[tor-dev] RAPTOR: Routing Attacks on Privacy in Tor

[Prateek Mittal]

All,

Our team at Princeton has been working on "Raptor: routing attacks on
privacy in Tor". These attacks can be launched by Autonomous System
(AS)-level adversaries, and exploit the dynamics of inter-domain routing.
We show that by exploiting routing asymmetry, routing churn, and routing
vulnerabilities (such as BGP hijacks and BGP interceptions), user anonymity
can be compromised much more effectively than previously thought. We
evaluated these attacks using historical BGP and Traceroute data, as well
as by performing real-world attacks on the live-Tor network, without
harming real Tor users.

Our technical report is available at: http://arxiv.org/abs/1503.03940,
feedback is most welcome.

While all of our attacks have consequences for user anonymity, attacks
based on BGP interceptions are particularly dangerous for the Tor network.
These attacks allow an adversary to intercept Tor traffic "on demand",
regardless of the adversary's network location. Our work demonstrates such
an attack -- with success, on the live Tor network. We find that 90% of the
Tor relays have a BGP prefix shorter than /24, enabling an adversary to
advertise a more specific prefix for them, which is propagated *globally*.

Countermeasures against interception attacks are challenging: we outline a
number of ideas including advertising Tor relays with /24 prefixes,
building frameworks to monitor the control plane and dataplane of Tor
relays to detect such attacks (we have started to build such monitoring
frameworks at Princeton), and in the long term -- aiming to speed up the
deployment of secure inter-domain routing protocols in the Internet.

Thanks,
Prateek


-- 
Prateek Mittal
Assistant Professor
Princeton University
http://www.princeton.edu/~pmittal/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20150316/534062ef/attachment.html>