The DUSTER Attack: Tor Onion Service Attribution Based on Flow Watermarking with Track Hiding

Iacovazzi, Alfonso and Frassinelli, Daniel and Elovici, Yuval
(2019) The DUSTER Attack: Tor Onion Service Attribution Based on Flow Watermarking with Track Hiding.
In: 22nd International Symposium on Research in Attacks, Intrusions and Defenses, RAID 2019, Chaoyang District, Beijing, China, September 23-25, 2019..
Conference: RAID - International Symposium on Recent Advances in Intrusion Detection

Full text not available from this repository.


Tor is a distributed network composed of volunteer relays which is designed to preserve the sender-receiver anonymity of communications on the Internet. Despite the use of the onion routing paradigm, Tor is vulnerable to traffic analysis attacks. In this paper we present Duster, an active traffic analysis attack based on flow watermarking that exploits a vulnerability in Tor's congestion control mechanism in order to link a Tor onion service with its real IP address. The proposed watermarking system embeds a watermark at the destination of a Tor circuit which is propagated throughout the Tor network and can be detected by our modified Tor relays in the proximity of the onion service. Furthermore, upon detection the watermark is cancelled so that the target onion service remains unaware of its presence. We performed a set of experiments over the real Tor network in order to evaluate the feasibility of this attack. Our results show that true positive rates above 94% and false positive rates below 0.05% can be easily obtained. Finally we discuss a solution to mitigate this and other traffic analysis attacks which exploit Tor's congestion control.


Actions (login required)

View Item View Item