4

If i am chaining multiple VPN's and possibly running through Tor as well, network correlation attacks can be performed against me to try to locate my position. If my network spikes a download for 40MB/s for 3 secounds, governments with collectors accross the world would be able to see this spike and correlate me with my VPN chains.

Is there a way to defend against this?

I would assume if a tool was made to generate random dummy traffic each at layer of VPNs, then they would not be able to correlate as well. Does such a tool exists?

Improve this question
1
  • 1
    This is a great question! Note though that product recommendations are off topic here, so that last question of yours may not get an answer
    – Conor Mancone
    Feb 26, 2020 at 2:01

2 Answers 2

Reset to default
1

What if you used a network like tor but one that has a more difficult algorithm that connects to each host within the farm?

'Network traffic pattern correlation attacks'. I heard that such an attack was done to trace users in Tor network by the Russian government.

I think if someone executes such an attack against you, then it is a matter of proxy servers you use between you and the destination host that you try to connect to.

The 40mb file that was downloaded in one host at specific time, could be attempted to be traced back, but it depends on how many proxies you use. The more of them, the more investigations the authorities will have to make to trace you.

To even go farther, you could use a proxy server that modifies the content of the request slightly and adds content to it at random length.

Improve this answer
4
  • 1
    this does not answer the question bro
    – yeah_well
    Feb 26, 2020 at 11:05
  • I would assume if a tool was made to generate random dummy traffic each at layer of VPNs, then they would not be able to correlate as well. Does such a tool exists? I dont know if such tool exist. I assume that there is.
    – Dan Friedman
    Feb 26, 2020 at 12:53
  • I think this is on the right track. One part that I'm dubious about is the general idea of "The more proxies you use the harder it is to correlate". This may not be true. After all, even if they can't track the exact path your traffic is following they can still correlate traffic. If everytime an anonymous source downloads a file from evil.com your ISP records you receiving a file download of the same size from an anonymous source, you will still end up in jail
    – Conor Mancone
    Feb 26, 2020 at 17:30
  • But things like having a proxy that modifies length (or timing) may help to confuse the data and make correlation harder.
    – Conor Mancone
    Feb 26, 2020 at 17:31
-2

I think there is no defense of what information can be correlated, in fact, the more information, the better correlation patterns are.

In your particular example, if you are making a 40MB download, your ISP probably will see download traffic from a VPN provider or ToR and nothing more (the traffic is encrypted). If the ISP wants to know or have an idea of what was downloaded they will need to contact the VPN provider and ask for this information. Depending on the case this information can be provided depending on the legal case. So in the case that the ISP has the information, they will need to correlate it by checking time events or other types of metrics or algorithms that can correlate the download with the real traffic or activity.

Improve this answer
2
  • 1
    This is a bit hard to read due to some grammar mistakes, but I thin that you've missed the main question here. Network correlation attacks are used by governments to de-anonymize traffic. The ISP is only one piece of the puzzle, and the ISP itself does not do the correlation - the law enforcement agency does it using data from the ISP and many other "snooping" points throughout the internet.
    – Conor Mancone
    Feb 26, 2020 at 10:24
  • The question is not about what was downloaded, but who downloaded it
    – schroeder ♦
    Feb 26, 2020 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .