network level attacks and defenses against anonymity networks

125 Pages·2016·3.43 MB·English

NETWORK LEVEL ATTACKS AND DEFENSES AGAINST
ANONYMITY NETWORKS
A Dissertation
in
Computer Science
submitted to the Faculty of the
Graduate School of Arts and Sciences
of Georgetown University
in partial fulfillment of the requirements of the
degree of Doctor of Philosophy
By
Zhi Da Henry Tan, M.S.
Washington, DC
April 18th, 2016
Copyright 2016 by Zhi Da Henry Tan
All Rights Reserved
ii
NETWORK LEVEL ATTACKS AND DEFENSES AGAINST ANONYMITY
NETWORKS
Zhi Da Henry Tan, M.S.
esis Advisor: Micah Sherr, Ph.D.
ABSTRACT
Online anonymous communication is an important service used by individuals,
journalists, government agencies and law enforcement agencies.
One of the most popular uses of online anonymity is web browsing which ne-
cessitates using a low latency anonymity system. Unfortunately, these systems are
typicallyvulnerabletothecorrelationattack,whereanadversarythatcanobservethe
parts of a client’s flow that enter and leave the system, can deanonymize the client.
Recentresearchhasshownthatnetworklayeradversariesposefargreaterthreatto
anonymitysystemsthanpreviouslythought. BymanipulatingtheInternet’scontrol-
plane, i.e., BGP, an adversary can increase its view of the network and improve its
ability to deanonymize clients.
In this dissertation, we study in depth these network level adversaries, attacks
against BGP and their effects on the security of Tor. We propose and evaluate de-
fenses against these attacks.
Inordertoevaluatetheaforementionedthreats, weconstructaccuratemodelsof
theInternet. OurmodelspreserveimportantdetailsoftheTornetwork,suchasend
to end latency and path of Autonomous Systems, of network routes.
Usingthesehighlygranularmodels,weemulateascaleddownversionoftheTor
network. OuremulationsallowustoexaminetheperformanceofTorandpotential
compromise due to an AS adversary under different relay selection strategies.
iii
Using an AS level model, we explore the effects of control-plane attacks on the
security of Tor. We quantify Tor’s susceptibility to these attacks by measuring the
fractionoftheTornetworkthatisvulnerable,andtheadvantagetheadversaryattains
by performing the attacks. We show that 13% of Tor’s ingress bandwidth, at the
median, is susceptible to an adversary which hijacks six prefixes.
We propose defense mechanisms to protect Tor users from manipulation at the
control-plane. Our defenses require low overhead, do not assume the active partic-
ipation of Internet Service Providers, and require small changes to Tor. We exper-
imentally evaluate the effectiveness of our defenses, and show that they result in a
morethantenfolddecreaseintheeffectivenessofthecontrol-planeattacks,prevent-
ing the attack entirely from many ASes.
iv
Acknowledgments
First and foremost, I must express my gratitude to my advisor, Dr. Micah Sherr,
for his guidance and tutelage. Your optimism and expertise helped me overcome
research setbacks and drew me from the dead-ends that I so often found myself in.
You have been an amazing mentor and colleague and this dissertation exists largely
thanks to you.
I would also like to thank Zhou Wenchao, Clay Shields, Calvin Newport and Paul
Syversonforbeingonmy committee, and fortheirtimeand supportinthecreation
and completion of this dissertation.
e department’s faculty that I have had the pleasure of studying under and collab-
orating with have been inspiring and impressive. Unfortunately, not all the research
I have been a part of could make it directly into this dissertation. However, each
project has been a humbling and learning experience and has had no small effect on
the research contained therein.
Iamalsogratefultothegraduatestudentsinthecomputersciencedepartment. e
discussions and collaboration shaped and enriched my time here at Georgetown.
Finally, I would like to thank my family, for supporting me from a long ways away
and for always being there for me.
e research conducted in the process of developing this dissertation was partially
supported by NSF awards CNS-1064986, CNS-1149832, and CNS-1527401 and
DARPA contract N66001-11-C-4020. Any opinions, findings, and conclusions or
recommendations expressed in this dissertation are those of the author and do not
necessarily reflect the views of the funding agencies.
v
Contents
1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 Attacks against Anonymity Systems . . . . . . . . . . . . . . 3
1.3 Achieving a More Robust Anonymity System . . . . . . . . . . 4
1.4 Research Questions . . . . . . . . . . . . . . . . . . . . . 7
1.5 Contributions . . . . . . . . . . . . . . . . . . . . . . . 8
1.6 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2 Background and Related Work . . . . . . . . . . . . . . . . 10
2.1 Anonymity Systems . . . . . . . . . . . . . . . . . . . . . 10
2.2 Defenses against traffic correlation attacks . . . . . . . . . . . 12
2.3 Routing dynamics and attacks. . . . . . . . . . . . . . . . . 12
2.4 BGP defenses and attack detection. . . . . . . . . . . . . . . 13
3 System and reat Model . . . . . . . . . . . . . . . . . . . 15
3.1 System Model . . . . . . . . . . . . . . . . . . . . . . . 15
vi
3.2 reat Model. . . . . . . . . . . . . . . . . . . . . . . . 16
4 Network Model . . . . . . . . . . . . . . . . . . . . . . . . 20
4.1 Modeling the Tor network . . . . . . . . . . . . . . . . . . 20
4.2 Tor, Client and destination configurations . . . . . . . . . . . 23
4.3 Routing . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.4 Verifying Our Topology . . . . . . . . . . . . . . . . . . . 25
5 e Passive Network Attacker. . . . . . . . . . . . . . . . . 31
5.1 Additional Modeling Details . . . . . . . . . . . . . . . . . 32
5.2 Relay Selection . . . . . . . . . . . . . . . . . . . . . . . 34
6 e Active Network Attacker . . . . . . . . . . . . . . . . . 54
6.1 Longest Prefix Adversary . . . . . . . . . . . . . . . . . . . 54
6.2 Shortest Path Adversary . . . . . . . . . . . . . . . . . . . 60
7 Defenses Against Network Attacks . . . . . . . . . . . . . . 69
7.1 Defense Components . . . . . . . . . . . . . . . . . . . . 72
7.2 A Distributed Service for Detecting Longest-Prefix Attacks . . . . 82
8 Future Directions for Online Anonymity . . . . . . . . . . . 91
8.1 Existing Techniques . . . . . . . . . . . . . . . . . . . . . 93
8.2 Eavesdropping-Resistant Communication Architectures . . . . . 94
8.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . 99
9 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 100
10 Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . 103
vii
List of Tables
4.1 Distribution of relays in the live Tor network and our 1524- and 50-
relay models, by count . . . . . . . . . . . . . . . . . . . . . 25
5.1 Percentage of vulnerable paths, Shannon entropy and Gini coefficient
from simulation of the 1524-relay model . . . . . . . . . . . . . 39
5.2 Performance metrics for various relay selection strategies applied het-
erogeneously under medium congestion . . . . . . . . . . . . . 51
5.3 Ginicoefficientandentropyforvariousrelayselectionstrategies,under
emulation . . . . . . . . . . . . . . . . . . . . . . . . . . 52
7.1 Fractionofsubpathsforagivendistancerelativetothedestinationthat
are compatible with the subpath property . . . . . . . . . . . . . 74
7.2 Data for false positive results, detection of guards by CPAs . . . . . 89
7.3 Data for false positive results, detection of CPA-Bs by CPA-As. . . . 90
viii
List of Figures
1.1 Example BGP Attack . . . . . . . . . . . . . . . . . . . . . 4
4.1 CDF of bandwidths as reported by the actual Tor network, and our
1524- and 50-relay models . . . . . . . . . . . . . . . . . . . 26
4.2 Histogram of relays’ AS membership for the live Tor network and our
1524-relay model . . . . . . . . . . . . . . . . . . . . . . . 28
4.3 Geographic distribution of different networks . . . . . . . . . . . 30
5.1 Cumulative distribution of throughput and time-to-first-byte of paths
in emulation . . . . . . . . . . . . . . . . . . . . . . . . . 34
5.2 e ASes that most often appeared on both sides of anonymous paths,
for each selection strategy. . . . . . . . . . . . . . . . . . . . 40
5.3 Cumulative distribution of throughput measured at medium conges-
tion for various relay selection policies . . . . . . . . . . . . . . 42
5.4 Cumulativedistributionoftime-to-first-bytemeasuredatmediumcon-
gestion for various relay selection policies . . . . . . . . . . . . . 43
5.5 Cumulative distribution of P-RTT (average ping time) measured at
medium congestion for various relay selection policies . . . . . . . 44
5.6 Cumulativedistributionofthroughputmeasuredathighcongestionfor
various relay selection policies . . . . . . . . . . . . . . . . . . 45
ix
5.7 Cumulative distribution of time-to-first-byte measured at high conges-
tion for various relay selection policies . . . . . . . . . . . . . . 46
5.8 Cumulative distribution of P-RTT (average ping time) measured at
high congestion for various relay selection policies . . . . . . . . . 47
5.9 Cumulative distribution of throughputmeasured at low congestion for
various relay selection policies . . . . . . . . . . . . . . . . . . 48
5.10 Cumulative distribution of time-to-first-byte measured at low conges-
tion for various relay selection policies . . . . . . . . . . . . . . 49
5.11 CumulativedistributionofP-RTT(averagepingtime)measuredatlow
congestion for various relay selection policies . . . . . . . . . . . 50
6.1 CumulativedistributionofTorguardadvertisedbandwidthagainstthe
longest prefix in the RIB of the routeviews2 Route Views router . . . 56
6.2 Maximum/minimum/median Tor ingress bandwidths for the longest
prefix attack . . . . . . . . . . . . . . . . . . . . . . . . . 59
6.3 Example scenarios of shortest AS path BGP attack . . . . . . . . . 60
6.4 CDF of ASes by potential increased Tor guard bandwidth observed for
different numbers of target for the shortest AS path attack. . . . . . 65
6.5 Fraction of total Tor guard bandwidth observed before and after per-
forming six attacks. . . . . . . . . . . . . . . . . . . . . . . 66
6.6 CDF of ASes by amount of potential increased Tor guard bandwidth
observed for different categories of ASes . . . . . . . . . . . . . 67
7.1 Defense workflow example . . . . . . . . . . . . . . . . . . . 70
7.2 An example of the routes before and after a prefix hijacking attack . . 73
7.3 HistogramofthedifferencesbetweentheAShopcountsofclient!guard
and guard!client traceroutes . . . . . . . . . . . . . . . . . . 76
7.4 Fraction of Tor bandwidth observed by different adversarial ASes. . . 88
8.1 Centralized communication architecture . . . . . . . . . . . . . 96
8.2 Distributed communication architecture . . . . . . . . . . . . . 97
x