MIT and QCRI researchers break the anonymity of Tor network traffic, with 88% accuracy, using malicious nodes (Relays)
Researchers from MIT and the Qatar Computing Research Institute (QCRI) are expected to present the findings of their new study at the Usenix Security Symposium, where they will detail a new method of breaching the anonymity of the Tor network, according to a report by Ars Technica.
The researchers' method does not attempt to decrypt Tor's notorious encryption system, which has multiple layers of security, but uses machine learning algorithms and a series of "lucky" situations to guess which services or websites a user is browsing.
To better understand certain concepts, a simple description of the Tor network is necessary, and more specifically an analysis of the terminology “guard” server.
When a Tor user wants to access a website, an encrypted request is sent from their browser and passed through the Tor network. The first server to receive the request is a “guard” server, which “peeles” some of the encryption and passes the request on to another randomly selected server.
This process is repeated until all layers of encryption are removed and the last server, the exit node, or exit-node, forwards the user's browser request to the actual server hosting the selected website.
However, if attackers add malicious servers to the Tor network, they will eventually be selected as "guard servers" for other users, and the attackers, using complex computer algorithms, could guess some of the user's traffic.
The factor of chance is crucial in the scientists' method
The researchers demonstrated that “by simply looking for patterns in the number of packets passing in each direction through a “guard” server, machine learning algorithms could, with 99 percent accuracy, determine the type of circuit being used, that is, whether it is a Web-browsing circuit, an introduction-point circuit, or a rendezvous-point circuit.”.
If attackers can then identify what kind of traffic is related to web-browsing, the algorithms can also show which websites users visited, with 88% accuracy, the researchers claim.
