60 research outputs found
An Empirical Study of the I2P Anonymity Network and its Censorship Resistance
Tor and I2P are well-known anonymity networks used by many individuals to
protect their online privacy and anonymity. Tor's centralized directory
services facilitate the understanding of the Tor network, as well as the
measurement and visualization of its structure through the Tor Metrics project.
In contrast, I2P does not rely on centralized directory servers, and thus
obtaining a complete view of the network is challenging. In this work, we
conduct an empirical study of the I2P network, in which we measure properties
including population, churn rate, router type, and the geographic distribution
of I2P peers. We find that there are currently around 32K active I2P peers in
the network on a daily basis. Of these peers, 14K are located behind NAT or
firewalls.
Using the collected network data, we examine the blocking resistance of I2P
against a censor that wants to prevent access to I2P using address-based
blocking techniques. Despite the decentralized characteristics of I2P, we
discover that a censor can block more than 95% of peer IP addresses known by a
stable I2P client by operating only 10 routers in the network. This amounts to
severe network impairment: a blocking rate of more than 70% is enough to cause
significant latency in web browsing activities, while blocking more than 90% of
peer IP addresses can make the network unusable. Finally, we discuss the
security consequences of the network being blocked, and directions for
potential approaches to make I2P more resistant to blocking.Comment: 14 pages, To appear in the 2018 Internet Measurement Conference
(IMC'18
Computer science and technology : historiography V (3)
I2P, X-Files season 10, video game writing credits..
Measuring and Evading Turkmenistan's Internet Censorship: A Case Study in Large-Scale Measurements of a Low-Penetration Country
Since 2006, Turkmenistan has been listed as one of the few Internet enemies
by Reporters without Borders due to its extensively censored Internet and
strictly regulated information control policies. Existing reports of filtering
in Turkmenistan rely on a small number of vantage points or test a small number
of websites. Yet, the country's poor Internet adoption rates and small
population can make more comprehensive measurement challenging. With a
population of only six million people and an Internet penetration rate of only
38%, it is challenging to either recruit in-country volunteers or obtain
vantage points to conduct remote network measurements at scale.
We present the largest measurement study to date of Turkmenistan's Web
censorship. To do so, we developed TMC, which tests the blocking status of
millions of domains across the three foundational protocols of the Web (DNS,
HTTP, and HTTPS). Importantly, TMC does not require access to vantage points in
the country. We apply TMC to 15.5M domains, our results reveal that
Turkmenistan censors more than 122K domains, using different blocklists for
each protocol. We also reverse-engineer these censored domains, identifying 6K
over-blocking rules causing incidental filtering of more than 5.4M domains.
Finally, we use Geneva, an open-source censorship evasion tool, to discover
five new censorship evasion strategies that can defeat Turkmenistan's
censorship at both transport and application layers. We will publicly release
both the data collected by TMC and the code for censorship evasion.Comment: To appear in Proceedings of The 2023 ACM Web Conference (WWW 2023
Assessing the Privacy Benefits of Domain Name Encryption
As Internet users have become more savvy about the potential for their
Internet communication to be observed, the use of network traffic encryption
technologies (e.g., HTTPS/TLS) is on the rise. However, even when encryption is
enabled, users leak information about the domains they visit via DNS queries
and via the Server Name Indication (SNI) extension of TLS. Two recent proposals
to ameliorate this issue are DNS over HTTPS/TLS (DoH/DoT) and Encrypted SNI
(ESNI). In this paper we aim to assess the privacy benefits of these proposals
by considering the relationship between hostnames and IP addresses, the latter
of which are still exposed. We perform DNS queries from nine vantage points
around the globe to characterize this relationship. We quantify the privacy
gain offered by ESNI for different hosting and CDN providers using two
different metrics, the k-anonymity degree due to co-hosting and the dynamics of
IP address changes. We find that 20% of the domains studied will not gain any
privacy benefit since they have a one-to-one mapping between their hostname and
IP address. On the other hand, 30% will gain a significant privacy benefit with
a k value greater than 100, since these domains are co-hosted with more than
100 other domains. Domains whose visitors' privacy will meaningfully improve
are far less popular, while for popular domains the benefit is not significant.
Analyzing the dynamics of IP addresses of long-lived domains, we find that only
7.7% of them change their hosting IP addresses on a daily basis. We conclude by
discussing potential approaches for website owners and hosting/CDN providers
for maximizing the privacy benefits of ESNI.Comment: In Proceedings of the 15th ACM Asia Conference on Computer and
Communications Security (ASIA CCS '20), October 5-9, 2020, Taipei, Taiwa
Recommended from our members
Traffic Analysis Attacks and Defenses in Low Latency Anonymous Communication
The recent public disclosure of mass surveillance of electronic communication, involving powerful government authorities, has drawn the public's attention to issues regarding Internet privacy. For almost a decade now, there have been several research efforts towards designing and deploying open source, trustworthy and reliable systems that ensure users' anonymity and privacy. These systems operate by hiding the true network identity of communicating parties against eavesdropping adversaries. Tor, acronym for The Onion Router, is an example of such a system. Such systems relay the traffic of their users through an overlay of nodes that are called Onion Routers and are operated by volunteers distributed across the globe. Such systems have served well as anti-censorship and anti-surveillance tools. However, recent publications have disclosed that powerful government organizations are seeking means to de-anonymize such systems and have deployed distributed monitoring infrastructure to aid their efforts.
Attacks against anonymous communication systems, like Tor, often involve trac analysis. In such attacks, an adversary, capable of observing network traffic statistics in several different networks, correlates the trac patterns in these networks, and associates otherwise seemingly unrelated network connections. The process can lead an adversary to the source of an anonymous connection. However, due to their design, consisting of globally distributed relays, the users of anonymity networks like Tor, can route their traffic virtually via any network; hiding their tracks and true identities from their communication peers and eavesdropping adversaries. De-anonymization of a random anonymous connection is hard, as the adversary is required to correlate traffic patterns in one network link to those in virtually all other networks. Past research mostly involved reducing the complexity of this process by rst reducing the set of relays or network routers to monitor, and then identifying the actual source of anonymous traffic among network connections that are routed via this reduced set of relays or network routers to monitor. A study of various research efforts in this field reveals that there have been many more efforts to reduce the set of relays or routers to be searched than to explore methods for actually identifying an anonymous user amidst the network connections using these routers and relays. Few have tried to comprehensively study a complete attack, that involves reducing the set of relays and routers to monitor and identifying the source of an anonymous connection. Although it is believed that systems like Tor are trivially vulnerable to traffic analysis, there are various technical challenges and issues that can become obstacles to accurately identifying the source of anonymous connection. It is hard to adjudge the vulnerability of anonymous communication systems without adequately exploring the issues involved in identifying the source of anonymous traffic.
We take steps to ll this gap by exploring two novel active trac analysis attacks, that solely rely on measurements of network statistics. In these attacks, the adversary tries to identify the source of an anonymous connection arriving to a server from an exit node. This generally involves correlating traffic entering and leaving the Tor network, linking otherwise unrelated connections. To increase the accuracy of identifying the victim connection among several connections, the adversary injects a traffic perturbation pattern into a connection arriving to the server from a Tor node, that the adversary wants to de-anonymize. One way to achieve this is by colluding with the server and injecting a traffic perturbation pattern using common traffic shaping tools. Our first attack involves a novel remote bandwidth estimation technique to conrm the identity of Tor relays and network routers along the path connecting a Tor client and a server by observing network bandwidth fluctuations deliberately injected by the server. The second attack involves correlating network statistics, for connections entering and leaving the Tor network, available from existing network infrastructure, such as Cisco's NetFlow, for identifying the source of an anonymous connection. Additionally, we explored a novel technique to defend against the latter attack. Most research towards defending against traffic analysis attacks, involving transmission of dummy traffic, have not been implemented due to fears of potential performance degradation. Our novel technique involves transmission of dummy traffic, consisting of packets with IP headers having small Time-to-Live (TTL) values. Such packets are discarded by the routers before they reach their destination. They distort NetFlow statistics, without degrading the client's performance. Finally, we present a strategy that employs transmission of unique plain-text decoy traffic, that appears sensitive, such as fake user credentials, through Tor nodes to decoy servers under our control. Periodic tallying of client and server logs to determine unsolicited connection attempts at the server is used to identify the eavesdropping nodes. Such malicious Tor node operators, eavesdropping on users' traffic, could be potential traffic analysis attackers
Datenschutzfördernde Techniken für private Dienste
Privacy on the Internet is becoming more and more important, as an increasing part of everyday life takes place over the Internet. Internet users lose the ability to control which information they give away about themselves or are even not aware that they do so. Privacy-enhancing technologies help control private information on the Internet, for example, by anonymizing Internet communication. Up to now, work on privacy-enhancing technologies has mainly focused on privacy of users requesting public services. This thesis introduces a new privacy risk that occurs when private persons run their own services. One example are instant messaging systems which allow users to exchange presence information and text messages in real time. These systems usually do not provide protection of presence information which is stored on central servers. As an alternative, decentralized instant messaging system designs mitigate this problem by having private persons provide instant messaging services to each other. However, providing a service as a private person causes new security problems as compared to providing a service as an organization or enterprise: First, the presence of such a service reveals information about the availability of the service provider. Second, the server location needs to be concealed in order to hide the whereabouts of a person. Third, the server needs to be specifically protected from unauthorized access attempts. This thesis proposes to use pseudonymous services as a building block for private services. Pseudonymous services conceal the location of a server that provides a specific service. The contribution made here is to analyze what parts of pseudonymous services, in particular Tor hidden services, are missing in order to apply them for private services. This analysis leads to three main problems for which solutions are proposed: First, known pseudonymous service designs do not scale to the expected number of private services which might be provided in the future. This thesis proposes a new approach to store hidden service descriptors in a distributed data structure rather than on central servers. A particular focus lies on the support of private entries which are required for private services. Second, pseudonymous services leak too much information about service identity during advertisement in the network and connection establishment by clients. The approach taken in this thesis is to reduce the information that a service publishes in the network to a minimum and prevent unauthorized clients from accessing a service already during connection establishment. These changes protect service activity and usage patterns from non-authorized entities. Third, pseudonymous services exhibit worse performance than direct service access. The contribution of this thesis is to measure performance, identify possible problems, and propose improvements.Privatsphäre im Internet wird immer wichtiger, da ein zunehmender Teil des alltäglichen Lebens über das Internet stattfindet. Internet-Benutzer verlieren die Fähigkeit zu steuern, welche Informationen sie über sich weitergeben oder wissen nicht einmal, dass sie dieses tun. Datenschutzfördernde Techniken helfen dabei, private Informationen im Internet zu kontrollieren, zum Beispiel durch die Anonymisierung von Internetkommunikation. Bis heute liegt der Fokus bei datenschutzfördernden Techniken hauptsächlich auf dem Schutz von Anfragen an öffentliche Dienste. Diese Arbeit wirft die Frage nach den Risiken beim Betrieb von Internetdiensten durch Privatpersonen auf. Ein Beispiel hierfür sind Instant-Messaging-Systeme, die es ermöglichen, Anwesenheitsinformationen und Textnachrichten in Echtzeit auszutauschen. Üblicherweise schützen diese Systeme die Anwesenheitsinformationen, die auf zentralen Servern gespeichert werden, nicht besonders. Als Alternative verringern dezentrale Instant-Messaging-Systeme dieses Problem, indem Privatpersonen sich gegenseitig Dienste anbieten. Allerdings bringt das Anbieten eines Dienstes als Privatperson im Vergleich zu Organisationen oder Unternehmen neue Sicherheitsprobleme mit sich: Erstens werden durch die Verfügbarkeit eines solchen Dienstes Informationen über die Präsenz des Dienstanbieters preisgegeben. Zweitens soll der Standort des Servers unerkannt bleiben, um nicht den Aufenthaltsort des Dienstanbieters zu offenbaren. Drittens muss der Server besonders vor unautorisierten Zugriffsversuchen geschützt werden. Diese Arbeit schlägt die Nutzung von pseudonymen Diensten als Baustein von privaten Diensten vor. Pseudonyme Dienste verbergen den Standort eines Servers, der einen bestimmten Dienst anbietet. Der hier geleistete Beitrag soll herausfinden, welche Teile von pseudonymen Diensten, besonders von Tor Hidden Services, fehlen, um sie für private Dienste einzusetzen. Dies führt zu drei Hauptproblemen, zu denen Lösungen vorgeschlagen werden: Erstens skalieren bisherige Ansätze für pseudonyme Dienste nicht für die in Zukunft zu erwartende Anzahl von privaten Diensten. Diese Arbeit schlägt einen neuen Ansatz vor, der Hidden-Service-Beschreibungen in einer verteilten Datenstruktur ablegt, anstatt sie auf zentralen Servern zu speichern. Ein besonderer Fokus liegt auf der Unterstützung von privaten Einträgen, die für private Dienste benötigt werden. Zweitens geben pseudonyme Dienste während des Anbietens im Netzwerk und der Verbindungsherstellung durch Clients zu viele Informationen über die Identität des Dienstes preis. Der in dieser Arbeit verfolgte Ansatz ist, die Informationen, die ein Dienst im Netzwerk bekanntgibt, auf ein Minimum zu reduzieren und nicht-autorisierte Clients am Zugriff auf den Dienst schon während der Verbindungsherstellung zu hindern. Diese Änderungen schützen die Aktivität und das Nutzungsmuster des Dienstes vor nicht-autorisierten Personen. Drittens weisen pseudonyme Dienste eine schlechtere Effizienz auf als Dienste, auf die direkt zugegriffen wird. Der Beitrag dieser Arbeit ist, die Effizienz zu messen, mögliche Probleme zu identifizieren und Verbesserungen vorzuschlagen
- …