The maintainers of the Tor anonymity network have responded to reports that German law enforcement has found a way to deanonymize users.
Germany’s Panorama TV program and investigative journalism outfit STRG_F have obtained evidence showing that the country’s Federal Criminal Police Office (BKA) and the Public Prosecutor General’s Office in Frankfurt were able to identify at least one user suspected of being involved in the distribution of child sexual abuse materials on the dark web.
Law enforcement leveraged extended monitoring of Tor nodes and timing analysis to determine exactly which nodes had been used by the perpetrator, ultimately obtaining information on his real identity from the ISP.
The law enforcement operation was carried out between 2019 and 2021 and resulted in a long prison sentence being handed out to the suspect in late 2022.
Security experts from Germany’s famous Chaos Computer Club (CCC) have reviewed technical details of the attack and confirmed that the deanonymization method works.
A CCC representative and German media suggested that the Tor Project needs to make significant improvements considering that the method could be used by not only law enforcement but also by authoritarian regimes to unmask Tor users.
The Tor Project, on the other hand, has not received the technical information and says it’s left with more questions than answers. The organization is hoping to obtain the same information that was provided to the CCC to be able to conduct a detailed investigation.
However, the Tor Project says the information it has been presented with suggests that users can continue to confidently rely on the anonymity network to protect their identity.
“From the limited information The Tor Project has, we believe that one user of the long-retired application Ricochet was fully de- anonymized through a guard discovery attack. This was possible, at the time, because the user was using a version of the software that neither had Vanguards-lite, nor the vanguards addon, which were introduced to protect users from this type of attack. This protection exists in Ricochet-Refresh, a maintained fork of the long-retired project Ricochet, since version 3.0.12 released in June of 2022.
Vanguards-lite, released in Tor 0.4.7, protects against the possibility of combining an adversary-induced circuit creation with circuit-based covert channel to obtain a malicious middle relay confirmed to be next to the user’s Guard. Once the Guard is obtained, netflow connection times can be used to find the user of interest. In this case, the netflow attack could proceed quickly, because the attacker was able to determine when the user was online and offline due to their Onion Service descriptor being available, combined with the low number of users on the discovered Guard.”
The Tor Project highlighted that since the operation conducted by law enforcement in 2019-2021, new features have been added to protect against these types of timing attacks, which require long-lived user connections.
Related: Tor Code Audit Finds 17 Vulnerabilities
Related: Okta Warns of Credential Stuffing Attacks Using Tor, Residential Proxies
Related: Tor Network Removes Risky Relays Associated With Cryptocurrency Scheme
