[Paper Review] RAPTOR: Routing Attacks on Privacy in Tor

Yixin Sun, Anne Edmundson+5 more|arXiv (Cornell University)|Mar 13, 2015

Internet Traffic Analysis and Secure E-votingComputer Science38 references107 citations

TL;DR

RAPTOR presents a suite of novel BGP-based attacks that exploit routing asymmetry, churn, and hijacks to deanonymize Tor users by enabling Autonomous Systems to observe both ends of Tor traffic. The authors demonstrate 95% deanonymization accuracy in live experiments and show over 90% of Tor relays are vulnerable, highlighting critical flaws in Tor's reliance on unstable network routing for anonymity.

ABSTRACT

The Tor network is a widely used system for anonymous communication. However, Tor is known to be vulnerable to attackers who can observe traffic at both ends of the communication path. In this paper, we show that prior attacks are just the tip of the iceberg. We present a suite of new attacks, called Raptor, that can be launched by Autonomous Systems (ASes) to compromise user anonymity. First, AS-level adversaries can exploit the asymmetric nature of Internet routing to increase the chance of observing at least one direction of user traffic at both ends of the communication. Second, AS-level adversaries can exploit natural churn in Internet routing to lie on the BGP paths for more users over time. Third, strategic adversaries can manipulate Internet routing via BGP hijacks (to discover the users using specific Tor guard nodes) and interceptions (to perform traffic analysis). We demonstrate the feasibility of Raptor attacks by analyzing historical BGP data and Traceroute data as well as performing real-world attacks on the live Tor network, while ensuring that we do not harm real users. In addition, we outline the design of two monitoring frameworks to counter these attacks: BGP monitoring to detect control-plane attacks, and Traceroute monitoring to detect data-plane anomalies. Overall, our work motivates the design of anonymity systems that are aware of the dynamics of Internet routing.

Motivation & Objective

• To expose the vulnerability of Tor to sophisticated attacks by Autonomous Systems (ASes) that exploit dynamic Internet routing protocols.
• To investigate how routing asymmetry and natural BGP churn increase the likelihood of AS-level adversaries observing both ends of Tor communication.
• To demonstrate the feasibility of BGP hijack and interception attacks for deanonymizing Tor clients via traffic analysis.
• To quantify the real-world impact of these attacks using historical BGP and traceroute data, and live experiments on the Tor network.
• To design and propose effective monitoring-based countermeasures to detect and mitigate RAPTOR-style attacks.

Proposed method

• Leveraged live Tor network experiments to perform asymmetric traffic correlation, observing packet timing and size differences across bidirectional paths.
• Analyzed historical BGP and traceroute data to quantify the increase in attack surface due to routing asymmetry and path churn.
• Conducted controlled BGP interception attacks on live Tor relays they controlled, simulating real-world interception without harming real users.
• Used BGP hijack simulations to demonstrate how strategic adversaries can redirect Tor traffic through their own ASes to enable traffic analysis.
• Designed two monitoring frameworks: BGP monitoring for control-plane anomalies and traceroute monitoring for data-plane deviations.
• Implemented network-level firewalls to isolate experimental traffic and prevent real Tor users from being affected during live testing.

Experimental results

Research questions

• RQ1 To what extent does routing asymmetry in BGP increase the probability of an AS-level adversary observing both ends of a Tor communication?
• RQ2 How does natural BGP path churn over time affect the long-term exposure of Tor clients to AS-level traffic analysis?
• RQ3 Can BGP hijacks and interception attacks be effectively used to redirect and monitor Tor traffic for deanonymization purposes?
• RQ4 What is the real-world feasibility and impact of these attacks, as demonstrated through live experiments and historical data analysis?
• RQ5 How effective are proposed monitoring-based countermeasures in detecting RAPTOR-style attacks in real time?

Key findings

• RAPTOR's asymmetric traffic correlation attack achieved 95% deanonymization accuracy with zero false positives in live experiments on the Tor network.
• Routing asymmetry alone increases the threat surface of AS-level attacks by 50% compared to symmetric path assumptions.
• BGP path churn increases the attack surface by 100% over time, enabling adversaries to observe more Tor clients without changing their infrastructure.
• Historical BGP data revealed multiple past hijack events that targeted Tor relay prefixes, including the 2014 Bitcoin and Indosat hijacks.
• A live BGP interception attack successfully redirected and monitored traffic through a controlled Tor relay, demonstrating practical feasibility.
• More than 90% of Tor relays are vulnerable to at least one RAPTOR attack vector due to reliance on insecure, dynamic routing protocols.