Tor has called for calm after new academic research into traffic analysis showed that it was possible to identity 81 per cent of users on the anonymity network. The technique, which tracks patterns in Tor connections as they pass around the web, could allow nation states to unmask Tor users with a false-positive rate of just over six percent.
The results appear alarming but security experts said the revelations were nothing new. While it is theoretically possible to track Tor users by linking up their entry and exit points on the anonymity network, doing so has proven difficult.
Research led by professor Sambuddah Chakravarty from the Indraprastha Institute of Information Technology in Delhi showed that in laboratory tests it was possible to spot and follow Tor traffic. The experiment uses readily available traffic monitoring technology, in this case Cisco's NetFlow, to analyse Tor traffic on a massive scale.
As Tor traffic behaves very differently to ordinary web traffic it is possible to spot its patterns, Chakravarty argued:
"A powerful adversary can mount traffic analysis attacks by observing similar traffic patterns at various points of the network, linking together otherwise unrelated network connections."
In laboratory tests the experiment was 100 percent accurate, falling to 81.4 percent in real-world experiments. Tor project leader Roger Dingledine said the six percent false positive rate made the attack "effectively useless", adding that academic research into traffic analysis on the network was still hugely important.
"Traffic confirmation attacks are not a new area so don't freak out without actually reading the papers," he concluded. The false positive rate is the experiments main problem. Conducting traffic analysis on the millions of active Tor connections would create tens of thousands of false positives, making it almost impossible to be sure you had tracked anyone successfully.
While it is easy to spot and follow traffic flows on small networks, doing so when there are millions of traffic flows becomes near impossible. False-positives, when an algorithm incorrectly thinks it has found a match, become more commonplace on larger networks.
Responding to questions on the Tor blog Chakravarty said that sensationalist media reports had got the facts wrong:
"Firstly, they [the media] have blow it a bit out of proportion by saying that '81 percent of Tor traffic', which is not true. It was only 81.4 percent of our experiments, and we have spoken about this upfront in our paper," he explained.
If governments found a way to unmask Tor users en masse it could have catastrophic consequences for free speech and privacy online. Both GCHQ and the NSA are known to target Tor users, but thus far the anonymity network has been a tough nut to crack.
http://www.wired.co.uk/news/archive/2014-11/20/tor-still-secure