7

Recent research [PDF] has shown that website fingerprinting works with Tor.

Website fingerprinting = Determine what website is visited based on certain characteristics even when encryption is applied.

Users:

Can users alter their behavior to prevent or make fingerprinting more difficult?

Websites:

What can websites do to make it more difficult for an adversary to fingerprint their users?

Tor/TorBrowserBundle(TBB):

Are there effective, at least, efficient techniques that can be implemented to make it more difficult or even impossible. For example ScrambleSuit aims to be more sophisticated than current pluggable transports. Would it help regarding fingerprinting of websites and be feasible to deploy on the whole Tor network?

  • I suggest making the Website fingerprinting definition more clear. On characteristics of what is it based? On characteristics of the Tor encrypted traffic? – pabouk Oct 1 '13 at 16:24
4

To get a good understanding of the general problem, I recommend the paper Why Efficient Traffic Analysis Countermeasures Fail . It gives a good overview of why previous defence mechanisms are not sufficient. They also proposed a rather simple classifier called VNG++ which achieves good detection accuracy by only exploiting coarse features such as "total bytes sent", "connection duration" and "packet bursts".

Generally, the only perfect defence against web site fingerprinting is a constant-rate channel between client and web server which keeps transmitting data (the paper cited above refers to such a channel as BuFLO). Obviously, that's not very practical. So with every piece of efficiency we obtain, we move further away from our ideal traffic analysis defence. That doesn't have to be bad but it also doesn't make defending against web site fingerprinting easier.

Can users alter their behavior to prevent or make fingerprinting more difficult?

Maybe a little bit. If you have a very good understanding of how modern classifiers work and what features they exploit, you might be able to influence your web surfing in a way that you would slightly reduce their accuracy. So with a lot of effort, you might be able to make it somewhat more difficult. This is just a guess, however. Web site fingerprinting does not exploit user behaviour but rather HTTP-level behaviour. In particular, how much content is transferred, how long it takes to transfer it and how client and server communicate while downloading a web site. As a user, you can't influence this process all that much.

I don't think that web site fingerprinting should be tackled by teaching users to act differently, though.

What can websites do to make it more difficult for an adversary to fingerprint their users?

I'm not aware of any lightweight and neat hacks. Good server-side protection would probably mean making your content "look similar" to other web sites. And even then, an attacker might be able to say "well, it's either site X or site Y". Also, this would require heavy modification of all the content on a web site. Unfortunately, the research community is currently more interested in enhancing attacks rather than thinking about defences. One reason for that is that it's easy to conclude from the paper I linked above that "we're all screwed".

For example ScrambleSuit aims to be more sophisticated than current pluggable transports. Would it help regarding fingerprinting of websites and be feasible to deploy on the whole Tor network?

ScrambleSuit modifies its packet length distribution and inter-arrival times. The modified packet length distribution should get rid of Tor's characteristic 586-byte signature. ScrambleSuit does not, however, obfuscate derived features such as "total bytes transferred" or "downstream/upstream bursts". While it wouldn't be a very tricky feature to implement, it would involve additional overhead.

There's no comprehensive analysis of how well ScrambleSuit defends against web site fingerprinting (I have the measurement tools but not the data) but my guess is that it would probably reduce the accuracy of classifiers a little bit but certainly not enough to be regarded as strong defence. However, it would be quite interesting to enhance ScrambleSuit in such a way. Patches are welcome! :-)

Regarding the feasibility of deploying it: the code is mostly ready and is currently being tested.

1

I believe that it's possible to prevent fingerprinting by browsing on a remote desktop, rather than directly on a local machine. The signatures for client-website traffic and local-remote RDP traffic would be poorly correlated at best.

First rent a hosted physical server, with at least 2 GB RAM, running Debian or Ubuntu (server, no GUI). If possible, using a secure channel, send an RSA public SSH key to the hosting provider for installation, and have them disable password-based SSH logins. Pay for the server using thoroughly-anonymized Bitcoins.

SSH to your server via Tor, and install Tor on it. Create an SSH hidden service. Then test the SSH hidden service, from a new terminal window, without terminating the existing SSH connection. Once you've verified that it works, create iptables rules on the server that block all non-Tor connectivity.

Now install VirtualBox, and its extension pack, on the server. Download the Crunchbang image, and create a VM using VBoxManage commands. Configure the Crunchbang VM for RDP using VBoxAuthSimple authentication. You can either use RDP via SSH via Tor, or create an RDP hidden service. If you like, you can enable remote USB support via RDP.

To use this setup, you would SSH to the server via Tor, start the Crunchbang VM using VBoxHeadless, and establish an RDP connection to it.

If there's interest, I'm willing to expand this answer as desired.

-1

It’s extremely difficult for people surfing the Web to avoid being tracked by device-fingerprinting technology.

Yeah, that is very hard, but also possible. That is possible by using some extensions to Firefox (look here), there exists also other (experimental) possibility - read more on Tor blog.

Also helpful may be following URLs :

http://www.w3.org/wiki/images/7/7d/Is_preventing_browser_fingerprinting_a_lost_cause.pdf

http://www.techradar.com/news/internet/how-linux-can-help-you-protect-your-privacy-online-1094887/3

http://comments.gmane.org/gmane.network.tor.user/27479

https://security.stackexchange.com/questions/23053/how-to-fight-browser-fingerprinting

I hope I helped.

  • 1
    My question was about an adversary being able to tell what websites I visit based on how my traffic looks. Your answer is partially about that, mostly it is about device fingerprinting. You can ask this question and answer it on your own. The TorBrowser design document explains what is done to make device fingerprinting harder. Thank you. – bastik Sep 30 '13 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.