11

Is there a way for an end user to protect oneself against the timing attack when using Tor?

For those, who are not familiar with it, a timing attack involves an adversary populating the Tor cloud with the nodes under their control, with the goal to likely be the first node that you contact and also be the exit node. The latter part is actually made easier by Tor, since it allows people to opt-out from being an exit node. With such a setup, the adversary begins to record times that you send a packet and also the time when the request packet leaves the exit node, and perform statistical analysis on your traffic and the traffic of the requested resource with the tor network.

Is there a way to introduce an artificial delay or some other mechanism to make a statistical analysis more difficult?

Improve this question
2
  • 2
    Please be more specific and provide details about the attack you're trying to defend against. A good general rule of thumb is that SE questions should be complete enough that someone finding them via a search engine in a years time should be able to understand the question and implement their solutions even if the original context has been lost. You'll also get better answers this way, and fewer off-topic answers. Thanks!
    – user5
    Commented Nov 6, 2013 at 18:13
  • I've added a description of the timing attack, hopefully it's more clear this way.
    – v010dya
    Commented Nov 7, 2013 at 4:46

5 Answers 5

Reset to default
7

Short answer is no, not really.

Timing attacks can be defended against by pumping a constant stream of data through the network. That's not foolproof, however, since an entry / intermediate node could introduce lag spikes which could then be analysed.

I believe that high-latency anonymity networks (anonymous remailers) have all kinds of timing attack defences; so maybe you want to look into those.

Improve this answer
3

I believe it is possible, but don't know if required tools already exist that anyone could use with low technical skills.

This answer will cover both traffic correlation and timing attack issues.

My idea is, you must somehow be able to use some computer in the middle anonymously and send it commands to perform anonymous tasks on scheduled dates and times, or immediately.

  • In context of Tor, pay anonymously for a server and host a Tor hidden service on it by connecting only through Tor to configure it. The tasks should be performed through Tor too on that server.

  • For any potentially risky activity, in terms of traffic correlation or timing attacks, you should use that anonymous server in the middle to perform tasks and better if you scheduled the tasks with a good timing where it is impossible to be correlated with any of your other identities, offline or online. Tasks could be performed when you're sleeping, when you're somewhere with no connection and preferably for a long time like vacations, etc.

About the implementation,

  • I think cronjob is the tool to schedule the tasks in Linux. Never used it before.

  • Most of the manual tasks which require browser clicks and typing would be hard to be scheduled if not impossible.

  • I don't know if Tor Browser could be controlled remotely on command-line, if a remote desktop connection is possible to the hidden service, that can be used for instant tasks.

  • Whonix may be used for both (your own and the one at the middle) computers for best protection. I'm not sure how possible it is.

  • Simple downloading & uploading tasks creates traffic fingerprints so you use the server in the middle to do it now or later, and maybe transfer files to your own computer at a later time. A remote desktop connection could also eliminate the need of having the files on your own computer and allow you to do any tasks anonymously.

  • But a remote desktop connection will also have its own traffic which may be suspicious.

About the tools,

  • I hope people could suggest better ideas, or any available tools to perform such tasks.

  • I believe volunteers could create some hidden websites/servers which could be used by public for instant or scheduled remote tasks. Advanced tasks may be hard to provide for such public services, but providing even the most simple tasks could create a huge benefit for people.

Improve this answer
1

Based on this paper (which was written in 2015 so it may be a bit outdated), the suggested mitigations to thwart a traffic analysis neural network given the most useful parameters (duration of access and incoming/outgoing cells) are:

  • circuits should have similar lifetimes (400-800 seconds; pad/re-establish circuits as necessary)
  • HS and Client IPs should be more difficult to identify - more variety in outgoing and incoming cells (pad as necessary)
  • preemptive, more homogenous circuit building

So you can implement that yourself (Tor is open source; patch and compile) or wait for others to do so.

Improve this answer
0

It would be child's play to implement some small amount of delay and dummy traffic into the network at any or all hops. I have no idea why this isn't a feature of Tor already.

Improve this answer
1
  • I doubt that it would really help much, not unless you also implement something like a datastore, but that would be very difficult with the stream data (probably impossible).
    – v010dya
    Commented Dec 23, 2013 at 16:05
0

I imagine it is possible to randomize the sending times to confuse the statistical, say by adding a random .5 to 3 second variance. More advanced statistical analysis would probably be able to beat this, and it would slow thing up a bit. It would probably be best as an optional feature, but I think it may be worth pursuing.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .