81% of Tor users can be identified according to new anonymity report

Tor was supposed to be an anonymous means of browsing the Internet, but a study by computer science professor Sambuddho Chakravarty reveals that 81 percent of those using Tor can be de-anonymized by exploiting a technology in Cisco routers called Netflow. The ploy reveals a user's originating IP address, which is analogous to identifying someone's home address even if he or she uses a P.O. box.

Professor Sambuddho Chakravarty is a former researcher at Columbia University’s Network Security Lab and now researching Network Anonymity and Privacy at the Indraprastha Institute of Information Technology in Delhi. He has co-published a series of papers over the last six years outlining the attack vector, and claims a 100% ‘decloaking’ success rate under laboratory conditions, and 81.4% in the actual wilds of the Tor network.

Here's Chakravarty's technique in simple terms: they repeatedly injected typical HTML files a Tor user would access into a router's connection. Since Netflow was designed to break down and analyze traffic depending on what you use the internet for (say 25 percent email and 50 percent web browsing), they could check who accessed those HTML files and get their IP addresses. He's convinced that a large organization (like, well, the government) can easily uncover the identities of Tor users if it wanted. In fact, he says one doesn't even need the resources of a powerful organization to do so, as a single autonomous system programmed to de-anonymize Tor clients can monitor up to 39 percent of the browser's traffic.

The Tor Project has responded to this via a blog post in which it explains that the network has never been designed to combat a technique such as traffic confirmation. “The Tor design doesn’t try to protect against an attacker who can see or measure traffic going into the Tor network and also traffic coming out of the Tor network."

To know more, you can check out a paper (PDF) published by Chakravarty and his colleagues.