Source-linked AI summary
RAPTOR: Routing Attacks on Privacy in Tor
Yixin Sun, Anne Edmundson, Laurent Vanbever, Oscar Li, Jennifer Rexford, Mung Chiang, Prateek Mittal
TL;DR
Tor’s low-latency design leaves packet timing and size information available to attackers observing both communication segments, while AS-level routing threats remain incompletely addressed. The paper presents Raptor, which exploits routing asymmetry, BGP churn, and active BGP attacks, evaluating them with routing data and live-network experiments. It demonstrates serious anonymity threats, including 95% accuracy with no observed false positives, and outlines BGP- and Traceroute-based monitoring countermeasures.
Problem
Tor remains vulnerable to adversaries that observe both traffic segments, and AS-level threats persist because paths between clients and guards can change over time.
Method
Raptor combines attacks exploiting routing asymmetry, natural BGP path churn, and strategic BGP hijack or interception, evaluated using historical routing data and controlled live-Tor experiments.
Results
95% accuracy with no observed false positives was achieved for asymmetric traffic correlation, while routing asymmetry and churn increased AS-level attack impact by 50% to 100% compared with conventional attacks.
Takeaways & Limitations
Anonymity systems should account for Internet-routing dynamics, with BGP and Traceroute monitoring proposed to detect routing attacks and anomalies.
Takeaways & Limitations
The analysis quantifies Raptor from the perspective of individual autonomous systems, although autonomous systems may collude to increase monitoring capability.
Abstract
from arXiv · showhide
The Tor network is a widely used system for anonymous communication. However, Tor is known to be vulnerable to attackers who can observe traffic at both ends of the communication path. In this paper, we show that prior attacks are just the tip of the iceberg. We present a suite of new attacks, called Raptor, that can be launched by Autonomous Systems (ASes) to compromise user anonymity. First, AS-level adversaries can exploit the asymmetric nature of Internet routing to increase the chance of observing at least one direction of user traffic at both ends of the communication. Second, AS-level adversaries can exploit natural churn in Internet routing to lie on the BGP paths for more users over time. Third, strategic adversaries can manipulate Internet routing via BGP hijacks (to discover the users using specific Tor guard nodes) and interceptions (to perform traffic analysis). We demonstrate the feasibility of Raptor attacks by analyzing historical BGP data and Traceroute data as well as performing real-world attacks on the live Tor network, while ensuring that we do not harm real users. In addition, we outline the design of two monitoring frameworks to counter these attacks: BGP monitoring to detect control-plane attacks, and Traceroute monitoring to detect data-plane anomalies. Overall, our work motivates the design of anonymity systems that are aware of the dynamics of Internet routing.
1 Introduction
Tor protects user identities but remains vulnerable to AS-level observation and routing manipulation. Raptor expands these threats through routing asymmetry, BGP churn, and active attacks, and proposes monitoring-based countermeasures.
- Background: Tor is widely used to protect identities, serving millions of users through thousands of relays and terabytes of daily traffic.As of February 2015, the network comprised 7,000 relays or proxies.
- Threat Model: Because Tor preserves packet timings and sizes, observing both communication segments enables traffic correlation that can deanonymize clients.ASes can eavesdrop on links and observe packet headers, timing, and size information.
- Raptor Attacks: Raptor uses dynamic BGP routing to introduce novel AS-level attacks beyond prior studies.Its attacks exploit routing asymmetry, natural path churn, and the insecurity of Internet routing.
- Raptor Attacks: Routing asymmetry lets adversaries observe one traffic direction at both endpoints, while BGP churn exposes additional Tor traffic and clients over time.These effects compound with active BGP hijack and interception attacks that support traffic observation and analysis.
- Evaluation: Live experiments achieved 95% deanonymization accuracy without false positives, while historical routing data quantified additional attack exposure.The paper also reports successful feasibility demonstrations on the live Tor network without harming real users.
- Countermeasures: The paper outlines BGP and Traceroute monitoring frameworks to detect suspicious AS-level path changes and routing anomalies.These countermeasures are intended to detect control-plane and data-plane attacks.
2 Raptor Attacks
Raptor extends Tor traffic-analysis attacks by exploiting routing asymmetry, BGP churn, and active BGP manipulation. These mechanisms increase the ASes able to observe traffic at both endpoints or selectively position themselves on relevant paths.
- Threat model: Tor’s layered circuits prevent any single relay from linking clients to destinations, but end-to-end timing analysis can correlate packet timings and sizes across both segments.This correlation works even when communication is encrypted.
- Asymmetric Traffic Analysis: Figure 1 shows that considering both forward and backward traffic expands compromising ASes from only AS5 to AS3, AS4, and AS5.The figure reports that asymmetric traffic analysis is feasible.
- Asymmetric Traffic Analysis: Asymmetric traffic analysis deanonymizes users when an adversary observes either traffic direction at both communication endpoints.TCP acknowledgments can provide the missing direction because Internet paths may differ between forward and reverse traffic.
- Natural Churn: Figure 2 shows BGP churn expanding deanonymizing ASes from only AS5 to AS5 and AS3 after the AS4–AS5 link fails.The change illustrates how routing failures can alter surveillance opportunities.
- Natural Churn: BGP churn changes paths over time, allowing ASes to observe additional Tor traffic and increasing surveillance capability by up to 50% over one month.Path changes can result from failures, new links or peering relationships, and routing-policy changes.
- Active Routing Attacks: Active BGP attacks include prefix hijacks that expose reduced anonymity sets and interceptions that preserve selective path visibility for exact deanonymization.Prefix hijacks can blackhole captured traffic, whereas interception attacks can place an AS on paths toward selected Tor relays without simply dropping the connection.
3 Asymmetric Traffic Analysis
The authors tested asymmetric traffic analysis on the live Tor network using researcher-generated traffic and packet-header correlations. Across four observation scenarios, the attack achieved high matching accuracy without observing false positives.
- Experimental Setup: The experiment used 50 Tor clients and 50 Web servers on geographically distributed PlanetLab machines, each client requesting a 100MB image through Tor.Researchers generated the traffic to avoid harming real Tor users.
- Asymmetric Correlation Analysis: The analysis extracted TCP sequence and acknowledgment numbers, computed transmitted bytes over time, and selected the highest-correlated client/server pair.The four scenarios varied whether client-side and server-side observations contained data or acknowledgment traffic.
- Results: 95% average accuracy was achieved after 300 seconds across all four asymmetric traffic-analysis scenarios.The reported accuracy used the highest-correlated pair for each trace.
- Results: No false positives were observed; the errors were false negatives in which clients could not be matched to any server.Detection accuracy increased with attack duration, especially during the first 30 seconds.
- Reported Metrics: Table 2 reports asymmetric traffic-analysis accuracy rates, while Table 3 reports confidence intervals for the measured error rates.The confidence intervals were computed using the sample size of 50 client machines and 50 server machines.
4 Natural Churn
Natural BGP churn expands the set of Tor circuits that AS-level adversaries can observe over time. Analyses using BGP data and traceroutes show substantially higher vulnerability when routing changes and asymmetry are considered.
- Control-plane evaluation: Up to 50% more Tor circuits became compromised over one month when BGP churn was included.The analysis counted a circuit as compromised only when it crossed the same AS for at least 30 seconds.
- Control-plane evaluation: For 60% of source-destination pairs, the amount of compromised circuits increased, reaching 50% in 20% of cases.Figure 8 reports the increase relative to the static baseline after one month.
- Control-plane evaluation: Churn increased the number of compromisable source-destination pairs from 5,593 to 5,754, an augmentation of nearly 3%.The comparison is between the static baseline and routing updates over the evaluated period.
- Control-plane evaluation: Large ASes such as NTT and Level3 saw Tor traffic for up to 90% of entry-exit relay pairs.The paper attributes this broad visibility to their central positions in the Internet.
- Data-plane evaluation: 31.8% of Tor circuits were vulnerable after three weeks when asymmetric paths were considered, versus 21.3% on day one and 12.8% under conventional analysis.The study measured 62,500 possible circuits using traceroutes among client, guard, exit, and destination AS groups.
5 BGP Attacks: Hijack and Interception
The paper evaluates BGP hijack and interception attacks against Tor, finding that relay concentration creates attractive targets and that a live interception attack successfully deanonymized clients. Historical incidents also affected Tor relays.
- 5.1 Relay concentration: Six ASes and 70 prefixes hosted approximately 30% of Tor relays and approximately 40% of network bandwidth, making them attractive hijack and interception targets.The attack impact depends on how many relays lie within the targeted prefix.
- 5.2 Known prefix hijacking attacks: Three well-known BGP hijacks affected Tor relays, including Indosat incidents and a Canadian Bitcoin theft incident.The authors identified affected Tor prefixes by filtering Routeviews BGP updates around documented attacks.
- 5.3 BGP prefix interception attack experiment: The live interception experiment deanonymized Tor sources with 90% accuracy while preserving the Tor connection.The attack redirected traffic through a more-specific /24 announcement and captured client TCP acknowledgment traffic.
- 5.3 BGP prefix interception attack experiment: Interception accuracy decreased from an average 95% in static asymmetric analysis to 90% because all 50 clients shared one guard and started requests simultaneously.The shared guard, synchronized requests, and guard/exit bottlenecks produced more similar bandwidths.
- 5.3 BGP prefix interception attack experiment: More than 90% of BGP prefixes hosting Tor relays were shorter than /24 and therefore directly vulnerable to a more-specific prefix attack.The paper notes that longer prefixes are commonly filtered by many ISPs.
6 Countermeasures Sketch
The paper organizes countermeasures around reducing an adversary’s chance of observing both communication ends and mitigating correlation when both ends are visible. It advocates monitoring routing control- and data-plane changes, alongside prevention strategies.
- Taxonomy of Countermeasures: Countermeasures either reduce the chance of observing both ends or mitigate correlation attacks despite end-to-end visibility.The taxonomy presents these as the two main defense categories.
- Monitoring: Tor can monitor client-to-guard and exit-to-destination path dynamics using traceroute or BGP-feed information.Relays could publish the ASes used to reach destination prefixes, distributing this information to clients.
- Monitoring: BGP monitoring uses frequency and time heuristics to detect suspicious routing changes involving Tor prefixes.The framework gathers Routeviews data and filters updates involving Tor relay prefixes.
- Monitoring: The BGP heuristics detected all known prefix-hijack attacks in preliminary validation, using thresholds .00001 and .01.The frequency heuristic threshold was .00001, while the time heuristic threshold was .01.
- Monitoring: Traceroute monitoring complements BGP monitoring because BGP data is limited to participating peers and noisily reflects the control plane.The traceroute framework runs measurements from 450 PlanetLab machines to Tor entry and exit relays.
- Monitoring: The traceroute framework detected the studied BGP interception attack through AS-level path changes observed from every PlanetLab node to the Tor guard.The measurements used 450 geographically diverse machines distributed across 140 ASes.
- Prevention: Prevention proposals include advertising /24 Tor prefixes, selecting relays with shorter AS-level paths, and deploying secure inter-domain routing protocols.Selecting guards closer to clients in AS topology can mitigate asymmetric traffic analysis and BGP churn, but secure routing deployment requires multiple stakeholders.
7 Discussion and Ethical Considerations
The discussion addresses stronger adversaries and bounds the ethics of the live experiments. The authors state that experiments targeted only researcher-controlled traffic and relays, with firewalls preventing real-user involvement.
- Discussion: The threat assessment quantifies individual autonomous systems, but colluding ASes could combine monitoring capabilities.ASes in the same legal jurisdiction might be compelled to share Tor-traffic observations with one entity.
- Ethical Considerations: All attacks experimented only with traffic created by the researchers and did not store or analyze traffic from real Tor users.The experiments deanonymized the researchers’ own traffic.
- Discussion: Selecting guards closer to clients can mitigate routing risks but may reveal probabilistic information about clients through guard knowledge.The authors identify this as a trade-off for future investigation.
- Ethical Considerations: Live interception attacks targeted relays controlled by the researchers, including their own prefix.The experiments did not intercept unrelated Tor relay prefixes.
- Ethical Considerations: Network-level firewalls dropped real-user traffic from researcher-controlled relays, allowing only authorized experimental traffic through.This safeguard was used to ensure real Tor users would not use the controlled relays.
8 Related Work
Raptor extends prior AS-level Tor analyses by incorporating routing dynamics and extends BGP-security research to privacy technologies. The paper also reports live-network validation and countermeasures beyond its preliminary workshop version.
- AS-level adversaries: Earlier work studied AS-level deanonymization and the security effects of Tor path-selection strategies.The paper positions Raptor as building on these analyses.
- AS-level adversaries: Raptor introduces attacks that leverage routing asymmetry, routing churn, and routing attacks to compromise anonymity more effectively than previously thought possible.These attacks extend the perspective of prior AS-level adversary studies.
- Contributions: This paper advances a preliminary workshop report by measuring attacks with real-world control- and data-plane data and demonstrating feasibility on the live Tor network.The authors state that the live experiments succeeded and harmed no real Tor users.
- BGP insecurity: Although BGP hijacking and interception have been extensively studied, this paper is presented as the first study of their implications for privacy technologies such as Tor.The related work distinguishes secure-routing research from its privacy-system application.
9 Conclusion
Raptor exploits Internet-routing dynamics to strengthen AS-level attacks against anonymity. Experiments report substantial attack effectiveness and motivate routing-aware designs for next-generation anonymity systems.
- Conclusion: Raptor attacks exploit routing asymmetry, routing churn, and routing attacks to enable AS-level compromise of user anonymity.The conclusion frames these routing dynamics as the attack’s central mechanism.
- Conclusion: 95% accuracy with no observed false positives was achieved for asymmetric traffic correlation on the live Tor network.The conclusion also reports successful live-network traffic analysis through BGP interception.
- Conclusion: Routing asymmetry and routing churn increased AS-level attack impact by 50% to 100% compared with conventional attacks.The conclusion lists these increases among the key experimental results.
- Conclusion: The findings highlight the danger of abstracting network routing away from anonymity-system analysis and motivate routing-aware next-generation designs.This is the paper’s stated broader implication for systems such as Tor.
A.1 Monitoring Challenges for Detecting Routing Attacks
Monitoring routing attacks can help Tor users, but detection itself creates a relay-selection vulnerability, while BGP complexity makes suspicious events difficult to classify accurately.
- A.1 Monitoring Challenges for Detecting Routing Attacks: Detection of malicious or accidental hijacks and interceptions could help Tor users, but allowing relay selection introduces a new attack surface.An attacker could hijack all but a few relays, forcing users toward a small, attacker-known set.
- A.1 Monitoring Challenges for Detecting Routing Attacks: BGP fundamentals cause many suspicious alerts to reflect multiple origin ASes, traffic engineering, or load-balancing instead of attacks.
- A.1 Monitoring Challenges for Detecting Routing Attacks: The monitoring goal retains no false negatives while placing less emphasis on minimizing false positives than prior hijack-detection research.
A.2 Rejected countermeasure: Mitigating Correlation Attacks
Several proposed defenses against correlation attacks are unsuitable for Tor because their deployment costs are high, while asymmetric attacks exploit TCP sequence numbers.
- A.2 Rejected countermeasure: Mitigating Correlation Attacks: High-latency mix networks and constant-rate cover traffic can mitigate timing analysis, but they are considered too costly for deployment in Tor.
- A.2 Rejected countermeasure: Mitigating Correlation Attacks: The asymmetric correlation attack uses the TCP sequence-number field, which indicates the number of acknowledged bytes.