Researchers at the Computer Science and Artificial Intelligence Laboratory (CSAIL) at the Massachusetts Institute of Technology (MIT) have developed a new online text messaging protocol that is far more secure and harder to trace than current alternatives, including the Tor anonymity network.
First, in cooperation with scientists from the Qatar Computing Research Institute (QCRI), they successfully exploited a security vulnerability affecting the Tor networks that made it possible to identify hidden servers with up to 88% accuracy. They accomplished this by observing patterns in the number of packets passing through Tor nodes. They managed to determine with 99% accuracy the type of communication taking place: whether it was regular web browsing, an introduction point (that gives users access to hidden a website), or a rendezvous point (that gives a second user access to the same hidden website at the same time as the first).
Building on this discovery, the researchers developed their anonymous communication system, presented in a paper title ‘Vuvuzela: Scalable Private Messaging Resistant to Traffic Analysis.’ Vuvuzela provides a much stronger anonymity model to users, as it drowns any identifiable traffic pattern in a barrage of meaningless data.
To communicate through the system, a user leaves a message in a specific, predefined location – a memory address on a dead-drop server – where a second user can retrieve it. To obfuscate the fact the two are communicating, the system makes all connected user send regular messages to the server. This creates the illusion that all users are communicating at all times, thus providing cover for the actual communication taking place.
If an attacker managed to penetrate and gain control of the server, he would be able to quickly determine which of the users were actually communicating. To combat this, the Vuvuzela system uses three servers to transmit all messages – both fake and real. The first server removes the first layer of encryption and scrambles the order of the messages before passing the message on to the second server, where the process repeats itself. This way, only the third server ‘knows’ the correct order of the messages for the user to read.
According to MIT, the system will protect the anonymity of the messages as long as at least one of the systems is not compromised.
“Tor operates under the assumption that there’s not a global adversary that’s paying attention to every single link in the world,” said Nickolai Zeldovich of CSAIL. “Maybe these days this is not as good of an assumption. Tor also assumes that no single bad guy controls a large number of nodes in their system. We’re also now thinking, maybe there are people who can compromise half of your servers.”
http://i-hls.com/2016/01/67696/?utm_source=Israel+Homeland+Security+%28iHLS%29&utm_campaign=b593729823-ENGLISH_DYNAMIC&utm_medium=email&utm_term=0_8ee2e16ed1-b593729823-89945429&mc_cid=b593729823&mc_eid=fc56e4974c
First, in cooperation with scientists from the Qatar Computing Research Institute (QCRI), they successfully exploited a security vulnerability affecting the Tor networks that made it possible to identify hidden servers with up to 88% accuracy. They accomplished this by observing patterns in the number of packets passing through Tor nodes. They managed to determine with 99% accuracy the type of communication taking place: whether it was regular web browsing, an introduction point (that gives users access to hidden a website), or a rendezvous point (that gives a second user access to the same hidden website at the same time as the first).
Building on this discovery, the researchers developed their anonymous communication system, presented in a paper title ‘Vuvuzela: Scalable Private Messaging Resistant to Traffic Analysis.’ Vuvuzela provides a much stronger anonymity model to users, as it drowns any identifiable traffic pattern in a barrage of meaningless data.
To communicate through the system, a user leaves a message in a specific, predefined location – a memory address on a dead-drop server – where a second user can retrieve it. To obfuscate the fact the two are communicating, the system makes all connected user send regular messages to the server. This creates the illusion that all users are communicating at all times, thus providing cover for the actual communication taking place.
If an attacker managed to penetrate and gain control of the server, he would be able to quickly determine which of the users were actually communicating. To combat this, the Vuvuzela system uses three servers to transmit all messages – both fake and real. The first server removes the first layer of encryption and scrambles the order of the messages before passing the message on to the second server, where the process repeats itself. This way, only the third server ‘knows’ the correct order of the messages for the user to read.
According to MIT, the system will protect the anonymity of the messages as long as at least one of the systems is not compromised.
“Tor operates under the assumption that there’s not a global adversary that’s paying attention to every single link in the world,” said Nickolai Zeldovich of CSAIL. “Maybe these days this is not as good of an assumption. Tor also assumes that no single bad guy controls a large number of nodes in their system. We’re also now thinking, maybe there are people who can compromise half of your servers.”
http://i-hls.com/2016/01/67696/?utm_source=Israel+Homeland+Security+%28iHLS%29&utm_campaign=b593729823-ENGLISH_DYNAMIC&utm_medium=email&utm_term=0_8ee2e16ed1-b593729823-89945429&mc_cid=b593729823&mc_eid=fc56e4974c