The document discusses de-anonymization of hidden services on the Tor network. Hidden services allow for anonymous hosting of websites on Tor. De-anonymization seeks to uncover the real IP addresses of hidden services that host illegal activities. The document outlines an active attack method to de-anonymize a hidden service in three phases. The attack injects malicious nodes as relays to eventually control an entry guard node and force the hidden service to select it. This allows the attacker to directly connect to the server and learn its IP address, completing the de-anonymization.

1. De-Anonymization in Tor Network
Presented by:-
• A021-Naman Dalsania
• A030-Jinesh Jain
• A037-Loukik Khandare

2. Working of a Tor Network

3. Path choice in a Tor Network

4. Need for De-Anonymization in Tor Network
• De-Anonymization in Tor Network is needed to track down the real IP
addresses of the Hidden Services so , so that it can be taken down or
the owner of that server could be punished for malicious crimes
performed from that server. The need to de-anonymize these hidden
services is because they serve as a route to perform malicious
activities on the Tor Network like drug supply, child porn, weapon
deals, etc.

5. What are Hidden Services?
• Hidden services are the websites located inside the Tor Networks, which
receive inbound connection only through Tor.
• They provide server anonymity in addition to Tor-default client one.
• They protect the location of the server hosting the service and provide
encryption at every hop from a client to the hidden service.

6. Method of De-Anonymizing HS
• Active Attack:-
The adversary injects malicious nodes in the Tor network and
eventually obtain the control of the HS entry guard with the possibility
of disabling benign
General idea: Since only entry nodes of the server knows its location (IP
address) the attacker consists in trying several attempts of connections
to the HS until this chooses an entry guard controlled by the attacker
relays.

7. Attack Phases in Active Attack
• Phase 1: The client continues to establish new connections with HS
and recording every kind of cell in the central server.It repeats this
loop until one of its entry point sees the following combination of
cells.

8. Phase 2:
• In this phase the attacker want to be sure its relay is chosen as HS
entry guard.
• When the client is about to establish the conversation with the
server, it automatically sends a begin cell.
• The RP without even decrypting, it modifies 1 bit of the cell so that
the server will not understand its content. Note that it works because
the integrity check is performed ONLY at HS.
• The above triggers a destroy cell to be sent back to the client to tear
down the complete circuit.
• Every attacker’s relay is waiting for this cell and, if it arrives, reports it
to the central server

9. Phase 2:

10. Phase 3
• The central server check the following
o Both RP and entry node trigger a Destroy event
oTimeliness of them is consistent: given Tb the timing of the begin cell
and Te the timing of the destroy cell at RP and Td the timing of the
destroy cell at entry point. If ,
Tb < Td < Te
timing of event is consistent.
• This implies the attacker controls an HS entry guard so… he is directly
connected with the server and consequently it knows its location.
• So the de-anonymization is successful.

11. Thank You.