Is this a viable defense against correlation attacks?

Question

So, I guess most of you know that the true identity can be revealed if somebody controls the entry and the exit node of your Tor-connection.

Let´s say I´m connecting first to an encrypted VPN Server which keeps no logs and then to the Tor-network, then my identity should be safe from a basic correlation attack. However, if somebody with a lot of power (e.g the government) is spying on me they can request the logs of my ISP and see that I am connected to a specific VPN server (which is irrelevant since they keep no logs) and how much bandwith I requested at what exact time. In theory this means, the government could still make a correlation attack while ignoring my VPN Server by combinging the ISP logs and the timing/bandwidth used from the exit node.

But what if I had an inconsistent noise of dataflow combined to my surfing over Tor? Let´s say I load inconsistently a 144px YouTube video on my Firefox over my VPN while surfing on the Tor Browser. My ISP would see a semi-constant timings of data flowing to me and they would see video bandwidth + Tor bandwidth. However, they could not distinguish one from another which would make a correlation attack basically impossible.

Is this correct or am I missing something major?

Answer 1

This does not provide you with much benefit.

What you are referring to is called multiplexing, which is the act of sending multiple discreet signals through a single data channel. Unfortunately, it does not provide very much protection against traffic correlation attacks done by a global passive adversary. The reason is that each individual connection will have a different traffic fingerprint. For example, Tor uses 514-byte packets called cells, whereas a VPN does not, making it possible to identify Tor traffic and non-Tor traffic even when they are both being put through a VPN. The same applies to different types of websites. And streaming traffic on YouTube will not mask other traffic from loading an HTML page, since the buffering behavior on streaming sites can be trivially distinguished from the behavior of a web page being loaded.

As grim as this may seem, it's actually not all that bad. While intentionally trying to mask traffic by using overlapping connections may not be particularly effective, simply browsing multiple sites in multiple tabs can actually decrease the accuracy of existing website fingerprinting attacks. This works because most website fingerprinting algorithms rely on the assumption that subsequent connections are both to the same destination. When that assumption is broken, classification accuracy suffers.

There are viable defenses out there, however. WTF-PAD is an experimental protocol which provides low-latency and low-overhead cover against website fingerprinting and other types of traffic analysis attacks. It does this by varying the time and size of individual bursts of packets sent between your client and your guard node. Tor Project has been considering integrating it for a while now.

There are a number of research papers relating to anonymity networks on Free Haven.

Answer 2

This tactic can make it more difficult but I think in this cases it´s more important the social aspect. Just imagine law enforcement is watching you and you are using tor over vpn... and this vpn only has logs of the time connected, and email used. Nothing else. How would they find you? A) Ip leaks B) Dns leaks C) They hack your machine directly D) Your computer gets messed or you mess up and connect to a service connected to real identity or used by your normal non encripted logged ip. E) They find out you are using a certain service which is insecure and you used it to talk about personal matters which can identify you.

Finally there is the possibility your isp would hack your computer if they consider you are using too many protecting measures for no apparent reason (example, "he is so scared he MUST BE HIDING SOMETHING).

Using tor browser over vpn still leaves the possibility for the browser to get exploited and open vulnerabilities to your computer, defeating the purpose of using tor in the first place. A better approach would be to use tor browser inside a virtual machine, having the host connect to a vpn and also the guest (the virtual machine also to connect to a vpn).