The Experts below are selected from a list of 60 Experts worldwide ranked by ideXlab platform

Rachel Greenstadt - One of the best experts on this subject based on the ideXlab platform.

  • a critical evaluation of website fingerprinting attacks
    Computer and Communications Security, 2014
    Co-Authors: Marc Juarez, Sadia Afroz, Gunes Acar, Claudia Diaz, Rachel Greenstadt
    Abstract:

    Recent studies on Website Fingerprinting (WF) claim to have found highly effective attacks on Tor. However, these studies make assumptions about user settings, adversary capabilities, and the nature of the Web that do not necessarily hold in practical scenarios. The following study critically evaluates these assumptions by conducting the attack where the assumptions do not hold. We show that certain variables, for example, user's browsing habits, differences in location and version of Tor Browser Bundle, that are usually omitted from the current WF model have a significant impact on the efficacy of the attack. We also empirically show how prior work succumbs to the base rate fallacy in the open-world scenario. We address this problem by augmenting our classification method with a verification step. We conclude that even though this approach reduces the number of false positives over 63\%, it does not completely solve the problem, which remains an open issue for WF attacks.

  • ACM Conference on Computer and Communications Security - A Critical Evaluation of Website Fingerprinting Attacks
    Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014
    Co-Authors: Marc Juarez, Sadia Afroz, Gunes Acar, Claudia Diaz, Rachel Greenstadt
    Abstract:

    Recent studies on Website Fingerprinting (WF) claim to have found highly effective attacks on Tor. However, these studies make assumptions about user settings, adversary capabilities, and the nature of the Web that do not necessarily hold in practical scenarios. The following study critically evaluates these assumptions by conducting the attack where the assumptions do not hold. We show that certain variables, for example, user's browsing habits, differences in location and version of Tor Browser Bundle, that are usually omitted from the current WF model have a significant impact on the efficacy of the attack. We also empirically show how prior work succumbs to the base rate fallacy in the open-world scenario. We address this problem by augmenting our classification method with a verification step. We conclude that even though this approach reduces the number of false positives over 63\%, it does not completely solve the problem, which remains an open issue for WF attacks.

Cory Smith - One of the best experts on this subject based on the ideXlab platform.

  • web Browser forensics in google chrome mozilla firefox and the Tor Browser Bundle
    Digital Forensic Education, 2020
    Co-Authors: Rebecca Nelson, Atul Shukla, Cory Smith
    Abstract:

    Browsers are widely used on personal computers, laptops and mobile devices. In this chapter, we seek to determine and compare which forensic artifacts can be recovered from Google Chrome, Mozilla Firefox, their respective private modes, and Tor. Our analysis was primarily conducted using FTK in order to replicate the process and abilities of a digital forensics lab with limited resources. After identical data generation across all Browsers and modes of browsing in a controlled virtual environment, forensic images were captured then analyzed. This research not only extends the current field of digital forensics for which artifacts can be found in which locations, but also confirms various claims in regards to the privacy of private browsing modes. As expected, all data was recovered from regular browsing modes, very minimal data from private browsing, and almost no artifacts from Tor.

  • Digital Forensic Education - Web Browser Forensics in Google Chrome, Mozilla Firefox, and the Tor Browser Bundle.
    Studies in Big Data, 2019
    Co-Authors: Rebecca Nelson, Atul Shukla, Cory Smith
    Abstract:

    Browsers are widely used on personal computers, laptops and mobile devices. In this chapter, we seek to determine and compare which forensic artifacts can be recovered from Google Chrome, Mozilla Firefox, their respective private modes, and Tor. Our analysis was primarily conducted using FTK in order to replicate the process and abilities of a digital forensics lab with limited resources. After identical data generation across all Browsers and modes of browsing in a controlled virtual environment, forensic images were captured then analyzed. This research not only extends the current field of digital forensics for which artifacts can be found in which locations, but also confirms various claims in regards to the privacy of private browsing modes. As expected, all data was recovered from regular browsing modes, very minimal data from private browsing, and almost no artifacts from Tor.

Stefan Lindskog - One of the best experts on this subject based on the ideXlab platform.

  • spoiled onions exposing malicious Tor exit relays
    Privacy Enhancing Technologies, 2014
    Co-Authors: Philipp Winter, Stefan Lindskog
    Abstract:

    Tor exit relays are operated by volunteers and together push more than 1 GiB/s of network traffic. By design, these volunteers are able to inspect and modify the anonymized network traffic. In this paper, we seek to expose such malicious exit relays and document their actions. First, we moniTored the Tor network after developing two fast and modular exit relay scanners—one for credential sniffing and one for active MitM attacks. We implemented several scanning modules for detecting common attacks and used them to probe all exit relays over a period of several months. We discovered numerous malicious exit relays engaging in a multitude of different attacks. To reduce the attack surface users are exposed to, we patched Torbutton, an existing Browser extension and part of the Tor Browser Bundle, to fetch and compare suspicious X.509 certificates over independent Tor circuits. Our work makes it possible to continuously and systematically moniTor Tor exit relays. We are able to detect and thwart many man-in-the-middle attacks, thereby making the network safer for its users. All our source code is available under a free license.

  • Privacy Enhancing Technologies - Spoiled Onions: Exposing Malicious Tor Exit Relays
    Privacy Enhancing Technologies, 2014
    Co-Authors: Philipp Winter, Stefan Lindskog
    Abstract:

    Tor exit relays are operated by volunteers and together push more than 1 GiB/s of network traffic. By design, these volunteers are able to inspect and modify the anonymized network traffic. In this paper, we seek to expose such malicious exit relays and document their actions. First, we moniTored the Tor network after developing two fast and modular exit relay scanners—one for credential sniffing and one for active MitM attacks. We implemented several scanning modules for detecting common attacks and used them to probe all exit relays over a period of several months. We discovered numerous malicious exit relays engaging in a multitude of different attacks. To reduce the attack surface users are exposed to, we patched Torbutton, an existing Browser extension and part of the Tor Browser Bundle, to fetch and compare suspicious X.509 certificates over independent Tor circuits. Our work makes it possible to continuously and systematically moniTor Tor exit relays. We are able to detect and thwart many man-in-the-middle attacks, thereby making the network safer for its users. All our source code is available under a free license.

Marc Juarez - One of the best experts on this subject based on the ideXlab platform.

  • a critical evaluation of website fingerprinting attacks
    Computer and Communications Security, 2014
    Co-Authors: Marc Juarez, Sadia Afroz, Gunes Acar, Claudia Diaz, Rachel Greenstadt
    Abstract:

    Recent studies on Website Fingerprinting (WF) claim to have found highly effective attacks on Tor. However, these studies make assumptions about user settings, adversary capabilities, and the nature of the Web that do not necessarily hold in practical scenarios. The following study critically evaluates these assumptions by conducting the attack where the assumptions do not hold. We show that certain variables, for example, user's browsing habits, differences in location and version of Tor Browser Bundle, that are usually omitted from the current WF model have a significant impact on the efficacy of the attack. We also empirically show how prior work succumbs to the base rate fallacy in the open-world scenario. We address this problem by augmenting our classification method with a verification step. We conclude that even though this approach reduces the number of false positives over 63\%, it does not completely solve the problem, which remains an open issue for WF attacks.

  • ACM Conference on Computer and Communications Security - A Critical Evaluation of Website Fingerprinting Attacks
    Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014
    Co-Authors: Marc Juarez, Sadia Afroz, Gunes Acar, Claudia Diaz, Rachel Greenstadt
    Abstract:

    Recent studies on Website Fingerprinting (WF) claim to have found highly effective attacks on Tor. However, these studies make assumptions about user settings, adversary capabilities, and the nature of the Web that do not necessarily hold in practical scenarios. The following study critically evaluates these assumptions by conducting the attack where the assumptions do not hold. We show that certain variables, for example, user's browsing habits, differences in location and version of Tor Browser Bundle, that are usually omitted from the current WF model have a significant impact on the efficacy of the attack. We also empirically show how prior work succumbs to the base rate fallacy in the open-world scenario. We address this problem by augmenting our classification method with a verification step. We conclude that even though this approach reduces the number of false positives over 63\%, it does not completely solve the problem, which remains an open issue for WF attacks.

Rebecca Nelson - One of the best experts on this subject based on the ideXlab platform.

  • web Browser forensics in google chrome mozilla firefox and the Tor Browser Bundle
    Digital Forensic Education, 2020
    Co-Authors: Rebecca Nelson, Atul Shukla, Cory Smith
    Abstract:

    Browsers are widely used on personal computers, laptops and mobile devices. In this chapter, we seek to determine and compare which forensic artifacts can be recovered from Google Chrome, Mozilla Firefox, their respective private modes, and Tor. Our analysis was primarily conducted using FTK in order to replicate the process and abilities of a digital forensics lab with limited resources. After identical data generation across all Browsers and modes of browsing in a controlled virtual environment, forensic images were captured then analyzed. This research not only extends the current field of digital forensics for which artifacts can be found in which locations, but also confirms various claims in regards to the privacy of private browsing modes. As expected, all data was recovered from regular browsing modes, very minimal data from private browsing, and almost no artifacts from Tor.

  • Digital Forensic Education - Web Browser Forensics in Google Chrome, Mozilla Firefox, and the Tor Browser Bundle.
    Studies in Big Data, 2019
    Co-Authors: Rebecca Nelson, Atul Shukla, Cory Smith
    Abstract:

    Browsers are widely used on personal computers, laptops and mobile devices. In this chapter, we seek to determine and compare which forensic artifacts can be recovered from Google Chrome, Mozilla Firefox, their respective private modes, and Tor. Our analysis was primarily conducted using FTK in order to replicate the process and abilities of a digital forensics lab with limited resources. After identical data generation across all Browsers and modes of browsing in a controlled virtual environment, forensic images were captured then analyzed. This research not only extends the current field of digital forensics for which artifacts can be found in which locations, but also confirms various claims in regards to the privacy of private browsing modes. As expected, all data was recovered from regular browsing modes, very minimal data from private browsing, and almost no artifacts from Tor.