Computer's Heat May Unmask Anonymized PCs 146
Virtual_Raider writes "Wired is carrying a story about a method developed by security researchers to identify computers hiding behind anonymity services. From the article: 'His victim is the Onion Router, or "Tor" — a sophisticated privacy system that lets users surf the web anonymously. Tor encrypts a user's traffic, and bounces it through multiple servers, so the final destination doesn't know where it came from. Murdoch set up a Tor network at Cambridge to test his technique, which works like this: If an attacker wants to learn the IP address of a hidden server on the Tor network, he'll suddenly request something difficult or intensive from that server. The added load will cause it to warm up.'"
Hot enough to... (Score:2, Funny)
FTA: Clock Skew, not temp. (Score:5, Informative)
Of course, the defense to this attack is probably something along the lines of:
$ man nice
Re:FTA: Clock Skew, not temp. (Score:5, Informative)
The idea of using some sort of timing attack against such a network is interesting. There are probably better methods, though.
One idea that springs to mind is that such P2P systems use caches. If you could generate enough requests to flood the cache system, you can force any computer to query nearby computers, where the latency will be roughly equal to the number of hops along the critical path. It then becomes similar to the game of "Black Box", where you try to map particles by throwing rays in and seeing what happens. If you have a sufficiently large latency map from a sufficiently large number of entrance points, you should be able to derive the whole of the exposed topology of the P2P network and be able to identify which of those servers carry what data.
(Think about it. Those of us in Open Source have all done reverse engineering, we have all tried to wrest the secrets of some black box we can't see the inside of, and eventually we have all succeeded in doing so. Our interpretation may not 100% match the internals literally, but they WILL 100% match the internals logically. And in the end, that's all that matters.)
Re: (Score:2)
The computers I tested it with were normal desktop machines. They all had fans, and in some cases were thermostatically controlled. The differences in temperature were only 1–2 C, but that could be remotely detected.
An oven-controlled crystal might be accurate enough (<1pp
Re: (Score:2)
Re: (Score:2)
One idea that springs to mind is that such P2P systems use caches. If you could generate enough requests to flood the cache system, you can force any computer to query nearby computers, where the latency will be roughly equal to the number of hops along the critical path. It then becomes similar to the game of "Black Box", where you try to map particles by throwing rays in and seeing what happens. If you have a sufficiently large latency map from a sufficiently large number of entrance points, you should be able to derive the whole of the exposed topology of the P2P network and be able to identify which of those servers carry what data.
Nice idea, but it wouldn't work on Tor. The topology of the router network depends on who is using it, as routing paths are decided by the machines using the Tor network to remain anonymous, not by the routers themselves. In the case of a hidden service on Tor, a directory server is used to associate a .onion TLD with several routing paths the clients can use to contact to the server. Little information can be derived from the routing paths themselves, as the address of each router in the sequence is encr
Re: (Score:2)
Re: (Score:2)
There will be exactly one minimal fit for these conditions and this will be the topology of the network.
This won't work on Tor, for three reasons. First, there is no overall network topology. The routers merely act on routing instructions passed onto them via the client; they don't make connections autonomously, like, for instance, the nodes in a Gnutella network would do. Second, the hidden servers are not actually part of the Tor network; the routers merely act as middle men, stopping direct communication between the server and the client. Thirdly, I'm not aware of any caching that goes on between router
Re: (Score:2)
You don't need to know every complete path, so the number of possible permutations is something you can work around. Think of the tables used by the nudes for routing as one gigantic divided secret. It is possible to prove that for a divided secret, you need only know one part more than 1/3 of all the parts before the secret is weak enough to be considered compromised. The question, then, is purely one of how to gain access to these tables.
Re: (Score:2)
Think of the tables used by the nodes for routing as one gigantic divided secret. It is possible to prove that for a divided secret, you need only know one part more than 1/3 of all the parts before the secret is weak enough to be considered compromised. The question, then, is purely one of how to gain access to these tables.
I don't think that's quite right. If there are 3 pieces of data encrypted with three different keys, then knowing what one of those pieces of information is doesn't necessarily help figure out what the other two pieces are.
Tor is pleasingly clever in the way it goes about ensuring anonymity. Each router in the Tor network publishes its IP address and public key on a directory server. The client picks a random sequence of router addresses, R1 to RN, and corresponding public keys, P1 to PN. It then encrypts
Re: (Score:2)
In many ways I agree, but literal != logical. If I spoof the behaviour you look for, I could 'frame' another server for my processes. Log
Re: (Score:2)
You forgot the simplest one that will defeat all attempts at timestamp fingerprinting...
Lie about the time. As long as it monotonically increases between packets, and stays within a few seconds of accurate, everything goes smoothly (for most general-purpose data traffic - Obviously this would completely screw up something like an NTP query).
Re: (Score:2)
Now, this isn't to say you can't seriously screw with the network's perception of time. For example, you could channel bond multiple VPN connections into a single super-VPN co
Randomize the clock (Score:5, Insightful)
Since this and other such attacks are based on analyzing very small changes in the target system clock, even a tiny amount of randomization or pseudo randomization would be effective.
Re: (Score:3, Informative)
For most hidden services, either should be feasible. Timing doesn't seem that important anyway, given the inherent latency of the Tor network.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Insightful)
RFC1323 is not part of tcp/ip. It is an optional extension that some systems could choose to implement. A system does not have to implement these options. Leave RFC1323 options turned off at the operating system level, and you won't reveal information about the system time keeping in that manner.
However, there is a possibility the TOR and other applications themselves reveal the timestamp, say the applications ordinarily include it in messages passed from one peer to another (or from server to client
Re: (Score:2)
Even if the clock oscillator were part of the CPU package, adding some random variation to the CPU cooler fan speed would defeat this.
Re:Randomize the clock (Score:5, Insightful)
Re: (Score:2, Insightful)
Not necessarily.
If you have your CPU-intensive app running at a low priority, and TOR running at a higher priority, then your CPU will become slightly hotter when TOR is doing heavy processing.
It may make it much harder to detect than it already is, but there you go.
Re: (Score:2, Insightful)
Why would heavy processing by TOR make the CPU run hotter than heavy processing by $SOME_APP ? It's still just heavy processing, CPU at 100% usage.
Re: (Score:2)
Please explain exactly how the CPU will know what priority the scheduler has assigned to a given process.
A system with speedstep might turn up the clock rate when it sees that there is a high priority process wanting CPU, but that's not the norm.
Re: (Score:2)
I don't specifically know "how". What I do know is that it's a fact, and quite easy to demonstrate.
Start a long-running CPU-intensive program (my preference is mencoder) at a low priority, and monitor the CPU tempurature. After you've given it plenty of time to cool down (a day or more if you like) start the program at the default or higher priority, and you'll see the tempurature is significantly high
Re: (Score:2)
Did you do that test on a laptop?
Re: (Score:2)
Not a laptop, nor a desktop with CnQ/SpeedStep...
In fact it is a 4 year-old Athlon XP, in a motherboard that doesn't even support S2K.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Since this and other such attacks are based on analyzing very small changes in the target system clock, even a tiny amount of randomization or pseudo randomization would be effective.
Although it would certainly make it more difficult, it would not be an absolute defense against the identification of the PC. Identification of a PC that is using this defense may not occur in 30 seconds after a single challenge, but could
WHA!?! (Score:2)
Great heat source (Score:2)
Re: (Score:2)
Watt goes around, comes around. (Score:2)
I did the same "back in the day" when I got my first personal Unix box - an Altos 68000 - one of crowd of generic Motorols 60x0 unix boxes that came out before PCs squeezed them out. With a meg of RAM and an 8" hard drive it put out enough heat to keep the computer r
April already? (Score:1, Offtopic)
utterly useless? (Score:4, Interesting)
Re: (Score:2, Informative)
Hidden services are something different than a Tor user. A hidden server is reachable via some hostname in the
More info on Murdochs talk (Score:1, Informative)
Utter Bullshit (Score:1)
Re: (Score:1)
Easy solution... (Score:2)
Curiously (Score:2)
Hold on (Score:2)
Far simpler method... (Score:2)
2. DDoS a server, not enough to kill it but slow it down a lot
3. Measure response times to hidden service
4. If all requests using different paths now are slow, you got it
Also, that attack scales to detect multiple hidden sites simultaniously - hit one server, request ten sites and see who answers quickly and not. It's just a consequence of depending on one machine. The only way you could totally avoid that is to not have services at all, only distributed datastore like e.g. Freenet.
Simple Defense (Score:5, Insightful)
Since date and time information isn't included in TCP/IP packets, this kind of attack won't work for all services. Assuming that the "hidden servers" in question are HTTP servers, there is a rather simple workaround: simply disable sending the "Date" header. This can probably be accomplished with mod_headers [apache.org] in Apache, but I've never tried using it myself. Oddly enough, the server would still be standards compliant [w3.org]. Obviously, servers that leak the current time by some other means would still be vulnerable.
A simpler, less precise attack of this nature would simply be to continuously ping the suspected server via both Tor and the public internet. If they (reproducibly) fail at the same time (and we could launch a denial-of-service attack to make it fail), they're probably the same machine. Attacks of this nature might even be able to confirm if a hidden server is on the same network as another computer.... But any of these attacks require someone to suspect you of running the server in the first place—and if they do, you probably have bigger problems to worry about.
The bottom line is, as Tor's manual clearly indicates [eff.org], having a hidden server machine accessible from both Tor and the internet is a bad thing. Operators of hidden services should use a dedicated machine and block all incoming traffic (on all TCP and UDP ports) that is not via Tor.
Re: (Score:2)
The answer is RC5, or SETI (Score:2)
Time Sync Early And Often (Score:2)
What if there were a time sync server in the setup whose whole purpose in life is to keep track of the time?
Have no other apps running on it, so that it has negligible system load. All the other systems in the TOR could be set up to sync their time with it every few seconds, i.e. before clock drift becomes detectable. Might check each and every second so as to intentionally cause a collision on the time server and add some randomness. Or, do a time sync every random(1..10) seconds. Or, use multiple NIC
Use NTP to defend against all clock skew attacks (Score:5, Interesting)
The correct defense is the same as the last time:
a) Make sure that there is no system clock skew, by running Network Time Protocol (NTP) on all servers.
b) Make sure that all externally visible timestamps are based on the system clock.
Part (b) is the only difficult step, since many current IP stacks use a private counter/clock instead of the system clock, presumably to reduce the overhead of providing timestamps. I know that Linus T have discussed using user-level library code to provide microsecond resolution (or better) timestamps, with very low overhead:
The library code can just query the cpu/system timer, multiply by the current scale factor (which depends on things like dynamically variable cpu clock frequency), and add the base time which was stored by the OS on the last HW clock interrupt: Total runtime, including call/return overhead can be below 100 clock cycles, which is fast enough to use it everywhere timestamps are needed:
BTW, I wrote asm code to do exactly this inside Novell's NetWare OS a little over 10 years ago. In NetWare these timestamps were used by the Packet Burst algorithms which optimized packet transmission rates.
Terje
what if (Score:2)
Won't this break down if more than one investigator is running this attack on a network? What if several people try this trick against a group of servers? How would they know the time skew was due to THEIR query? What if this is the best trick ever so everyone trying to track down a computer uses it
Couldn't they detect whatever the popular trick is to increase temp and have the computer try and skew others on the network. I don't suppose you would want to do it random
This system requires 2 points of info (Score:2)
Without knowing as well that all systems are skewd differently you also have a problem. What if you grabbed a random set of 32, with 2 groups of 12 and one of 8 with identical skews.
How can I work it into my next CSI:Renton script? (Score:2)
Re:I didn't RTFA, but... (Score:5, Informative)
See what reading the article gets you? A tiny nugget of useless information.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Fix it with NTP? (Score:5, Interesting)
Re: (Score:1, Informative)
Or try a simple hardware upgrade [walmart.com]
Re: (Score:1)
Every computer on my network (several dozen) are sync'd every 5 seconds by a single packet. (ok, 3... one from each NTP server.) That includes windows machines too. (forget w32time and install ntpd)
Re: (Score:2)
I agree it wouldn't do much in terms of dammage but i would guess it would make it possible to bypass a few time restricted activities, logging, etc.
Re:Fix it with NTP? (Score:5, Insightful)
One must remember TOR doesn't guarantee strong anonymity, for that you need something like Herbivore [cornell.edu].
Re: (Score:2)
Exactly. This is kind of like the whole NP-Complete space. It's hard to find the right answer, but once you've found the right answer, it can be verified in polynomial time. Same thing here. It's a verification exploit, not a location exploit. It can, with a sufficiently large number of tests, verify that the host you think is providing the information really is. However, unless you can simultaneously track the heat emissions from every computer in the world (and somehow process that much information
Re: (Score:2)
Re: (Score:2, Informative)
While Herbivore sounds interesting, don't forget to mention its limitations as well.
In the Herbivore documentation, you will find this PDF: Eluding Carnivores: File Sharing with Strong Anonymity [cornell.edu]
From which we learn that: The system consists of approximately 27,000 lines of Java and C code, 2,000 of which comprise the GUI for anonymous filesharing and a helper application for k-anonymous chat while the rest form the core system. (Section 5: Performance)
So Herbivore provides anonymity for filesharing a
Re: (Score:2)
Tor without software installation? (Score:2)
This is slightly offtopic, but I didn't realize that you could use the TOR network in this way. Can you expand on this? I thought in order to use TOR, you had to install the TOR software package on the end-user's machine, and
Re: (Score:2)
Re: (Score:2, Insightful)
Fix it with SETI at home (Score:2)
Re: (Score:2)
Re: (Score:1)
Re:I didn't RTFA, but... (Score:5, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:3, Interesting)
And if I suddenly load a video file (Score:1)
My CPU temp would spike more than what he's doing to me. Or if I'm playing a game.
Packet-rewriting firewalls, here we come :)
Re: (Score:2, Offtopic)
Re: (Score:1)
Alli
Re: (Score:2)
According to TFA, no. Now maybe you want to R it.
Re:I didn't RTFA, but... (Score:5, Funny)
Re:I didn't RTFA, but... (Score:5, Funny)
consider your id: 223197
then, consider the fact that you found "You must be new here" a novel response - at least novel enough for you to use it. let me just say, *You* must be new here.
P.S. i hope the recursive irony - including my ID and the parent posters ID - is self evident. no need for recursive "*You* must be new here" replies. please think of the children.
P.P.S. i don't really think recursion is the right word. but the fact that an 'older' user is declared 'new' by a newer user on each child post should lead to a division by zero, a black hole, or at least a bazzarro world somewhere... or it might just be my bed time.
Re: (Score:1)
P.P.S. i don't really think recursion is the right word. but the fact that an 'older' user is declared 'new' by a newer user on each child post should lead to a division by zero, a black hole, or at least a bazzarro world somewhere... or it might just be my bed time.
I'll take issue with your usage of the word "older"; I'll have you know that, at a measly 23 years old, I'm probably younger than /. users with a higher UID number.
And I'm too tired to really care that I really don't need to get involved in another log(UID)-based pissing match. (But hey, isn't that what posting on Slashdot at 2:30AM is all about? Besides, I already made a constructive comment over in the article about embedding DB authentication credentials on software.)
(And this ends my stupid and over-
Re: (Score:2)
STFU, noob.
Waiting, waiting, waiting.....
Watch who you're calling "noob"... (Score:2)
Re:I didn't RTFA, but... (Score:4, Funny)
Everyone knows that no number of P.P.P.P.P.P.P.S.s that you can add will prevent SOMEONE from posting this very comment.
Re: (Score:1, Insightful)
Re:I didn't RTFA, but... (Score:5, Funny)
Re:I didn't RTFA, but... (Score:4, Funny)
awww
Re:I didn't RTFA, but... (Score:5, Insightful)
His software lets you pinpoint servers in the anon TOR network, good trick, but ultimately useless (since its the users computer you are trying to find).
Of course the other problem is "giving it a heavy load" define heavy load? is it just a little more than usual? or does it mean you have to heat board (he goes off system clock, maintained by a frequency crystal on the MB), most data centres I would think would be fairly efficient at routing even high heat loads out of enclosures and away from the machine.
And then, whoever he does this to can sue him for DoSing their machine, if they can prove (and its not overly difficult) that heat damages computer parts, he can be nabbed for wilful destruction of property as well, since his whole exercise heats the machine for no other reason than locating it.
Then of course, the only way to "heat up" said computer is to do it through the TOR api, which i am guessing most anon servers are built to handle very well (since that would be their primary task).
Oh, and this of course neglects to take into account that your TOR requests may be handled by many many servers in a cluster, each one heating and skewing at different rates...
Ok, its late on a Saturday afternoon and I can poke that many holes in his trick (even if only one is at all real), gimme a good 2-3 hours with some energy drinks in me and I can find more I am sure ^_^
If he can prove it works (and successfully do something usefull with it) in the real world, then it would be a better story.
Heat seeking missives (Score:2)
Any self-respecting admin is going to keep his servers in a temperature controlled environment, but the lunch room is another story entirely.
I want to know the size and source of the grant supporting this research. I'm looking for funding for my fusion-at-room-temperature device (pics on YouTube!).
Re: (Score:2)
And here I thought he was executed via hanging. Instead...
Death by Boonga-Boonga!!!
Re: (Score:2)
Re: (Score:3, Informative)
In most cases, the wouldn't even need to be near your house. A well-positioned amp-meter with remote sensing could tell you if the CPU suddenly needed more power.
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
One could easily set the frequency lower than the original maximum, so that spikes can't be detected.
Add to the above approach, keeping the clock in sync, as others have noted.
Re: (Score:2)
Somehow I don't think that would meet the standard for evidence...
You need to measure tiny variations in current caused by one device, mixed in with the haystack of all the other electric devices in your house... Most of which can vary significantly from moment to moment.
Re: (Score:2)
At least that has a point.
I haven't found anyone who didn't think Norton made programs which don't take all your resources.
Re: (Score:2)
> a crime?
Who said it was? If you are using TOR you must be doing so for some reason and therefor should be interested in evidence that it is not as anonymous as you though it was.