Low-Cost Traffic Analysis of Tor

TLDR

Tor is a second‑generation onion router that enables anonymous TCP streams, but its low latency makes it suitable for web browsing while remaining vulnerable to traffic‑analysis by a global passive adversary. The authors introduce traffic‑analysis techniques that, with only a partial network view, can infer the relay nodes used by anonymous streams and thus greatly reduce Tor’s anonymity. These techniques link otherwise unrelated streams to the same initiator and are feasible for the adversary envisioned by Tor designers. Experiments on the live Tor network confirm that the proposed partial‑view traffic‑analysis attacks can identify relay nodes and link unrelated streams, demonstrating that anonymity is substantially weakened and that similar attacks apply to any low‑latency anonymous network, thereby linking traffic‑analysis to covert channel issues and showing that indirect observation via the network can reveal traffic loads.

Abstract

Tor is the second generation onion router supporting the anonymous transport of TCP streams over the Internet. Its low latency makes it very suitable for common tasks, such as Web browsing, but insecure against traffic-analysis attacks by a global passive adversary. We present new traffic-analysis techniques that allow adversaries with only a partial view of the network to infer which nodes are being used to relay the anonymous streams and therefore greatly reduce the anonymity provided by Tor. Furthermore, we show that otherwise unrelated streams can be linked back to the same initiator Our attack is feasible for the adversary anticipated by the Tor designers. Our theoretical attacks are backed up by experiments performed on the deployed, albeit experimental, Tor network. Our techniques should also be applicable to any low latency anonymous network. These attacks highlight the relationship between the field of traffic-analysis and more traditional computer security issues, such as covert channel analysis. Our research also highlights that the inability to directly observe network links does not prevent an attacker from performing traffic-analysis: the adversary can use the anonymising network as an oracle to infer the traffic load on remote nodes in order to perform traffic-analysis.