[Paper Review] Tails & Tor and other tools for Safeguarding Online Activities.

Stephanie Abraham, Tyler Silva+2 more|arXiv (Cornell University)|Oct 24, 2017

Internet Traffic Analysis and Secure E-voting3 citations

TL;DR

This paper examines Tails and Tor as privacy-enhancing tools for anonymous online activity, detailing their technical operation, forensic challenges, and limitations in concealing user identity. It explores how investigators can acquire Tor-related evidence despite encryption and obfuscation, and identifies emerging tools like dark pools, gaming consoles, and cryptocurrencies used by criminals to evade detection.

ABSTRACT

There are not many known ways to break Tor anonymity, and they require an enormous amount of computational power. Controlling both entrance and exit nodes allows an attacker to compromise client IP with enough pattern analysis. If an .onion or public website does not use SSL, information will not be encrypted once it reaches the exit node. Tor has been successfully broken by Carnegie Mellon, however they will not answer questions nor confirm their method. This research paper investigates Tails & Tor and other tools for Safeguarding Online Activities.

Motivation & Objective

• To analyze the technical mechanisms of Tails and Tor in enabling online anonymity.
• To identify forensic challenges in investigating Tails and Tor usage due to ephemeral data and encryption.
• To examine emerging tools and technologies—such as dark pools, gaming consoles, and cryptocurrencies—used by criminals to obscure digital footprints.
• To evaluate the limitations of Tor-based anonymity and methods for tracking users despite strong encryption.
• To assess the role of new technologies like BitCoin and I2P in facilitating illicit online activities.

Proposed method

• Analyzing Tails as a live, read-only Linux distribution that leaves no trace on host systems, using Debian-based architecture and LUKS disk encryption.
• Examining Tor’s onion routing protocol, which encrypts data in multiple layers and routes it through relays, each decrypting only the next layer’s routing information.
• Investigating forensic acquisition of network and cloud-based evidence due to the lack of local artifacts on Tails systems.
• Assessing the use of MAC address spoofing and other obfuscation techniques in Tails to evade device-level tracking.
• Reviewing the role of third-party tools such as Pidgin with OTR, Claws with GnuPG, and Electrum for encrypted communication and cryptocurrency use.
• Evaluating the use of gaming consoles and dark pools as alternative, less-monitored communication and trading channels.

Experimental results

Research questions

• RQ1 How do Tails and Tor work together to provide end-to-end anonymity in online activities?
• RQ2 What are the key forensic challenges in investigating Tails and Tor usage, and what evidence sources remain accessible?
• RQ3 What emerging tools and technologies are being used by criminals to maintain anonymity beyond Tor and Tails?
• RQ4 In what ways can investigators still track users on private networks like Tor despite strong encryption and obfuscation?
• RQ5 How do dark pools function in financial markets, and what implications do they have for law enforcement and regulatory oversight?

Key findings

• Tails ensures anonymity by running as a live, read-only operating system from removable media, leaving no persistent traces on the host machine.
• Tor uses multi-layered encryption and relay routing to obscure the origin of data packets, with each relay only knowing the next hop in the chain.
• Investigators face significant challenges in forensic analysis of Tails systems due to the lack of local logs and the need for root access, which is often unavailable.
• Despite strong anonymity, investigators can potentially track users by identifying the true MAC address or through network-level traffic analysis.
• Criminals increasingly use decentralized tools like BitCoin, I2P, and gaming consoles (e.g., PS4) to bypass traditional surveillance and communication monitoring.
• Dark pools enable large, anonymous stock trades that can distort market transparency and create unfair advantages, raising concerns for regulators and law enforcement.