Trawling for tor hidden services: Detection, measurement, deanonymization

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2013, Pages 80-94

  Biryukov, Alex ^a   Pustogarov, Ivan ^a   Weinmann, Ralf Philipp ^a  

^a UNIVERSITY OF LUXEMBOURG   (Luxembourg)

Author keywords

anonymity network; hidden services; privacy; Tor

Indexed keywords

ANONYMITY NETWORKS; COMMAND AND CONTROL; DEANONYMIZATION; DESIGN AND IMPLEMENTATIONS; HIDDEN SERVICES; INTERNET SERVICES; SILK ROADS; TOR;

DATA PRIVACY; SEARCH ENGINES;

FISHERIES;

EID: 84881248798     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2013.15     Document Type: Conference Paper

References (26)

1. ANONYMOUS. IAmA a malware coder and botnet operator, AMA. http://www.reddit.com/r/IAmA/comments/sq7cy/iama-a-malware-coder-and-botnet- operator-ama/, April 2012.
2. BAUER, K. S., MCCOY, D., GRUNWALD, D., KOHNO, T., AND SICKER, D. C. Low-resource routing attacks against Tor. In WPES (2007), P. Ning and T. Yu, Eds., ACM, pp. 11-20.
3. BIRYUKOV, A., PUSTOGAROV, I., AND WEINMANN, R.-P. TorScan: Tracing long-lived connections and differential scanning attacks. In ESORICS 2012, S. Foresti, M. Yung, and F. Martinelli, Eds., vol. 7459 of LNCS. Springer, 2012, pp. 469-486.
4. BROWN, D. Resilient botnet command and control with Tor. DefCon 18, https://www.defcon.org/images/defcon-18/dc-18-presentations/D.Brown/ DEFCON-18-Brown-TorCnC.pdf, July 2010.
5. CHRISTIN, N. Traveling the silk road: A measurement analysis of a large anonymous online marketplace. CoRR abs/1207.7139 (2012).
6. DARROCH, J. N., AND SENETA, E. On quasi-stationary distributions in absorbing continuous-time finite Markov chains. Journal of Applied Probability 4, 1 (1967), pp. 192-196.
7. DINGLEDINE, R., MATHEWSON, N., AND SYVERSON, P. F. Tor: The second-generation onion router. In USENIX Security Symposium (2004), USENIX, pp. 303-320.
8. DOUCEUR, J. R. The Sybil attack. In IPTPS 2002 - Peer-to-Peer Systems, First International Worksho (2002), P. Druschel, M. F. Kaashoek, and A. I. T. Rowstron, Eds., vol. 2429 of Lecture Notes in Computer Science, Springer, pp. 251-260.
9. ELAHI, T., BAUER, K., A L S ABAH, M., DINGLEDINE, R., AND GOLDBERG, I. Changing of the guards: A framework for understanding and improving entry guard selection in Tor. In Proceedings of the Workshop on Privacy in the Electronic Society (WPES 2012) (2012), ACM, pp. 43-54.
10. ELICES, J., PEREZ-GONZALEZ, F., AND TRONCOSO, C. Fingerprinting Tor's Hidden Service Log Files Using a Timing Channel. In WIFS 2011 - 3rd IEEE International Workshop on Information Forensics and Security (2011), IEEE.
11. G DATA SECURITY. Botnet command server hidden in Tor. http://blog.gdatasoftware.com/blog/article/botnet-command-server-hidden-in-tor. html, September 2012.
12. GUARNIERI, C. Skynet, a Tor-powered botnet straight from Reddit. https://community.rapid7.com/community/infosec/blog/2012/12/06/ skynet-a-tor-powered-botnet-straight-from-reddit, December 2012.
13. JANSEN, R., AND HOPPER, N. Shadow: Running Tor in a Box for Accurate and Efficient Experimentation. In NDSS 2012 - Proceedings of the Network and Distributed System Security Symposium (2012), Internet Society.
14. LIPMAN, D. H. Mailing list post: "[tor-talk] vwfws4obovm2cydl.onion ?". https://lists.torproject.org/pipermail/tor-talk/2012-June/024565.html, June 2012.
15. LOESING, K. Privacy-enhancing Technologies for Private Services. PhD thesis, University of Bamberg, May 2009.
16. MANDL, P. Sur le comportement asymptotique des probabilites dans les ensembles de etats dune chaine de Markov homogeene (Russian). Casopis Pest. Mat. 84 (1959), pp. 140-149.
17. MICAH, M. W., WRIGHT, M., ADLER, M., AND LEVINE, B. N. Defending anonymous communications against passive logging attacks. In Proceedings of the 2003 IEEE Symposium on Security and Privacy (2003), pp. 28-41.
18. MURDOCH, S. J. Hot or not: Revealing hidden services by their clock skew. In 13th ACM Conference on Computer and Communications Security (2006), ACM Press, pp. 27-36.
19. ØVERLIER, L., AND SYVERSON, P. Locating hidden servers. In Proceedings of the 2006 IEEE Symposium on Security and Privacy (2006), IEEE Computer Society, pp. 100-114.
20. ØVERLIER, L., AND SYVERSON, P. F. Valet services: Improving hidden servers with a personal touch. In PET 2006 - Privacy Enhancing Technologies (2006), G. Danezis and P. Golle, Eds., vol. 4258 of Lecture Notes in Computer Science, Springer, pp. 223-244.
21. POLLETT, P. K. Analytical and computational methods for modelling the long-term behaviour of evanescent random processes, June 1993.
22. SCHUMER, C. E., AND MANCHIN, J. Press release: Manchin urges federal law enforcement to shut down online black market for illegal drugs. http://manchin.senate.gov/public/index.cfm/2011/6/manchin-urges-federal-law- enforcement-to-shut-down-online-black-market-for-illegal-drugs, Jun 2011.
23. SENETA, E. Quasi-stationary behaviour in the random walk with continuous time. Australian Journal of Statistics 8, 2 (1966), 92-98.
24. SHEBARO, B., PEREZ-GONZALEZ, F., AND CRANDALL, J. R. Leaving timing-channel fingerprints in hidden service log files. Digital Investigation 7 (2010), pp. 104-113.
25. THE TOR PROJECT. Tor Rendezvous Specification. https://gitweb.torproject. org/torspec.git?a=blob plain;hb=HEAD;f=rend-spec.txt, accessed on November 13th, 2012.
26. ZANDER, S., AND MURDOCH, S. J. An improved clockskew measurement technique for revealing hidden services. In USENIX Security Symposium (2008), pp. 211-226.