Defending Tor from Network Adversaries: A Case Study of Network Path Prediction

Abstract: The Tor anonymity network has been shown vul-nerable to traffic analysis attacks by autonomous systems (ASes) and Internet exchanges (IXes), which can observe dif-ferent overlay hops belonging to the same circuit. We evaluate whether network path prediction techniques provide an accu-rate picture of the threat from such adversaries, and whether they can be used to avoid this threat. We perform a measure-ment study by collecting 17.2 million traceroutes from Tor re-lays to destinations around the Internet. We compare the col-lected traceroute paths to predicted paths using state-of-the-art path inference techniques. We find that traceroutes present a very different picture, with the set of ASes seen in the tracer-oute path differing from the predicted path 80 % of the time. We also consider the impact that prediction errors have on Tor security. Using a simulator to choose paths over a week, our traceroutes indicate a user has nearly a 100 % chance of at least one compromise in a week with 11 % of total paths containing an AS compromise and less than 1 % containing an IX com-promise when using default Tor selection. We find modifying the path selection to choose paths predicted to be safe lowers total paths with an AS compromise to 0.14 % but still presents a 5–11 % chance of at least one compromise in a week while making 5 % of paths fail, with 96 % of failures due to false pos-itives in path inferences. Our results demonstrate more mea-surement and better path prediction is necessary to mitigate the risk of AS and IX adversaries to Tor