Downloaded 38 times
Uploaded byCEE-SEC(R)
Анонимность Tor: миф и реальность
Tor is an anonymity network that allows users to browse the internet privately and access hidden services anonymously. It works by routing traffic through a distributed network of volunteer servers run by ordinary people, making it difficult to trace back traffic to its source. While Tor aims to provide strong anonymity, attacks are still possible against the network depending on the resources and level of access an attacker has, such as corrupting entry, exit or directory servers. Website fingerprinting through machine learning is one such attack that can analyze traffic patterns to recognize sites visited over Tor.
More Related Content
Similar to Анонимность Tor: миф и реальность
Анонимность Tor: миф и реальность
- 1. 12th CENTRAL &EASTERN EUROPEAN SOFTWARE ENGINEERING CONFERENCE IN RUSSIA October 28 - 29, Moscow Aleksandr Lazarenko Anonymity of Tor: myth and reality NRU HSE
- 2.
- 3. The Onion Router Anonymousnetwork Volunteer servers Free software Browser & Messenger 3
- 4.
- 5.
- 6. 6 Every server isVOLUNTEER
- 7.
- 8.
- 9.
- 10.
- 11. 11 1998 The Onion Routing DARPA* FreeHaven Project MIT * Defense Advanced Research Projects Agency
- 12.
- 13.
- 14.
- 15.
- 16. 16 2 000 000 Usersper day
- 17. 17 0 50000 100000150000 200000 250000 300000 350000 400000 450000 Netherlands Japan Brazil Italy Spain UK Russia France Germany USA Number of users per day
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31.
- 32.
- 33.
- 34. 34 Tor Client User Connects withTor Has installed soft Any PC
- 35. 35 Entry guard Relay Speaks withClient Encrypts data Retranslates data Entry
- 36. 36 Middle Relay Speaks with Entry Encryptsdata Speaks with Exit Entry Middle Exit
- 37. 37 Exit Relay Speaks with Middle Encryptsdata Speaks with Endpoint Exit Middle Endpoint
- 38. Default circuit middle exit Endpoint entry Encrypted connection Justconnection 38 Tor Client
- 39. Client receives the list ofall Tor nodes from directory server Tor Client Directory server Endpoint #1 Endpoint #2 Encrypted connection Just connection 39 Step #1
- 40. Client initializes the random path throughthe network Endpoint 1 Endpoint 2 entry middle exit 40ы Encrypted connection Just connection Step #2 Tor Client Directory server
- 41. Client initializes another random path Endpoint 1 Endpoint2 entry middle exit 41 Tor Client Directory server Encrypted connection Just connection Step #3
- 42.
- 43.
- 44. 0 2 4 6 8 10 12 14 16 18 Porn Drugs PoliticsForgery Anonymity 44 The most popular content
- 45.
- 46.
- 47.
- 48. 48 Silk Road Used tobe the biggest Drug Store Revenue: 9.5 mln BTC Closed by FBI Founder is life sentenced
- 49.
- 50. Attacker only observes traffic,without modifying it Attacks Attacker observes and modifies traffic Passive Active 50
- 51. 51 Classification # Resources Attacks 1Corrupted entry guard Website fingerprinting attack 2 Corrupted entry and exit nodes Traffic analysis Timing attack Circuit fingerprinting attack Tagging attack 3 Corrupted exit node Sniffing of intercepted traffic 4 Corrupted entry and exit nodes, external server Browser based timing attack with JavaScript injection Browser based traffic analysis attack with JavaScript injection 5 Autonomous system BGP hijacking BGP interception RAPTOR attack 6 Big number of various corrupted nodes Packet spinning attack CellFlood DoS attack Other DoS and DDoS attacks
- 52.
- 53. The Idea: Data miningMachine learning 53
- 54. Attackers strategy Tor Client Entry Exit DB website Datamining Classifier training Website recognition 54
- 55. Feature extraction levels 55 Cell1 Cell 2 Cell 3 Cell 4 Cell 5 Record 1 Record 2 Packet 1 Packet 2 Packet 3 Cells TLS TCP
- 56. Attack as aclassification problem Classes Tracked websites Other 56
- 57.
- 58.
- 59.
- 60.
Editor's Notes
- #4 Сеть из волонтерских серверов Самая большая развернутая анонимная сеть в мире The Onion Router
- #9 Полная децентрализованность Оверлейность Сервера – волонтеры Прячет пользователей друг между другом -> чем > пользователей, тем > анонимность
- #39 Рассказать здесь про entry, exit, middle. Рассказать здесь про то, что каждый из них знает Рассказать про дополнительные уровни шифровки
- #54 Данная атака позволяет скомпрометировать портал, помещенный пользователем в сети, при просматривании зашифрованного траффика какой-то части сети.
- #55 пакетов, их размер и временные интервалы между ними). Используя построенную модель, атакующий классифицирует траффик пользователей в сети. Атака начинается со сбора данных.
- #57 WF атака может быть представлена в виде задачи классификации Каждый класс может быть группой сайтов, например “Специфический сайт”, “Остальные сайты”. Таким образом, после сбора данных нужно обучить классификатор. После тренировки на полученных образцах, классификатор сможет идентифицировать неизвестные образцы.