‘Sybil’ nodes could be used to de-anonymise traffic. The Tor Project is working with Princeton University boffins to try and identify possibly malicious nodes, and prevent them from harvesting traffic by gaming its node reputation system.
Tor’s reputation services collect flags from relays, from which they assess and publish (hourly) the reputation of relays, but the researchers from Princeton and the Tor project believe the network isn’t sufficiently protected against “Sybil attacks”.
In a Sybil attack (named after the Flora Schreiber novel about dissociative identity disorder), a single individual controls multiple accounts to game a reputation system. In the case of Tor, gaming the system would let an attacker attract traffic to nodes they control – and that gives the attacker more traffic to observe (for example, to try and de-anonymise users).
Tor already tries to remove malicious Sybils from the network (not all of them are attackers), but a false positive is costly, because it removes bandwidth from the network. However, the paper (by Princeton and Karlstad University’s Philipp Winter, Roya Ensafi and Nick Feamster of Princeton, and the Tor Project’s Karsten Loesing) notes that to get rid of dangerous nodes, the network needs ways to identify them.
A miscreant, the authors say, can also use Sybils to snoop on exit traffic (for credential collection), fingerprint Websites users are connecting to, harvest bridge addresses (which undermines Tor’s potential to circumvent censorship).
The boffins trained their main tool, called “sybilhunter”, on historical network data about the Tor consensus (that is, the output of its reputation system), and turned up some interesting results, including:
- Rewrite Sybils – these hijacked Bitcoin transactions by rewriting their Bitcoin addresses;
- Redirect Sybils – these also attacked Bitcoin users, by redirecting them to an impersonation site;
- FDCservers Sybils – associated with the CMU deanonymisation research later subpoenaed by the FBI;
- Botnets of Sybils – possibly misguided attempts to help drive up usage;
- Academic Sybils – they observed the Amazon EC2-hosted nodes operated by Biryukov, Pustogarov, and Weinmann for this 2013 paper; and
- The https://www.theregister.co.uk/2014/12/27/tor_lizard_squad_sybil_attack/ LizardNSA attack on Tor.
The paper notes that sybilhunter isn’t a complete answer to the problem. It can’t assess the motivations behind Sybils, and some fingerprints it misses are picked up by other tools, such as Exitmap. So the Tor Project is advised to use “diverse and complimentary tools” to protect the network.
Manual work is needed as well, and can provide important context to distinguish harmless and malicious Sybils: “Sybils that are (i) operated in “bulletproof” Ases, (ii) show signs of not running the Tor reference implementation, or (iii) spoof information in their router descriptor all suggest malicious intent”, they say.
They hope to create a crowd-sourced sybilhunter: “We are also working with The Tor Project on incorporating our techniques in Tor Metrics, a web site that contains network visualisations, which are frequented by numerous volunteers that sometimes report anomalies. By incorporating our techniques, we hope to benefit from “crowd-sourced” Sybil detection.”
Source:https://www.theregister.co.uk/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
