UK TOP SECRET STRAP1 COMINT A potential technique to deanonymise users of the TOR network OPC-MCR GCHQ This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Outline o TOR and the need for deanonymisation o Data transformation o Scoring o Results o Current status o Software This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT What is TOR o The Onion Router o Hides source of traffic by passing encrypted versions of your internet traffic between multiple TOR routers o Notation - Client - the initiator of communication - Guard node - the TOR router the client contacts - Exit node - the TOR router that relays your traffic to the final destination with no extra encryption so this link can be exploited by SIGINT system G C H Q This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ C Crown Copyright All rights reserved UKTOPSECRET STRAP1 COMINT What is TOR Client Guard Node Onion Router Onion T Router Onion Router Onion Router Exit Node Onion Router Server This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ or G C H Q C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Who uses TOR o TOR was created by the US government and is now maintained by the Electronic Frontier Foundation EFF o EFF will tell you there are many pseudo-legitimate uses for TOR o We're interested as bad people use TOR in particular - Terrorists - Paedophiles This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ or IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Aim o Find client IP address associated with TOR exit node traffic o Attack based on externals - specifically packet timings - Strong crypt is being used This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Aim o We'll make our task easier by assuming we own the exit node being used - Allows us to see all the traffic associated with a TOR circuit - Demultiplex traffic by unknown user F I G C H Q This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Side note Circuit tracing o One suggestion was to track packets through each hop in the TOR network o We experimented with spotting all links in circuits created by GCHQ o Visibility was too low to be a sensible approach - 13 out of 8294 potential inter-TOR-router links were seen o We will directly correlate - exit node traffic and - traffic between client and guard node This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UKTOPSECRET STRAP1 COMINT Own This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Test data collection o Used the standard TOR button web-browser package to access TOR o Made minor changes to ensure we could collect exit node traffic 1 News Search for news visit news websites 2 TOR Browse the TOR website and then use a privacy checking website Split into 2a and 2b as TOR changed circuit mid-way through 1 Download visit to SlashDot followed by downloading a large PDF file 2 Forum Search on Google followed by browsing a PC technical help forum This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Flattening of timing patterns o I C T R - N E observed that TOR can flatten out timing patterns TOR uses a rate-limiting store-and-forward procedure at each TOR router Graph shows bytes of exit node traffic in green and client traffic in red whilst downloading a 1MB file figure from -5QQ00 -- 250QQ T T Os 50 F I G C H Q 100s 15DS 200s This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Cumulative packet counts Our new insight is to use cumulative packet counts Hope packets are approximately preserved Exit Guard 15 46 15 48 15 50 15 52 l 15 54 r 15 56 StoC T 15 46 1 15 48 1 15 50 1 15 52 1 15 54 1 15 56 - Approximate as TOR repacketises data See strong correlation 16 22 16 24 16 26 16 28 15 22 Time hh mm i G C HoQ This information is exempt from disclosure under the Freedom of Inforn other UK information legislation Refer disclosure requests to GCHQ or C Crown Copyright All rights reserved 15 24 1 16 26 r 16 2B UK TOP SECRET STRAP1 COMINT Scoring basic idea An idea of - Bin time into intervals - For each interval get a pair E G o Cumulative exit node packets upto time i o Cumulative guard node packets upto time i - Measure the correlation between these pairs We use I s time-windows - Easy for the SIGI NT system - Seems to work This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on G C H Q C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Scoring refinements o We also expect counts to be similar - Fit a linear model Gi a pE i - Only accept sessions where V 2 5 2 This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Scoring refinements o There may be an unknown time-offset - Traffic takes time to relay through the TOR network - SIGINT clocks may not be synchronised - We slide the traces against each other and find the best match - Truncate to exit node trace we know that it is a complete TOR circuit This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on G C H Q C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Self-comparison beta r 2 -500 We show how the score behaviour as a function of time slide See high correlation pink at small time offset CtoS 1 StoC 1 CtoS 2a StoC 2a 2b StoC 3 StoC 3 4 StoC 4 2 0 1 5 1 0 0 5 ft 11 il 1 CtoS 2 0 2b 1 5 1 0 - 0 5 0 0 CtoS Also generally see 3 blue in a sensible range 500 CtoS 2 0 1 5 1 0 0 5 H X 0 0 -500 500 Time offset s IGCHQ This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT False positives o Want an algorithm with very low false positive rate o Used 2 hours of timestamp source IP destination IP tuples captured from 4 10G internet bearers o Filtered to tuples between a guard node and a nonTOR node o Allow time to arbitrarily slide - 2 hours - In real redeployment one would restrict this slide o Allow us to plot ROC curves for the technique This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAF Server to client False positives Linear - log ROC curve plot Server-to-client good OO O CO -i--' o v o CL D - We miss the very short 2a session with no false-positives - Threshold r2 0 998 O o O CN n 1e-06 o High as comparing increasing functions Client-to-server direction many false positives - There's less structure in data as less data flows in this direction when web-browsing I I 1e-04 1e-02 1e 00 False positive rate Client to server O o ou jD oe I 7 O CL O o O o M O IGCHQ This information is exempt from disclosure under the Freedom of Infoi other UK information legislation Refer disclosure requests to GCHQ c 1e-06 1e-04 1e-02 False positive rate C Crown Copyright All rights reserved 1e 00 UK TOP SECRET STRAP1 COMINT A larger experiment o We want to find some false hits to understand worst case accuracy for the server-to-client direction o Let's open the aperture very wide - 2027 bearer hours of logs with any time slide - Filter to all traffic involving a TOR node o Not just likely guard-to-client traffic as before o We find some false hits 540 but rate is assessed to be low enough o 92% of false hits are against the big download session which has little structure This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT The next step o We are collecting the required logs of packet times with TOR guard nodes in SIGINT o GTE JTRIG have adapted some TOR exit nodes we own to collect the required exit node data - We are keen to engage with others with exit nodes too o Then run the attack - Expect to basically work - Some extra work might be required to only allow queries on sessions with enough structure o Need the bulk data first to progress this question This information is exempt from disclosure under the Freedom of lnformatiorW c OO JTchT other UK information legislation Refer disclosure requests to GCHQ IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT R package An R packaae can be downloaded from Includes algorithm and the collected web-browsing data Recommend R packages for sharing analytics can contain - R C Fortran code Example data Runnable examples and documentation Unit tests G C H Q This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT Conclusion o Have shown a potential externals-based deanonymisation attack for TOR - Requires SIGINT collection of guard-to-client packet times - Requires TOR collection from exit nodes we own o Hope to get this running live at GCHQ soon o Full paper and software available from This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved UK TOP SECRET STRAP1 COMINT This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information legislation Refer disclosure requests to GCHQ on IGCHQ C Crown Copyright All rights reserved                     National Security Archive    Suite 701  Gelman Library  The George Washington University    2130 H Street  NW  Washington  D C  20037    Phone  202 994‐7000  Fax  202 994‐7005  nsarchiv@gwu edu