Honey Onions: Exposing Snooping Tor HSDir Relays

Honey Onions: Exposing Snooping Tor HSDir Relays

Honey Onions:
Exposing Snooping Tor HSDir Relays

1dd7176bac1e853c31abbde4bdd12c92?s=128

Amirali Sanatinia

August 01, 2016
Tweet

Transcript

  1. Honey Onions: Exposing Snooping Tor HSDir Relays Amirali Sanatinia &

    Guevara Noubir {amirali, noubir}@ccs.neu.edu 1
  2. What is Tor? • Tor is a powerful and popular

    privacy tool • Services • Allows one to browse the Internet anonymously • Allows to run a hidden service without revealing its physical location • Used by a variety of people and applications to protect their privacy • Normal users (majority): do not want to be tracked, circumvent censorship • Journalists • Activists & whistleblowers • Law enforcement & military • Criminals 2
  3. Hidden Services • Allows to run a hidden service without

    revealing its physical location • Additional side effects: self-authentication (no need for certificates), end-to- end encryption • Examples 3
  4. Tor • Tor does not claim to protect against everything

    • Tor Browser: does not mean End-to-End encryption • Hidden Services: does not hide the existence of the hidden service 4
  5. Related Work & Motivation • Like most privacy infrastructure it

    is also a target of attacks & abuse • Cryptography, crypto-currencies • Previous research studied maliciousness of the relays/exit • Other work looked at the nature of hidden services content • We are interested in Hidden Service Directories (HSDirs) • Indicator of the presence of malicious actors • Related work within the Tor Project (Donncha O'Cearbhaill) • Not about breaking the stated properties Tor/Hidden Services 5
  6. Questions • How many relays with HSDir flag snoop on

    hidden services information? • Derive a lower-bound • Which relays snoop? • IP address? Location? • What else do they do? • Passive vs. active • Who are they? 6
  7. Questions • How many relays with HSDir flag snoop on

    hidden services information? • Derive a lower-bound • Which relays snoop? • IP address? Location? • What else do they do? • Passive vs. active • Who are they? 7
  8. Hidden Service Directories (HSDir) Client Hidden Service IP RP HSDir

    (1) (2) (3) (4) (5) (6) (7) 8
  9. Ring of Responsible HSDirs • Every day 3 + 3

    relays are selected • By design to prevent DoS • Side effect misbehaving HSDir can snoop and learn .onion addresses 9
  10. Honey Onions (HOnions) • Each HOnion corresponds to a server/process

    that we don’t share • Run on local IP address (Hidden Service) • Serve a white page • Accessible only through Tor and not shared anywhere/anyone • Three schedules • Daily, Weekly, Monthly • #"#$%& ≅ 3000 ⇒ #ℎ,-%,- = 1500 (cover 95% HSDir relays) • Log the requests/visits for further investigation 10
  11. HOnions? 11

  12. HOnions 12 • On visit: 6 suspicious relays

  13. HOnions 13 • On visit: 6 suspicious relays • Snooping

    relays explain multiple visits
  14. HOnions 14 • On visit: 6 suspicious relays • Honest

    relays never visit
  15. HOnions Architecture 1. Generate honions ho i ho j 2.

    Place honions on HSDirs 3. Build bipartite graph On visit, mark potential HSDirs ho j d i d i+2 d i+1 d i d i+1 d i+2 On visit, add to bipartite graph 15
  16. Minimal Set of HSDir Explaining Visits • !"# = %&:

    ()* *+,-./ 012ℎ !"#1* 4,-5 • !6 = ℎ)7: !681)8 2ℎ-2 0-/ 91/12+% • : = !"# ∪ !6 • < = ℎ)7, %& ∈ !6 × !"# ℎ)7 0-/ @,-Aed on %& and was visited} • M ⊆OMP QRST&U ": ∀ ℎ)7, %& ∈ <, ∃%′& ∈ " ∧ ℎ)7, %′& ∈ < • Can be shown equivalent to a set cover (an NP-complete problem) • Can be calculated using approximation algorithms • Set cover gives the lower bound on the number of snooping HSDirs 16
  17. Heuristic Approach: Greedy Algorithm • Input: G(V, E): Bipartitie graph

    of HOnions to HSDirs • Output: S Set explaining visits • ! ⟵ ∅ • while $ ∩ &' ≠ ∅ )o • Pick * ∈ $ ∩ &!,: ./0ℎ ℎ/2ℎ340 degree • $ ← $ \ * 78* /04 &'8/98 83/2ℎ:9;4 • end • Gives log |&'| approximation ratio 17
  18. Integer Linear Programming (ILP) • min (%& , … ,

    %)*+ ) ∑ -.& |)*+| %0 • subject to ∀ ℎ3- ∈ 56 ∑ ∀ 0: 89:,;< ∈= %0 ≥ 1 • Provides a lower bound on the number of snooping HSDirs to explain the visits • Fast using Matlab ILP solver 18
  19. Simulations • 19 Percentage of Bad HSDirs Perc. of Identified

    HSDirs
  20. Experiment • Period reported on: • Start: Feb 12, 2016

    • End: April 24, 2016 20 Daily Weekly Monthly Unique Hidden Services Stats
  21. Connectivity Graph 21 • Number of visits: 40k+ • ILP

    output: 111 HSDir
  22. Verifying Snooping HSDirs • 22 Alibaba Alibaba Alibaba Contabo Gmbh

  23. Snoopers’ Most Likely Geolocation 23 • No snooping HSDirs in

    China, Middle East, or Africa but • Many of these countries Tor is blocked • Alibaba datacenter in California (15 HSDir)
  24. More Stats • More than 70% of these HSDirs are

    hosted on Cloud infrastructure • ~25% are exit nodes (compare to 15% of the average relay) • Top 5 cloud providers are • Alibaba California (15 detected HSDirs) • Digital Ocean (7) • Online S.A.S. (7) • OVH SAS (6) • Hetzner Online GmbH (6) 24
  25. Snooping Behavior • Wide variety of behavior • Automated vs

    manual probing • Mostly automated but some request favicon.ico (probably manual TorBrowser) • Aggressive, periodic probing • One periodically asked for server-status page of Apache (mod_status) • Attempts to find vulnerabilities • SQL Injection • Targeted information_schema.tables, username enumeration in Drupal • Path traversal • looking for boot.ini and /etc/passwd • XSS • PHP Easter Eggs • Targeting Drupal and Ruby on Rails 25
  26. Snoopers’ Identity • Hard to identify the real entity behind

    the relays • More than half of the HSDirs are hosted on cloud platform • The geolocations correspond to the location of the hosting platform not necessarily the entity running them • Number of cloud platforms are located in countries with stronger privacy protection for customers • Some cloud platform accept payments over bitcoin, making it even harder to identify the real actors 26
  27. Recent Trends • 27

  28. Media Coverage • 28

  29. Conclusion • Tor relies on the honest behavior of volunteering

    relays • The detection, identification and mitigation of misbehaving relays helps to improve the privacy and security of Tor • This work is an addition to the previous body of work focusing on detection of misbehaving Tor relays • Honey Onions (HOnions) is a framework to detect snooping HSDirs • Provides a lower bound on such relays • Identifies likely misbehaving HSDir relays • Game theoretic formulation for different types of actors • Systematic immediate, delay, randomizers • Large Delay => miss on fresh information • Small Delay => risk detection • Mitigations • Next generation Hidden Services • Do not assume that the existence of your Hidden Service cannot be discovered 29