How Guard Discovery attack in Tor network works?

Question

How Guard Discovery attack works? What steps an attacker need to perform in order to discover the guard relay of the HS? How easy this attack can be realized in the real world? What are the countermeasures?

Answer 1

Since each hidden service keeps a list of guard nodes, revealing the guards gives the attacker the next point of attack. Since both hidden services and guard nodes are valid for a long time (more than a month in case of guard nodes), this also gives the attacker/advocacy ample time to take control over the guard nodes or mount legal attack or recovery metadata from guard nodes.

This attack is presented in great detail in Section VI and VII in the original article "Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization". An important point to note is that to carry out this attack, control over at least two Tor non-Exit relays is a prerequisite.

To quote from the paper:

In the attack, the hidden service is forced to establishes many rendezvous connections to the rendezvous point (RP) controlled by the attacker in hope that some circuits pass through the second node (the middle node) controlled by the attacker. The RP generates traffic with a special signature which can be identified by the attacker’s middle node. The steps of the attack are the same as in section VI.

It is unlikely to eliminate the risk of risk of guard nodes being able to deanonymize a hidden service having chosen them, but suggested countermeasures include:

• use an additional layer of guard nodes – guard middle nodes. This has already been proposed as a part of Next-Generation Hidden Services in Tor.
• decrease guards compromise rate by:
  • making the guard rotation interval longer
  • taking into account how long nodes have been part of the network when assigning Guard flags to them