81% of Tor Users Can Be De-anonymized By Analysing Router Information

An anonymous reader writes A former researcher at Columbia University's Network Security Lab has conducted research since 2008 indicating that traffic flow software included in network routers, notably Cisco's 'Netflow' package, can be exploited to deanonymize 81.4% of Tor clients. Professor Sambuddho Chakravarty, currently researching Network Anonymity and Privacy at the Indraprastha Institute of Information Technology, uses a technique which injects a repeating traffic pattern into the TCP connection associated with an exit node, and then compares subsequent aberrations in network timing with the traffic flow records generated by Netflow (or equivalent packages from other router manufacturers) to individuate the 'victim' client. In laboratory conditions the success rate of this traffic analysis attack is 100%, with network noise and variations reducing efficiency to 81% in a live Tor environment. Chakravarty says: 'it is not even essential to be a global adversary to launch such traffic analysis attacks. A powerful, yet non- global adversary could use traffic analysis methods [] to determine the various relays participating in a Tor circuit and directly monitor the traffic entering the entry node of the victim connection.'

Comments

Dear Tor users:

[NoNonAlphaCharsHere]

By "can be" De-anonymized, we mean "have been".

Sincerely,
The NSA

Re:The only solution I can think of

[Lunix Nutcase]

How come we aren't don't doing more of that on government/corporate communications? I mean, turnabout is fair play, no?

I don't know. Why are you not doing more of that? Most people are not doing it because they don't want to be sent to prison.

Re:Can't be true

[gstoddart]

"So, yes, some of us are still being paranoid. But that doesn't mean that we're not right."

Spoken like a true paranoid.

Why, thank you. That's the nicest thing anybody has said to me all week.

Look, if the reality wasn't that the surveillance programs in place are far more invasive, sophisticated, and all encompassing than we've ever thought possible, I would happily be a slightly paranoid guy in the corner tilting at windmills. I'm OK with that. Everybody needs a hobby, and it's fun at parties.

The reality is, stuff which we know to be happening is far more widespread than anybody would have believed. They've demonstrated themselves willing to lie to Congress. They get funding from alternate sources which they don't always tell us about. They don't always care about the niceties of the law.

They've colluded with law enforcement to conceal their ways and means, and come up with ways to charge you and hide how they got there by writing a handbook of perjury and lying.

They can use secret laws to make it illegal to tell anybody the scope of what they're actually doing.

So, the problem becomes ... when a high degree of paranoia has been demonstrated to be not nearly paranoid enough ... being somewhat paranoid becomes pretty much mandatory.

And these guys have made what would have been dismissed as merely paranoid ravings only a few years ago into something which is documented and commonplace.

So, yeah, I sound paranoid. Because the people who make me paranoid have upped their game to the level where it's hard to imagine I'm being paranoid enough.

In other words

[msobkow]

In other words, you're only "anonymous" if you don't matter.

Re:Can't be true

[HornWumpus]

Imagine you are a spook who has compromised a 'secure' means of communication.

Can you think of anything better to do with this then shut it down immediately? Should Bletchly park have gotten on the radio and told the Germans 'neener neener, we broke your codes you jerry morons.'?