Nothing Special   »   [go: up one dir, main page]

skip to main content
10.1145/2382196.2382211acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article

StegoTorus: a camouflage proxy for the Tor anonymity system

Published: 16 October 2012 Publication History

Abstract

Internet censorship by governments is an increasingly common practice worldwide. Internet users and censors are locked in an arms race: as users find ways to evade censorship schemes, the censors develop countermeasures for the evasion tactics. One of the most popular and effective circumvention tools, Tor, must regularly adjust its network traffic signature to remain usable.
We present StegoTorus, a tool that comprehensively disguises Tor from protocol analysis. To foil analysis of packet contents, Tor's traffic is steganographed to resemble an innocuous cover protocol, such as HTTP. To foil analysis at the transport level, the Tor circuit is distributed over many shorter-lived connections with per-packet characteristics that mimic cover-protocol traffic. Our evaluation demonstrates that StegoTorus improves the resilience of Tor to fingerprinting attacks and delivers usable performance.

References

[1]
Adobe Systems Incorporated. SWF File Format Specification (version 10), 2008. https://www.adobe.com/devnet/swf.html.
[2]
Albrecht, M. R., Paterson, K. G., and Watson, G. J. Plaintext Recovery Attacks against SSH. In IEEE Symposium on Security and Privacy (2009), pp. 16--26.
[3]
Alexa. Top Sites by Category. Data set, 2011. http://www.alexa.com/topsites/category.
[4]
Bar-Yanai, R., Langberg, M., Peleg, D., and Roditty, L. Realtime Classification for Encrypted Traffic. In Experimental Algorithms (2010), vol. 6049 of Lecture Notes in Computer Science, pp. 373--385.
[5]
Bard, G. V. The Vulnerability of SSL to Chosen Plaintext Attack. Cryptology ePrint Archive, Report 2004/111, 2004. http://eprint.iacr.org/2004/111.
[6]
Bard, G. V. A Challenging but Feasible Blockwise-Adaptive Chosen-Plaintext Attack on SSL. Cryptology ePrint Archive, Report 2006/136, 2006. http://eprint.iacr.org/2006/136.
[7]
Bellare, M., and Namprempre, C. Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm. J. Cryptology 21, 4 (2008), 469--491.
[8]
Bissias, G. D., Liberatore, M., Jensen, D., and Levine, B. N. Privacy vulnerabilities in encrypted HTTP streams. In Privacy Enhancing Technologies (2006), vol. 3856 of Lecture Notes in Computer Science, pp. 1--11.
[9]
Black, J., and Urtubia, H. Side-Channel Attacks on Symmetric Encryption Schemes: The Case for Authenticated Encryption. In Proceedings of the 11th USENIX Security Symposium (2002), pp. 327--338. http://www.usenix.org/event/sec02/full_papers/black/black_html/.
[10]
Böhme, R. Advanced Statistical Steganalysis. Springer, 2010. http://www.springer.com/book/978-3-642-14312-0.
[11]
Burnett, S., Feamster, N., and Vempala, S. Chipping Away at Censorship Firewalls with User-Generated Content. In Proceedings of the 19th USENIX Security Symposium (2010), pp. 453--468. http://www.usenix.org/events/sec10/tech/full_papers/Burnett.pdf.
[12]
Caballero, J., Yin, H., Liang, Z., and Song, D. Polyglot: Automatic extraction of protocol format using dynamic binary analysis. In 14th ACM Conference on Computer and Communications Security (2007), pp. 317--329.
[13]
Celine, H. Quoted in Leviathan, Robert Shea and Robert Anton Wilson, Dell Publishing, 1975.
[14]
claffy, k., Andersen, D., and Hick, P. The CAIDA Anonymized Internet Traces Equinix, Chicago, 17 Feb 2011. Data set, 2011. http://www.caida.org/data/passive/passive_2011_dataset.xml.
[15]
Cui, W., Kannan, J., and Wang, H. J. Discoverer: Automatic protocol reverse engineering from network traces. In Proceedings of the 16th USENIX Security Symposium (2007), pp. 199--212. http://www.usenix.org/events/sec07/tech/cui.html.
[16]
Deibert, R. J., Palfrey, J., Rohozinski, R., and Zittrain, J. Global Internet Filtering Map and Regional Summaries, 2011. http://map.opennet.net/.
[17]
Dierks, T., and Allen, C. The TLS Protocol, Version 1.0. RFC 2246, 1999. http://tools.ietf.org/html/rfc2246.
[18]
Diffie, W., Oorschot, P. C., and Wiener, M. J. Authentication and authenticated key exchanges. Designs, Codes and Cryptography 2 (1992), 107--125. http://sites.google.com/site/michaeljameswiener/STS.pdf.
[19]
Dingledine, R. Behavior for bridge users, bridge relays, and bridge authorities. Tor Proposal #125, 2007. https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/125-bridges.txt.
[20]
Dingledine, R. Iran blocks Tor; Tor releases same-day fix. Tor Project official blog, 2011. https://blog.torproject.org/blog/iranblocks-tor-tor-releases-same-day-fix.
[21]
Dingledine, R. Obfsproxy: the next step in the censorship arms race. Tor Project official blog, 2012. https://blog.torproject.org/blog/obfsproxy-next-step-censorship-arms-race.
[22]
Dingledine, R., and Mathewson, N. Tor Protocol Specification. The Tor Project, 2003--2011. https://gitweb.torproject.org/torspec.git/blob/84ec5aca5f5735f445840f6f574842b71365bbde:/torspec.txt.
[23]
Dingledine, R., and Mathewson, N. Design of a blocking-resistant anonymity system. Tech. rep., The Tor Project, 2006. https://svn.torproject.org/svn/projects/designpaper/blocking.pdf.
[24]
Dingledine, R., Mathewson, N., and Syverson, P. Tor: The Second-Generation Onion Router. In Proceedings of the 13th USENIX Security Symposium (2004), pp. 303--320. http://www.usenix.org/events/sec04/tech/dingledine.html.
[25]
Dworkin, M. Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. NIST Special Publication 800-38D, 2007. http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf.
[26]
Dynamic Internet Technology Inc. DynaWeb. Proxy service, 2002. http://www.dit-inc.us/dynaweb
[27]
Feamster, N., Balazinska, M., Harfst, G., Balakrishnan, H., and Karger, D. Infranet: Circumventing Web Censorship and Surveillance. In Proceedings of the 11th USENIX Security Symposium (2002), pp. 247--262. http://www.usenix.org/events/sec02/feamster.html.
[28]
Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and Berners-Lee, T. Hypertext Transfer Protocol--HTTP/1.1. RFC 2616, 1999. http://tools.ietf.org/html/rfc2616.
[29]
Fifield, D., Hardison, N., Ellithorpe, J., Stark, E., Dingledine, R., Porras, P., and Boneh, D. Evading Censorship with Browser-Based Proxies. In Privacy Enhancing Technologies (2012), vol. 7384 of Lecture Notes on Computer Science, pp. 239--258. https://crypto.stanford.edu/flashproxy/flashproxy.pdf.
[30]
Fisk, G., Fisk, M., Papadopoulos, C., and Neil, J. Eliminating Steganography in Internet Traffic with Active Wardens. In Information Hiding (2003), vol. 2578 of Lecture Notes in Computer Science, pp. 18--35. http://www.woozle.org/~mfisk/papers/ih02.pdf.
[31]
Gilmore, J. Quoted in "First Nation in Cyberspace" by Philip Elmer-Dewitt. TIME Magazine, December 1993.
[32]
Guan, Y., Fu, X., Xuan, D., Shenoy, P. U., Bettati, R., and Zhao, W. NetCamo: Camouflaging Network Traffic for QoS-Guaranteed Mission Critical Applications. IEEE Transactions on Systems, Man, and Cybernetics 31, 4 (2001), 253--265.
[33]
Haselton, B., et al. Peacefire: Open Access for the Net Generation. Web site, 1995--2012. http://www.peacefire.org/info/about-peacefire.shtml.
[34]
Hemminger, S. Network Emulation with NetEm. In linux.conf.au (2005). http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.67.1687&rep=rep1&type=pdf.
[35]
Herrmann, D., Wendolsky, R., and Federrath, H. Website Fingerprinting: Attacking Popular Privacy Enhancing Technologies with the Multinomial Naïve-Bayes Classifier. In Proceedings of the 2009 ACM workshop on Cloud computing security (2009), pp. 31--42.
[36]
Hintz, A. Fingerprinting websites using traffic analysis. In Privacy Enhancing Technologies (2003), vol. 2482 of Lecture Notes in Computer Science, pp. 229--233.
[37]
Hopper, N. J., Langford, J., and von Ahn, L. Provably Secure Steganography. In Advances in Cryptology -- CRYPTO (2002), vol. 2442 of Lecture Notes in Computer Science, pp. 119--123.
[38]
Houmansadr, A., Nguyen, G. T., Caesar, M., and Borisov, N. Cirripede: Circumvention Infrastructure using Router Redirection with Plausible Deniability. In Proceedings of the 18th ACM conference on Computer and communications security (2011), pp. 187--200.
[39]
Josefsson, S. The Base16, Base32, and Base64 Data Encodings. RFC 4648, 2006. http://tools.ietf.org/html/rfc4648.
[40]
Karlin, J., Ellard, D., Jackson, A., Jones, C. E., Lauer, G., Makins, D. P., and Strayer, W. T. Decoy Routing: Toward Unblockable Internet Communication. In USENIX Workshop on Free and Open Communications on the Internet (2011). https://db.usenix.org/events/foci11/tech/final_files/Karlin.pdf.
[41]
Köpsell, S., and Hillig, U. How to Achieve Blocking Resistance for Existing Systems Enabling Anonymous Web Surfing. In Proceedings of the 2004 ACM workshop on Privacy in the electronic society (2004), pp. 47--58. https://gnunet.org/sites/default/files/koepsell-wpes2004_0.pdf.
[42]
Krawczyk, H. Cryptographic Extraction and Key Derivation: The HKDF Scheme. Cryptology ePrint Archive, Report 2010/264, 2010. http://eprint.iacr.org/2010/264.
[43]
Leech, M., Ganis, M., Lee, Y.-D., Kuris, R., Koblas, D., and Jones, L. SOCKS Protocol Version 5. RFC 1928, 1996. http://tools.ietf.org/html/rfc1928.
[44]
Lin, Z., Jiang, X., Xu, D., and Zhang, X. Automatic Protocol Format Reverse Engineering through Context-Aware Monitored Execution. In 15th Symposium on Network and Distributed System Security (2008). http://www.isoc.org/isoc/conferences/ndss/08/papers/14_automatic_protocol_format.pdf.
[45]
Lincoln, P., Mason, I., Porras, P., Yegneswaran, V., Weinberg, Z., Massar, J., Simpson, W. A., Vixie, P., and Boneh, D. Bootstrapping Communications into an Anti-Censorship System. In 2nd USENIX Workshop on Free and Open Communications on the Internet (2012). https://www.usenix.org/conference/foci12/bootstrapping-communications-anti-censorship-system.
[46]
Maier, G., Feldmann, A., Paxson, V., and Allman, M. On Dominant Characteristics of Residential Broadband Internet Traffic. In Proceedings of the Ninth Internet Measurement Conference (2009), pp. 90--102. http://www.icir.org/vern/papers/imc102-maier.pdf.
[47]
Mathewson, N. Pluggable Transports for Circumvention. Tor Proposal #180, 2010-2011. https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/180-pluggable-transport.txt.
[48]
Mathewson, N. Tor and Circumvention: Lessons Learned. Invited talk at the 4th USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2011. http://www.usenix.org/event/leet11/tech/slides/mathewson.pdf.
[49]
McGill, R., Tukey, J. W., and Larsen, W. A. Variations of Box Plots. The American Statistician 32, 1 (1978), 12--16. http://www.jstor.org/pss/2683468.
[50]
McLachlan, J., and Hopper, N. On the risks of serving whenever you surf: vulnerabilities in Tor's blocking resistance design. In Proceedings of the 8th ACM workshop on Privacy in the electronic society (2009), pp. 31--40.
[51]
Moghaddam, H. M., Li, B., Derakhshani, M., and Goldberg, I. SkypeMorph: Protocol Obfuscation for Tor Bridges. Tech. rep., University of Waterloo, 2012. http://cacr.uwaterloo.ca/techreports/2012/cacr2012-08.pdf.
[52]
Moller, B. A Public-Key Encryption Scheme with Pseudo-random Ciphertexts. In Computer Security -- ESORICS (2004), vol. 3193 of Lecture Notes in Computer Science, pp. 335--351. http://www.bmoeller.de/pdf/pke-pseudo-esorics2004.pdf.
[53]
Murdoch, S. J., and Danezis, G. Low-Cost Traffic Analysis of Tor. In Proceedings of the 2005 IEEE Symposium on Security and Privacy (2005), pp. 183--195.
[54]
NIST. Digital Signature Standard. FIPS 186-2, 2000. http://csrc.nist.gov/publications/fips/archive/fips186-2/fips186-2.pdf.
[55]
Nottingham, M. Making HTTP Pipelining Usable on the Open Web. Internet-Draft, 2011. http://tools.ietf.org/html/draftnottingham-http-pipeline.
[56]
Ohling, F., Schoen, S., adam or aco, et al. How to Bypass Internet Censorship. FLOSS Manuals, 2011. http://en.flossmanuals.net/bypassing-censorship/.
[57]
Panchenko, A., Niessen, L., Zinnen, A., and Engel, T. Website Fingerprinting in Onion Routing Based Anonymization Networks. In Proceedings of the 10th annual ACM workshop on Privacy in the electronic society (2011), pp. 103--114.
[58]
Perry, M. Experimental Defense for Website Traffic Fingerprinting. Tor Project official blog, 2011. https://blog.torproject.org/blog/experimentaldefense-website-traffic-fingerprinting.
[59]
Pfitzmann, A., and Hansen, M. A terminology for talking about privacy by data minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management, 2010. v0.34. http://dud.inf.tu-dresden.de/literatur/Anon_Terminology_v0.34.pdf.
[60]
Price, M., Enayat, M., et al. Persian cyberspace report: internet blackouts across Iran. Iran Media Program news bulletin, 2012. http://iranmediaresearch.com/en/blog/101/12/02/09/840.
[61]
R Development Core Team. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing, Vienna, Austria, 2011. http://www.R-project.org/.
[62]
Rogaway, P. Nonce-Based Symmetric Encryption. In Fast Software Encryption (2004), vol. 3017 of Lecture Notes in Computer Science, pp. 348--359. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.76.2964&rep=rep1&type=pdf.
[63]
Ross, A. Quoted in "Hillary Clinton adviser compares Internet to Che Guevara" by Josh Halliday. The Guardian, June 2011. http://www.guardian.co.uk/media/2011/jun/22/hillaryclinton-adviser-alec-ross.
[64]
Sun, Q., Simon, D. R., Wang, Y.-M., Russell, W., Padmanabhan, V. N., and Qiu, L. Statistical identification of encrypted Web browsing traffic. In Proceedings of the 2002 IEEE Symposium on Security and Privacy (2002), pp. 19--30.
[65]
UltraReach Internet Corp. Ultrasurf. Proxy service, 2001. http://www.ultrasurf.us/.
[66]
von Ahn, L., and Hopper, N. J. Public-Key Steganography. In Advances in Cryptology -- EUROCRYPT (2004), vol. 3027 of Lecture Notes in Computer Science, pp. 323--341.
[67]
Wang, X., Luo, J., Yang, M., and Ling, Z. A potential HTTP-based application-level attack against Tor. Future Generation Computer Systems 27 (2011), 67--77.
[68]
White, A. M., Matthews, A. R., Snow, K. Z., and Monrose, F. Phonotactic Reconstruction of Encrypted VoIP Conversations: Hookt on Fon-iks. In IEEE Symposium on Security and Privacy (2011), pp. 3--18. https://www.cs.unc.edu/~amw/resources/hooktonfoniks.pdf.
[69]
Wickham, H. ggplot2: elegant graphics for data analysis. Springer New York, 2009. http://had.co.nz/ggplot2/book.
[70]
Wilde, T. Knock Knock Knockin' on Bridges' Doors. Tor Project official blog, 2012. https://blog.torproject.org/blog/knock-knock-knockin-bridges-doors.
[71]
Wiley, B. Dust: A Blocking-Resistant Internet Transport Protocol, 2010. http://blanu.net/Dust.pdf.
[72]
Wustrow, E., Wolchok, S., Goldberg, I., and Halderman, J. A. Telex: Anticensorship in the Network Infrastructure. In Proceedings of the 20th USENIX Security Symposium (2011), pp. 459--473. http://www.usenix.org/events/sec11/tech/full_papers/Wustrow.pdf.
[73]
Yeo, V. Green Dam enforcement watered down. ZDNet Asia (October 2009). http://www.zdnetasia.com/green-dam-enforcementwatered-down-62058509.htm.

Cited By

View all
  • (2024)Look What’s There! Utilizing the Internet’s Existing Data for Censorship Circumvention with OPPRESSIONProceedings of the 19th ACM Asia Conference on Computer and Communications Security10.1145/3634737.3637676(80-95)Online publication date: 1-Jul-2024
  • (2023)PTPerf: On the Performance Evaluation of Tor Pluggable TransportsProceedings of the 2023 ACM on Internet Measurement Conference10.1145/3618257.3624817(501-525)Online publication date: 24-Oct-2023
  • (2023)Stealth Key Exchange and Confined Access to the Record Protocol Data in TLS 1.3Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security10.1145/3576915.3623099(2901-2914)Online publication date: 15-Nov-2023
  • Show More Cited By

Index Terms

  1. StegoTorus: a camouflage proxy for the Tor anonymity system

    Recommendations

    Comments

    Please enable JavaScript to view thecomments powered by Disqus.

    Information & Contributors

    Information

    Published In

    cover image ACM Conferences
    CCS '12: Proceedings of the 2012 ACM conference on Computer and communications security
    October 2012
    1088 pages
    ISBN:9781450316514
    DOI:10.1145/2382196
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

    Sponsors

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 16 October 2012

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. anticensorship
    2. circumvention tools
    3. steganography

    Qualifiers

    • Research-article

    Conference

    CCS'12
    Sponsor:
    CCS'12: the ACM Conference on Computer and Communications Security
    October 16 - 18, 2012
    North Carolina, Raleigh, USA

    Acceptance Rates

    Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

    Upcoming Conference

    CCS '24
    ACM SIGSAC Conference on Computer and Communications Security
    October 14 - 18, 2024
    Salt Lake City , UT , USA

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)53
    • Downloads (Last 6 weeks)3
    Reflects downloads up to 30 Sep 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Look What’s There! Utilizing the Internet’s Existing Data for Censorship Circumvention with OPPRESSIONProceedings of the 19th ACM Asia Conference on Computer and Communications Security10.1145/3634737.3637676(80-95)Online publication date: 1-Jul-2024
    • (2023)PTPerf: On the Performance Evaluation of Tor Pluggable TransportsProceedings of the 2023 ACM on Internet Measurement Conference10.1145/3618257.3624817(501-525)Online publication date: 24-Oct-2023
    • (2023)Stealth Key Exchange and Confined Access to the Record Protocol Data in TLS 1.3Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security10.1145/3576915.3623099(2901-2914)Online publication date: 15-Nov-2023
    • (2023)Telepath: A Minecraft-based Covert Communication System2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179335(2223-2237)Online publication date: May-2023
    • (2023)Semi-shadow file system: An anonymous files storage solutionPeer-to-Peer Networking and Applications10.1007/s12083-023-01573-y17:1(18-32)Online publication date: 16-Oct-2023
    • (2023)MuChat against active attacks, passive attacks, and traffic analysis methods: a free convert chat application for instant communication on mobileCluster Computing10.1007/s10586-023-04070-227:3(2653-2671)Online publication date: 25-Jul-2023
    • (2023)Study Report of Tor Antiforensic TechniquesProceedings of the 2nd International Conference on Cognitive and Intelligent Computing10.1007/978-981-99-2742-5_9(81-91)Online publication date: 27-Sep-2023
    • (2022)Network Traffic Obfuscation against Traffic ClassificationSecurity and Communication Networks10.1155/2022/31043922022(1-14)Online publication date: 31-Aug-2022
    • (2022)SEnD: A Social Network Friendship Enhanced Decentralized System to Circumvent CensorshipsIEEE Transactions on Services Computing10.1109/TSC.2019.294259815:1(346-360)Online publication date: 1-Jan-2022
    • (2022)Procedures, Criteria, and Machine Learning Techniques for Network Traffic Classification: A SurveyIEEE Access10.1109/ACCESS.2022.318113510(61135-61158)Online publication date: 2022
    • Show More Cited By

    View Options

    Get Access

    Login options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media