;. 314--329.
43. <scp>Scarlatta, V., Levine, B., and Shields, C.</scp> 2001. Responder anonymity and anonymous peer-to-peer file sharing. In &lt;it&gt;Proceedings of the IEEE International Conference on Network Protocols (ICNP'01)&lt;/it&gt;.
44. <scp>Serjantov, A. and Danezis, G.</scp> 2002. Towards an information theoretic metric for anonymity. In &lt;it&gt;Proceedings of the Workshop on Privacy Enhancing Technologies (PET'02)&lt;/it&gt;. Lecture Notes in Computer Science, vol. 2482. 259--263.
45. <scp>Serjantov, A. and Sewell, P.</scp> 2003. Passive attack analysis for connection-based anonymity systems. In &lt;it&gt;Proceedings of the European Symposium on Research in Computer Security (ESORICS'03)&lt;/it&gt;. 116--131.
46. <scp>Sherwood, R., Bhattacharjee, B., and Srinivasan, A.</scp> 2005. P5: a protocol for scalable anonymous communication. &lt;it&gt;J. Comput. Secur. 13,&lt;/it&gt; 6, 839--876.
47. <scp>Shmatikov, V.</scp> 2002. Probabilistic analysis of anonymity. In &lt;it&gt;IEEE Computer Security Foundations Workshop&lt;/it&gt;. 119--128.
48. <scp>Sun, Q., Simon, D. R., Wang, Y.-M., Russell, W., Padmanabhan, V. N., and Qiu, L.</scp> 2002. Statistical identification of encrypted Web browsing traffic. In &lt;it&gt;Proceedings of the IEEE Symposium on Security and Privacy&lt;/it&gt;. 19--30.
49. <scp>Syverson, P., Tsudik, G., Reed, M., and Landwehr, C.</scp> 2000. Towards an analysis of onion routing security. In &lt;it&gt;Proceedings Workshop on Design Issues in Anonymity and Unobservability&lt;/it&gt;. Lecture Notes in Computer Science, vol. 2009. 96--114.
50. <scp>The Graphic, Visualization, and Usability Center</scp>. 1998. GVU's 10th WWW User Survey. http://www-static.cc.gatech.edu/user_surveys/survey-1998-10.
51. <scp>Wright, M., Adler, M., Levine, B. N., and Shields, C.</scp> 2002. An analysis of the degradation of anonymous protocols. In &lt;it&gt;Proceedings of ISOC Network and Distributed System Security Symposium (NDSS'02)&lt;/it&gt;. 38--50.
52. <scp>Wright, M., Adler, M., Levine, B. N., and Shields, C.</scp> 2003. Defending anonymous communication against passive logging attacks. In &lt;it&gt;Proceedings of the IEEE Symposium on Security and Privacy&lt;/it&gt;. 28--41.
53. <scp>Wright, M., Adler, M., Levine, B. N., and Shields, C.</scp> 2004. The predecessor attack: An analysis of a threat to anonymous communications systems. &lt;it&gt;ACM Trans. Inform. Syst. Secur. 4,&lt;/it&gt; 7, 489--522.

Index Terms

• Software and its engineering

  • Software organization and properties

    • Software system structures

      • Distributed systems organizing principles

        • Organizing principles for web applications