honey onions揭露tor hsdir中继监听24 guevara noubir amirali sanatinia exposing snooping relaysdefcon 24监视.pdfVIP

Motivations

•Previous research studied the maliciousness of the relays

•Known bad Exit nodes

•Other work looked at the nature of hidden services content

•No prior work on the Hidden Service Directories (HSDirs)

•Indexing hidden services requires modification to Tor, which can be an

indicator of some effort and potentially more malicious activities

2

TorHiddenServices

•A widely used practical anonymity infrastructure

•Provides anonymity for both the clients and the server through

hidden services

•Depends on the honest behavior of the volunteering relays

•It is known that some relays are misbehaving (Bad Exit nodes)

•Some Exit nodes actively try to perform Man in the Middle Attack

(MITM)

•Not much is known about the HSDirsor Hidden Services in general

3

HiddenServiceDirectories(HSDir)

RP

(7)

(4)

IP(6)

(5)

(1)

Client

(3)

(2)

HiddenService

HSDir

4

RingofResponsibleHSDirs

5

HoneyOnions(HOnions)

•Each HOnioncorresponds to a server/process

•Run on local IP address (Hidden Service)

•Accessible only through Tor and not shared anywhere

•Three schedules