1. Notify Tor user about quantum
insert attack
Mohiuddin Ebna Kawsar
Matriculation Number: 2544252
Institute of Computer Science IV
Work Group IT Security
Prof. Dr. Michael Meier
Rheinische Friedrich-Wilhelms-Universiät Bonn

2. What is ?

3. Uses of Tor
● Normal people use Tor
● Journalists and their audience use Tor
● Law enforcement officers use Tor
● Business executives use Tor
● Militarily use Tor
● IT Professionals use Tor

4. Why anonymity is important

5. Onion Routing
Images source: https://en.wikipedia.org/wiki/Onion_routing

6. How Tor works
Images source: www.torproject.org

7. How Tor works
Images source: www.torproject.org

8. How Tor works
Images source: www.torproject.org

9. How Tor works
Images source: www.torproject.org

10. Quantum Insert Attack
1) User
makes http
get request
to remote
server
PRECONDISION
Attacker needs
topologically closer
position to victim to
reply faster then
legitimate server
reply
2) Attacker send
spoofed packet
to redirect
Victim to dummy
webserver or
different server

11. Quantum Insert Attack
3) Victim/user
redirects to Attacker
webserver.

12. Quantum Insert Attack
Attacker injects malware to
victim System.

13. Snort position in Tor Network

14. Overall Port and Connection in Tor
Directory listener Port
Directory Port
CPU worker
Socks conn
OR conn
Edge conn
Control conn
Entry OR ExitOP

15. Overall Port and Connection in Tor
Directory listener Port
OR port
Directory Port
OR listener CPU worker
Or
Socks conn
OR conn
Edge conn
Control conn
Entry OR ExitOP

16. Overall Port and Connection in Tor
Directory listener Port
OR port
Control Listener
Control Port
Directory Port
OR listener
CPU worker
Socks port
Or
Socks Listener
Socks
Socks conn
OR conn
Edge conn
Control
Control conn
OP Entry OR Exit

17. Overall Port and Connection in Tor
Directory listener Port
Edge port
OR port
Control Listener
Control Port
Directory Port
OR listener
Edge
CPU worker
Socks port
Or
Socks Listener
Socks
Socks conn
OR conn
Edge conn
Control
Control conn
OP Entry OR Exit

18. Connection in Tor

19. Exit node debug message

20. Exit node debug message
Configuration added to each torrc
KeepalivePeriod 100
CircuitIdleTimeout 100

21. Exit connection debug message

22. Exit connection debug message

23. Connection in Tor

24. How alert travel back to client
const char payload [ C E L L _ P A Y L O A D _ S I Z E ] = " ATTACK QI % s % d % s % d " ;

25. How alert travel back to client
Images source: www.torproject.org

26. Evaluation Setup

27. Evaluation

28. Evaluation

29. Questions?

30. Thank you for listening