The Effect of DNS on Tors Anonymity Benjamin Greschbach KTH Royal - - PowerPoint PPT Presentation

▶
the effect of dns on tor s anonymity
SMART_READER_LITE
LIVE PREVIEW

The Effect of DNS on Tors Anonymity Benjamin Greschbach KTH Royal - - PowerPoint PPT Presentation

Oct 23, 2022 18 likes •438 views

The Effect of DNS on Tors Anonymity Benjamin Greschbach KTH Royal Institute of Technology Tobias Pulls Karlstad University Laura M. Roberts Princeton University Philipp Winter Princeton University Nick Feamster Princeton University 1

slide-1
SLIDE 1

The Effect of DNS on Tor’s Anonymity

Benjamin Greschbach KTH Royal Institute of Technology Tobias Pulls Karlstad University Laura M. Roberts Princeton University Philipp Winter Princeton University Nick Feamster Princeton University

1

slide-2
SLIDE 2

www.generic-adult-content-site.com

2

slide-3
SLIDE 3

www.generic-adult-content-site.com

3

slide-4
SLIDE 4

How is DNS handled in Tor?

example.com DNS resolver Tor client Guard Middle Exit

4

slide-5
SLIDE 5

How is DNS handled in Tor?

example.com DNS resolver Tor client Guard Middle Exit Where’s example.com?

5

slide-6
SLIDE 6

How is DNS handled in Tor?

example.com DNS resolver Tor client Guard Middle Exit Where’s example.com?

6

slide-7
SLIDE 7

Exit relays perform DNS resolution.

example.com DNS resolver Tor client Guard Middle Exit Where’s example.com?

7

slide-8
SLIDE 8

Research Questions

example.com DNS resolver Tor client Guard Middle Exit Where’s example.com?

?

8

slide-9
SLIDE 9

Research Questions

example.com DNS resolver Tor client Guard Middle Exit Where’s example.com?

? ?

9

slide-10
SLIDE 10

How DNS can be used to compromise Tor.

example.com DNS resolver Tor client Guard Middle Exit Where’s example.com?

? ? ?

10

slide-11
SLIDE 11

How exposed are DNS queries?

11

slide-12
SLIDE 12

How exposed are DNS queries?

12

slide-13
SLIDE 13

How exposed are DNS queries?

13

slide-14
SLIDE 14

How exposed are DNS queries?

14

slide-15
SLIDE 15

How exposed are DNS queries?

15

slide-16
SLIDE 16

How exposed are DNS queries?

16

slide-17
SLIDE 17

How exposed are DNS queries?

17

slide-18
SLIDE 18

How exposed are DNS queries?

18

slide-19
SLIDE 19

How exposed are DNS queries?

19

slide-20
SLIDE 20

How exposed are DNS queries?

20

slide-21
SLIDE 21

DNS traffic traverses ASes that are not otherwise traversed by TCP traffic.

21

For half of all of the Alexa Top 1,000 websites, DNS-only ASes account for 57% or more of all traversed ASes

slide-22
SLIDE 22

What resolvers do exit relays use?

22

slide-23
SLIDE 23

What resolvers do exit relays use?

23

slide-24
SLIDE 24

What resolvers do exit relays use?

24

slide-25
SLIDE 25

What resolvers do exit relays use?

25

slide-26
SLIDE 26

What resolvers do exit relays use?

Resolver Min (%) Max (%) Median (%) Google 23.57 42.33 32.84 Local 7.71 15.95 11.56 OVH 1.96 14.13 6.57 OpenDNS 0.05 5.62 0.76 Percentage of observed DNS queries

26

slide-27
SLIDE 27

What resolvers do exit relays use?

Resolver Min (%) Max (%) Median (%) Google 23.57 42.33 32.84 Local 7.71 15.95 11.56 OVH 1.96 14.13 6.57 OpenDNS 0.05 5.62 0.76 Percentage of observed DNS queries

27

slide-28
SLIDE 28

What resolvers do exit relays use?

Resolver Min (%) Max (%) Median (%) Google 23.57 42.33 32.84 Local 7.71 15.95 11.56 OVH 1.96 14.13 6.57 OpenDNS 0.05 5.62 0.76 Percentage of observed DNS queries

28

slide-29
SLIDE 29

How can an attacker leverage DNS?

29

slide-30
SLIDE 30

How can an attacker leverage DNS?

30

slide-31
SLIDE 31

Attacker augments website fingerprinting attack with DNS data

  • We extended Wang et al.’s Wa-kNN classifier (USENIX Security’14)
  • Close-the-world attack
  • High precision attack

○ Accepts Wa-kNN’s website classification only if that website was observed in DNS traffic

  • Our attacks are very precise for unpopular websites

31

slide-32
SLIDE 32

Our attacks at Internet-scale

  • Place Tor clients in top five Tor usage countries
  • Simulate clients’ online behavior

○

  • Cf. Johnson et al. CCS’13
  • Simulate Tor clients’ path selection

○ TorPS (github.com/torps/torps)

  • Run traceroutes client →guard and exit → destination

○ Use RIPE Atlas!

  • Check for overlapping autonomous systems

○ Set intersection

32

slide-33
SLIDE 33

Analyzed four Tor exit relay DNS set-up scenarios

  • What if all Tor exit relays were set up to use their ISPs’ resolvers?
  • What if all Tor exit relays were set up to use Google’s 8.8.8.8 public resolver?
  • What if all Tor exit relays were set up to do their own DNS resolution?
  • What if all Tor exit relays were set up as they currently are (status quo)?

33

slide-34
SLIDE 34

Fraction of compromised streams

34

slide-35
SLIDE 35

Immediate Countermeasures

  • Recommendations for exit relay operators

○ Don’t use Google’s 8.8.8.8 ○ Use ISP’s resolver ○ Run their own resolver with QNAME minimization

35

slide-36
SLIDE 36

Long-term Solutions

  • Add confidentiality to DNS

○ T-DNS (Zhu et al. Oakland’15)

  • Improve website fingerprinting defenses

36

slide-37
SLIDE 37

Contributions

  • Discovered that DNS exposes Tor users’ behavior to more adversaries than

previously thought

37

slide-38
SLIDE 38

Contributions

  • Discovered that DNS exposes Tor users’ behavior to more adversaries than

previously thought

  • Discovered that Google gets to learn a lot about Tor users’ online activity

38

slide-39
SLIDE 39

Contributions

  • Discovered that DNS exposes Tor users’ behavior to more adversaries than

previously thought

  • Discovered that Google gets to learn a lot about Tor users’ online activity
  • Created proof-of-concept deanonymization attacks that demonstrate how

DNS can make website fingerprinting attacks more precise

39

slide-40
SLIDE 40

Contributions

  • Discovered that DNS exposes Tor users’ behavior to more adversaries than

previously thought

  • Discovered that Google gets to learn a lot about Tor users’ online activity
  • Created proof-of-concept deanonymization attacks that demonstrate how

DNS can make website fingerprinting attacks more precise

  • Performed simulations at Internet-scale in order to understand how our

attacks could affect real people

40

slide-41
SLIDE 41

Contributions

  • Our work compels researchers to continue exploring how to make DNS more

secure

41

slide-42
SLIDE 42
  • Paper, data, code, and replication

instructions: https://nymity.ch/tor-dns/

  • Contact: laurar@cs.princeton.edu

Nick Tobias

Fin

Philipp Benjamin Laura

42