Flow correlation attack on Tor: A critical Analysis of ESPRESSO and possible countermeasures

Anonymity networks are becoming increasingly prevalent in today’s digital landscape, as more users seek to protect their online privacy. Tor is currently the most widely used anonymity network, providing anonymity to both users and hidden services. However, the anonymity ensured by Tor is often exploited for illicit purposes, such as hosting illegal marketplaces for drug and weapon sales, as well as managing command-and-control servers for botnets. Conse- quently, various entities, including governments and law enforcement agencies, have a vested interest in developing attack techniques aimed at deanonymizing Tor users, disrupting its func- tionality, or circumventing its censorship resistance mechanisms. Additionally, such attacks may be conducted by malicious adversaries seeking to de-anonymize specific victims for per- sonal reasons. De-anonymizing a user means discovering the activity of a specific target user and to under- stand which/if the user has visited a specific site. This study, following an overview of state-of- the-art flow correlation attacks, focuses on assessing the effectiveness of one of the most recent proposals, known as ESPRESSO. Specifically, through experimental results obtained in this work, it is demonstrated that ESPRESSO is ineffective at correlating Tor traffic, achieving an accuracy of approximately 8%, making it unsuitable for real-world deployment. Through a critical analysis of flow correlation techniques and the defensive mechanisms adopted by Tor, this study demonstrates that mitigations developed by Tor have substantially reduced the risks associated with such attacks, thereby strengthening user anonymity. In order to deanonimize a user, adopting other techniques, like phishing, is more worth for an attacker.