End-to-End Attack Collecting Information Using SIGINT: How Is It Done?

Question

I'm reviewing the documents filtered by Snowden related to Tor. Two documents in particular, entitled "A potential technique to deanonymise users of the TOR network (proposal)" and "A potential technique to deanonymise users of the TOR network (presentation)" have caught my attention.

These documents propose "a deanonymisation attack against Tor users based on the collection of data from exit nodes owned by the agency".

It seems that the documents mention a classic attack: the 'traffic correlation attack' or 'end-to-end attack'. But, although the document says that the attacker must control the exit node to consummate the attack, it states that it is not necessary to control the entry node; instead, it proposes to collect the information between the client and the entry node through "SIGINT".

Here you can find a screenshot of one of the documents where the attack is graphically represented.

My question is:

1. How can information be collected between the client and the entry node by means of "SIGINT".

2. On the other hand, I already know that one of the vulnerabilities of low latency anonymity networks, such as Tor, is the traffic correlation attack. That's why Tor introduced entry guards and changes the circuit every ten minutes. But has any further improvement been made to prevent this type of attack?

Thank you.

Answer 1

How can information be collected between the client and the entry node by means of "SIGINT".

If there is a large IXP (Internet eXchange Provider) between the client and the guard node, it may result in the Tor traffic going through an NSA/FVEY tap. This can either be done explicitly with a literal tap on undersea or other major cables, or in through compromised routers somewhere between the Tor client and the guard relay.

But has any further improvement been made to prevent this type of attack?

There are considerations to implement WTF-Pad, a pluggable transport that obfuscates packet timings intelligently. There has also already been a successful effort to add NetFlow padding. That is a newer technique which sends periodic "pings" to the guard relay, changing the behavior of an ISP's routers and causing them to log traffic flows in lower granularity.