When it comes to protecting privacy while surfing the internet Tor is one of the top notch browser, with 2.5 million people using it daily. For many years people living under cruel administrations have been using Tor while browsing the internet to hide their identity.

Tor

Researchers at MIT’s Computer Science and Artificial Intelligence Lab (CSAIL) and the Qatar Computing Research Institute (QCRI) have now showed a flaw in Tor’s design. They showed an opponent would be able to assume the hidden server’s location, or the source where Tor user is getting all the information from, by just examining the traffic patterns of encrypted data that is passing through a single computer in the all-volunteer Tor network.

But not to worry, the same paper proposes ways that can fix this problem with the Tor browser. The project also said they are looking at things that can be included in the further versions of the Tor software to make it more secure.

Encryption Methods

Basically what Tor does is that it masks your identity by moving your traffic over distinctive Tor servers, and encrypts that traffic so that it won’t be tracked back to you. Any individual who tries, would see traffic originating from irregular nods on the Tor network, rather than seeing the location of your computer. So if you were to view a page of The Guardian anonymously using Tor, what it will do is that it will wrap your request in several layers of encryption and move it to another Tor-enabled computer, which is also selected randomly. The first computer which is also known as the guard- will remove the first layer of encryption and moves it to another random computer in the network which also removes another layer of encryption and so on, until the request reaches the last computer in the chain, called the exit, which removes the last layer of encryption, exposing the request final destination: The Guardian. The first computer or the guard knows the Internet address of the sender, while the last computer in the chain knows the Internet address of the destination site, but no computer in the chain is able to figure out both. This is known as the onion routing.

Traffic fingerprinting

Kwon planned an attack on this system with joint first author Mashael AlSabah. For this attack to work the researchers need rival’s computer to work as the guard on a Tor circuit. The first computers or the guards are selected randomly, if the rival connects enough computers to the tor network, there are high chances that at some point, one of the computer will be in good position to spy on. On a Tor network a lot of information is passed around when the circuit is being established. The researchers also showed that the machine learning alogs could, with 99% accuracy determine the circuit by just looking at the patterns of the packets passing through guards.

Tor

To defend against this type of attack, “We recommend that they mask the sequences so that all the sequences look the same,” AlSabah says. “You send dummy packets to make all five types of circuits look similar.”

For now Tor is still a secure network because it still requires an attacker to be inside the network and collect data for a certain period of time.