– Independent security researcher presents new methods for removing the anonymity of Tor network users
– Users can be identified based on their mouse movements
– What other fingerprinting techniques are used to reveal the identity of users?
Independent security researcher Jose Carlos Norte has discovered a number of new methods of identifying Tor network users , which can be used to de-anonymize them during abusive law enforcement investigations or in cyber-surveillance campaigns.
The process of “user fingerprinting” refers to ways to detect non-standard actions, as well as information about user behavior. Although analytics services, which collect a lot of such information, are successfully blocked by Tor Browsers, there are several “fingerprinting” methods that can reveal the identity of users, as the data recorded while surfing the web through Tor can be later compared with the data recorded while browsing in their regular browser.
Your mouse movements reveal your identity
Mr. Norte has published on his blog a series of fingerprinting techniques that are effective against Tor Browser users, along with a page where he demonstrates his research.
[alert variation=”alert-info”]The data typically recorded by fingerprinting systems is not 100% reliable and accurate, but it is a starting point for future research. [/alert]
The first technique mentioned involves recording the speed at which users scroll a page using the mouse wheel. Even if the scroll speed is the same for all mice, an attacker could detect patterns in scroll events based on the idiosyncrasies of each individual.
Another fingerprinting method involves recording the speed at which users move their mouse pointer across a page. Since each user has their own sensitivity preferences – having adjusted their mouse OS settings accordingly – and their own way of handling the device, this technique is much more accurate than the previous one and can be used to successfully identify users.
Even worse, if a user uses a trackpad to navigate a page, fingerprinting techniques become even more accurate, adding precise speed measurements to the already recorded scrolling and movement patterns.
[su_button url=”https://www.secnews.gr/101573/%CF%86%CF%84%CE%B9%CE%AC%CE%BE%CF%84%CE%B5-tor-proxy-%CE%B4%CF%81%CE%BF%CE%BC%CE%BF%CE%BB%CE%BF%CE%B3%CE%B7%CF%84%CE%AE-%CE%BC%CE%B5-raspberry-pi/” target=”blank” style=”glass5″ wide=”yes”]How to make your own TOR Proxy router with a Raspberry Pi [/su_button]
The researcher discovered that he could also collect the fingerprints of not only any user but also any machine. By running a CPU-intensive JavaScript function in the browser, he could record the time it took to execute a process and use this information later to identify suspects by identifying the computer from which the Tor browser was used.
[alert variation=”alert-info”]In another similar study conducted a few weeks earlier, Mr. Norte also discovered that some improperly configured Apache servers could leak the general location of a Tor user if the server was running under certain conditions.[/alert]
