On Sat, Mar 29, 2014 at 1:06 PM, Jann Horn <[email protected]> wrote: > This is a very simple implementation of an active timing attack on Tor. > Please note that > the Tor developers are aware of issues like this - > https://blog.torproject.org/blog/one-cell-enough states:...
interesting work; and a good example of the limits of traffic analysis protection in low latency, stream oriented protocols. an even more effective approach is using active DoS as a signal for confirmation, like your sequence of activity: "Denial of Service or Denial of Security? How Attacks on Reliability can Compromise Anonymity" http://hostmaster.freehaven.net/anonbib/cache/ccs07-doa.pdf > So, this is a known problem, but I wanted to see how easy it really is to do > this, > and I wanted to try it myself, so I built a PoC. > > The requirements are: > - The user points his browser to an attacker's webserver and stays on that > server > long enough (a bit over 4 minutes in my implementation) one other trick, try hosting the webserver on a common "long lived port". not sure if this will make much difference, but it should improve the odds of your entire few minute sequence staying on the same circuit... best regards, _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
