How much anonymity does network latency leak?
- 1 February 2010
- journal article
- research article
- Published by Association for Computing Machinery (ACM) in ACM Transactions on Information and System Security
- Vol. 13 (2), 1-28
- https://doi.org/10.1145/1698750.1698753
Abstract
Low-latency anonymity systems such as Tor, AN.ON, Crowds, and Anonymizer.com aim to provide anonymous connections that are both untraceable by “local” adversaries who control only a few machines and have low enough delay to support anonymous use of network services like Web browsing and remote login. One consequence of these goals is that these services leak some information about the network latency between the sender and one or more nodes in the system. We present two attacks on low-latency anonymity schemes using this information. The first attack allows a pair of colluding Web sites to predict, based on local timing information and with no additional resources, whether two connections from the same Tor exit node are using the same circuit with high confidence. The second attack requires more resources but allows a malicious Web site to gain several bits of information about a client each time he visits the site. We evaluate both attacks against two low-latency anonymity protocols—the Tor network and the MultiProxy proxy aggregator service—and conclude that both are highly vulnerable to these attacks.Keywords
Funding Information
- Division of Computer and Network Systems (CNS-0546162)
This publication has 17 references indexed in Scilit:
- How much anonymity does network latency leak?Published by Association for Computing Machinery (ACM) ,2007
- Constraint-Based Geolocation of Internet HostsIEEE/ACM Transactions on Networking, 2006
- An introduction to ROC analysisPattern Recognition Letters, 2005
- Practical Traffic Analysis: Extending and Resisting Statistical DisclosureLecture Notes in Computer Science, 2005
- VivaldiPublished by Association for Computing Machinery (ACM) ,2004
- PlanetLabACM SIGCOMM Computer Communication Review, 2003
- Statistical Disclosure AttacksPublished by Springer Science and Business Media LLC ,2003
- KingPublished by Association for Computing Machinery (ACM) ,2002
- Hypertext Transfer Protocol -- HTTP/1.11999
- Untraceable electronic mail, return addresses, and digital pseudonymsCommunications of the ACM, 1981