Tor Anonymity Issues

A report from the University of Colorado describe a weakness in Tor, a popular anonymity system and tool for getting around the Great Firewall. While it does take a fair amount of resources to compromise the anonymity, it is a cause for concern because it is significantly more feasable than previously thought. From their paper:

We show that an attacker can infiltrate the Tor network and can fully compromise the anonymity of a large percentage of users…

In our experiments conducted on our isolated Tor deployment consisting of 60 nodes, our attack was able to correlate over 46% of circuit-building requests through the entire network. This is a significant increase over the 0.70% analytical expectation assumed by many anonymity systems analysts… our attack performed far above expectations.

Here’s a summary and link to the Slashdot posting that brought attention to this.

Tor Open To Attack

“A group of researchers have written a paper that lays out an attack against Tor (PDF) in enough detail to cause Roger Dingledine a fair amount of heartburn. The essential avenue of attack is that Tor doesn’t verify claims of uptime or bandwidth, allowing an attacker to advertise more than it need deliver, and thus draw traffic. If the attacker controls the entry and exit node and has decent clocks, then the attacker can link these together and trace someone through the network.”

UPDATE (Feb 26 08:03:36 UTC): After just talking to the folks at the Tor project, it seems the threat is not as large as the paper has declared. Roger Dingledine and Shava Nerad of the project are incredibly sharp folks and promise to come out with an official response soon.

I was also concerned the paper was only a CS department report from the U of Colorado, and not an accepted conference or journal paper, meaning that no fellow researchers or folks in the field have endorsed their analysis. Some of the comments on Slashdot also agree that these are not brand new issues.

Related posts:

This entry was posted on Sunday, February 25th, 2007 at 7:58 pm and is filed under Technology, GFW. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.