That's broadly describing one possible class of attack. It looks more like a combination of attacks may have been used - traffic confirmation via timing of outages and packets is definitely a strong one, and that's what GCHQ's QUICKANT was gunning for; ONIONBREATH was targeted at hidden service enumeration and distinguishability, and Tor is seemingly not perfect at that. (I gather HSes were due for an overhaul anyway?)

Remember, Tor cannot comprehensively protect against a global passive attacker - which is what GCHQ, DSD, NSA, et al are trying to be, as well as every other kind of attacker of course. (Generally speaking, they try every possible angle at once.)

However, they have still not had much success to date identifying users, especially en masse. We're talking here about highly-targeted attacks, combined with a few OPSEC fails.

(I still prefer garlic routing in general, but Tor has a huge advantage which has little to do with tech - a massive, diverse userbase to hide amongst.)

I've studied Tor vulnerabilities for two years. I'm seeing signs of traffic confirmation (active), traffic confirmation (passive), stream watermarking, and a massive willingness to shape control of the network with DoS. Just about every attack on hidden services (active and passive), of which I am aware, was deployed, all at once. The malformed packet DoS was especially clever. And I'm sure a ton more were used that never made it to the academic research.

It was almost comical, like the star ship captain saying "now on my mark, fire all photon torpedoes!" They just revealed a massive amount of capability to send a message: Tor is not safe. They want everyone to know that despite that sticker on Snowden's laptop, Tor remains vulnerable.

But what remains interesting, and glaringly obviously absent, is user identification. The NSA does not appear to be able to deanonymize users at will. That is, given enough time and enough resources, they can ID hidden services and long-term users, but given an arbitrary Tor exit and and TCP stream, they can't simply follow it back to its origin.

A for effort. But in organizaton it looks like a military campaign, not a cyber attack. Straight out of the "total dominance" playbook.

But of course it won't work. Tor isn't a country. Its an idea. You can't force the Internet to "submit."

All this did was make blindingly obvious holes that many researchers have been asking to be fixed for a while.

> But what remains interesting, and glaringly obviously absent, is user identification.

I wonder if using Facebook over Tor would help in that regard.

https://www.facebook.com/notes/protect-the-graph/making-conn...

This is very interesting. Are you suggesting that Facebook over Tor could be a step in the wrong direction? Official NSA Facebook partnerships are for now very unlikely, but I am interested to know how Facebook over Tor could in principle solve the user identification problem listed by grand parent.

Please correct me if I'm wrong, but if someone is logged in to Facebook while browsing over Tor, aren't you just one CSRF from getting all personal details for the user?

You're corrrect. Fast Tor user attribution is a different, much harder problem, and one they don't appesr to have cracked.

If you're using Facebook over Tor, you probably shouldn't be using an account that you created on an non-Tor connection or an account tied to your real-world identity.

If you are, and you're concerned about being identified... :/

I don't think Facebook will let you register new accounts using a Tor IP.

Indeed, it works like freenet IRC where you have to make an account first then log in to it with Tor. This is solved by making a throwaway VPS or virtual desktop you ssh into with Tor, make your account, shred the VPS and then change the password when you log in directly to Fb with Tor.

You can also edit Torrc to temporarily only use your own Tor exit nodes if worried about malicious exits while setting up accounts.

Someone's WIFI connection with a modified MAC is also a good way. Just make sure it's not the neighbours WIFI.

Using Facebokk would be considered harmful, and make tge situation worse.

I'm sure they're disscussing fixes on the tor dev irc and mailing list right now if anyone's interested.

> I've studied Tor vulnerabilities for two years.

Is that academic research, or in what context? I'd be interested to hear what you have to say on that; anything published anywhere? Email in profile if you'd be into that :)

You can't see emails in profiles, but I'd be happy to talk about what I can.

I think you're right. This describes a graph attack that uses a secondary vector of malformed packets to limit other connections.

Is there actually anything you can do to prevent this kind of attack?

I'm assuming once your network is compromised to such an extent there is not much you can do.

One (rather wasteful) workaround to delay the discovery a little bit is to have each node generate an equivalent amount of traffic going somewhere else.

The concept of a hidden service is itself interesting since it must still be "visible" to some extent, or else nothing could communicate with it; but at the same time, it's attempting to hide any indications of its presence. Attacks based on a large volume of traffic will always work if the service is centralised, since that's where all the traffic will (eventually) go. The only real solution I see is to make hidden services highly distributed so that the load is spread out and largely masked by other traffic.

Somewhat related: http://en.wikipedia.org/wiki/Fast_flux

Cut the hardline. Well, but seriously, shut down the network temporarily.

Wouldn't that only make it easier to confirm that this network/ip is associated with given hidden service?

This made me thinking btw about the latest hetzner hiccups which never happened before.

Yeah, assuming a global adversary, you'd just watch which servers went dark and the investigate them. We really need a "defensive mode" for TOR.

What are the odds of that request being routed exclusively through those specific nodes ?

I mean he either tried for a long time or had a very long list of nodes... I don't even know what's the average number of middle node for one route.

What I don't fully understand is why it's necessary for an adversary to have access to all nodes on the complete path from his DDoS machine to the target IP he's trying to unmask.

Wouldn't it only be necessary that I have shared knowledge of what packet I'm sending between the machine that I'm sending my DDoS from and my relay which I'm hoping is the last one that my target is connecting to? Or perhaps I don't understand Tor well enough.

You might be able to use statistics instead. If you flood Tor with requests for a particular service, that service's address should become more common at the relays you control.

Tor works by obfuscating traffic, jumping through 3 or more nodes before exiting the tor network. If an attacker controls those three nodes it is possible for them to determine the source.

You're not going to know the contents of the packet unless you also control the machine in the previous hop.

You can use a timing attack.

I think there's a chance of using malformed packets to disrupt all other nodes.

In other words, a Sybil attack.

A Sybil attack is any attack that involves attacking by brute forcing the number of identities. The identity need not be based on cryptographic systems -- it could simply be the number of IP addresses.

what do you mean by "hidden service" ?

A web site only available using Tor.

See: https://www.torproject.org/docs/hidden-services.html.en