CARONTE: Detecting Location Leaks for Deanonymizing Tor Hidden Services

Anonymity networks such as Tor are a critical privacy-enabling technology. Tor’s hidden services provide both client and server anonymity. They protect the location of the server hosting the service and provide encryption at every hop from a client to the hidden service. This paper presents CARONTE, a tool to automatically identify location leaks in hidden services, i.e., sensitive information in the content served by the hidden service or its configuration that discloses the server’s IP address. CARONTE can be used by hidden services administrators to check their sites for deanonymizing location leaks. Compared to prior techniques that deanonymize hidden services CARONTE implements a novel approach that does not rely on flaws on the Tor protocol and assumes an open-world, i.e., it does not require a short list of candidate servers known in advance. CARONTE visits the hidden service, extracts Internet endpoints and looks up unique strings from the hidden service’s content, and...

• Type: Journal
• Year: 2015
• Where: CCS
• Authors: Srdjan Matic, Platon Kotzias, Juan Caballero
• Keywords: CCS 2015, Security Privacy