2

I read an article titled the network is hostile, in which the following is stated:

Traffic analysis remains a particular problem: even knowing the size of the files requested by a TLS-protected browser connection can leak a vast amount of information [pdf] about the user's browsing habits.

In the linked article, a the website visited may be identified due to the subsequent GET requests after visiting an encrypted website. The adversary only sees the traffic and is in possession of a database of websites and their subsequent requests (amount and sizes).

Is this attack applicable to HTTP traffic flowing through ssh-socks5 connections (with DNS request through the tunnel)? I'm not sure if such a channel is included in the SSL or TLS type encryptions mentioned in the paper.

Improve this question
1
  • SOCKS is a tunnel and does not add garbage information like TOR does.
    – sebix
    Commented Aug 22, 2015 at 11:53

1 Answer 1

Reset to default
3

You can still see the traffic pattern when looking at the encrypted SSH connection, but you don't see the target host of the requests. But if you know what the target host might be you could still do the same kind of traffic analysis - at least if you only have a few connections at the same time.

For a similar kind of flow control analysis but for SSH see Timing Analysis of Keystrokes and Timing Attacks on SSH. In this attack you could reduce the scope of possible passwords a user is entering within an established SSH session by measuring the timings between the packets containing keystrokes. While in this case on could use random packet delays to disrupt this analysis disrupting analysis of HTTP 1.x traffic is much harder because it has a typical pattern with (usually small) requests followed by (usually larger) responses, then the next request and next response etc. And both the directions and the approximate size of the requests/responses can be seen when looking at the SSH traffic.

Improve this answer
5
  • Thanks for the answer. I understand that the hostname isn't visible. So basically, your answer is "yes", the same kind of attack could be executed. Correct?
    – Sebastian
    Commented Aug 22, 2015 at 19:42
  • If you use the SSH tunnel as a socks proxy but only visit a single site the analysis will probably successful. If you instead run lots of connections to multiple hosts through it at the same time the traffic will be more diffuse and it will be much harder to mount such an attack.
    – Steffen Ullrich
    Commented Aug 22, 2015 at 19:47
  • 1
    @SteffenUllrich SSHv2 does use random data packets called MSG_IGNORE where random data of different lengths are intermittently sent. Wouldn't this also disrupt traffic analysis?
    – RoraΖ
    Commented Aug 24, 2015 at 16:25
  • @raz: I could not find any documentation how often these are sent and how large these packets are but from a short test it looks like that they don't disrupt the traffic pattern but only add some noise which makes it a bit harder. But one can still see the approximate sizes of HTTP request and response. This is not a surprise because to really hide this traffic pattern you have to add lots of noise, probably in a range which needs significant more bandwidth then the signal you want to hide. With other kind of traffic this might be different but HTTP has a very characteristic signal.
    – Steffen Ullrich
    Commented Aug 24, 2015 at 16:52
  • @SteffenUllrich That makes sense, thanks for the clarification.
    – RoraΖ
    Commented Aug 24, 2015 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .