2

One of the tactics discussed as a measure to defend against traffic correlation/timing attacks, is to have your Tor client sending traffic on a consistent basis.

For example: If a client was always sending traffic 24x7, it would be more difficult to differentiate the user traffic from the benign traffic.

Are there any tools that do this or something similar? I'm looking for tools that could replay, generate, randomize, or simulate traffic going over a Tor client connection.

0

This blog post might help https://blog.torproject.org/blog/experimental-defense-website-traffic-fingerprinting it's not specifically on correlation/timing attacks but it contains the following sentence:

the researchers point out that a Firefox addon that simply performs background HTTP requests concurrent to normal user activity was enough to foil their classifier.

I did some digging to see if I could find such an add-on and I found this. http://www.instructables.com/id/How-to-generate-fake-traffic-using-the-Tor-Browser/

Using the Tor Browser go to the following Mozilla plug-in recourse center and download the reload every plug-in:

I went to the add-on page and typed in "reload every" and it was the first result. I haven't tried it yet but you can set a time (the minimum seems to be 5 seconds) and the add-on will reload the current page every set number of seconds. Opening something like Wikipedia in tab 1 and reloading every 5 seconds while you use other tabs for the tor traffic you are trying to protect seems like a decent way to use this. If you want to generate more traffic you should be able to make the add-on reload several tabs at the same time.

Not sure if this is exactly what you are looking for but if it works like I expect, it should fall under the category of the "replay traffic going through Tor" part of your question. I couldn't find the name of the add-on that the blog post was referring to but perhaps there is an even better add-on that I didn't find.

  • nice. This seems to work as expected and answered correct. I am still looking for a browser-less version as well though. – Lizbeth Jul 24 '15 at 15:37
  • @Lizbeth So is the python tag because you were hoping for a python script to generate this traffic? In that case, unfortunately I'm not going to be able to give any valuable tips here as I don't have the required experience. Perhaps someone else could weigh in with a "browser-less version". The (probably unhelpful) question I do have is would running your own relay provide similar protection from correlation attacks, or is that not how it works? Just wondering because there would be a constant flow of traffic from your network, but it wouldn't be originating from your machine. – Joey Jul 25 '15 at 1:22
  • Yeah I was ideally looking for Python but I'll take what I can get. :) Yes running a relay helps to defend against correlation attacks.. to a point. torproject.org/docs/faq.html.en#BetterAnonymity But now with EntryGuards being static(ish) it would be easier to differentiate Tor clients on a network based on which Entry Guard they use – Lizbeth Jul 30 '15 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.