Researchers from the Massachusetts Institute of Technology (MIT) have discovered a vulnerability in Tor that, if exploited, could reveal hidden services in the application with up to 88% accuracy.
Researchers from MIT and the Qatar Computing Research Institute (QCRI) have managed to breach the anonymity of the Tor network. Their study will be presented at the Usenix Security Symposium to be held this summer.
Researchers have demonstrated how an attacker can secretly log into a server, or gain access to the information of a specific Tor user. This is possible, according to the researchers, by analyzing the traffic patterns of encrypted data passing through a computer located on the Tor network.
Tor, which stands for “The Onion Router.” Onion is a word used metaphorically to describe how the service works, which wraps each communication in several layers of encryption (like an onion). This supposedly prevents information from being revealed without going through all the layers of encryption.
Hidden services are now websites that the Tor network uses to protect itself in a similar way that the network protects users.
For the Tor network to work, it is necessary for computers to exchange a large amount of data when establishing a connection to a hidden service.
The researchers showed that “by simply looking for patterns in the number of packets passing in each direction through a hidden gatekeeper service, a machine learning algorithm could determine the circuit with 99% accuracy.”
So the researchers were able to decipher data through traffic correlation.
Furthermore, they were able to connect to a number of different hidden services, demonstrating that with a similar analysis of traffic streams they could identify these services with 88% accuracy.
David Goulet, a developer at the Tor project, said:
“We are currently considering countermeasures for possible improvement of the hidden services, but I believe we need more tangible evidence to determine the issue.”
The full MIT press release on the MIT and QCRI study is available from the link below.
