The Effect of DNS on Tor's Anonymity
Benjamin Greschbach, Tobias Pulls, Laura M. Roberts, Philipp Winter,, Nick Feamster

TL;DR
This paper demonstrates how DNS traffic can significantly increase the vulnerability of Tor users to correlation attacks, revealing new attack methods and quantifying the risks posed by DNS lookups in anonymous communication.
Contribution
It introduces DefecTor attacks that incorporate DNS traffic, develops methods to identify DNS resolvers of exit relays, and analyzes the real-world impact on Tor's anonymity.
Findings
Google's DNS resolver observes nearly 40% of DNS requests exiting Tor.
DNS requests often traverse different ASes than TCP connections, exposing more traffic to adversaries.
DefecTor attacks can often identify the websites users visit with perfect accuracy, especially for less popular sites.
Abstract
Previous attacks that link the sender and receiver of traffic in the Tor network ("correlation attacks") have generally relied on analyzing traffic from TCP connections. The TCP connections of a typical client application, however, are often accompanied by DNS requests and responses. This additional traffic presents more opportunities for correlation attacks. This paper quantifies how DNS traffic can make Tor users more vulnerable to correlation attacks. We investigate how incorporating DNS traffic can make existing correlation attacks more powerful and how DNS lookups can leak information to third parties about anonymous communication. We (i) develop a method to identify the DNS resolvers of Tor exit relays; (ii) develop a new set of correlation attacks (DefecTor attacks) that incorporate DNS traffic to improve precision; (iii) analyze the Internet-scale effects of these new attacks on…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
