Forensic Dead-Ends: Tracing Anonymous R er Abusers Len Sassaman The Shmoo Group

What is Anonymity?

Network anonymity services Shield the identity of the user Conceal other identifying factors Dissociate users’ actions with identity Do not conceal that those actions occur! Anonymity != privacy

Why Anonymity on the Internet is Necessary

Why people use r ers Whistle blowing Discussion of personal or taboo issues Journalistic correspondence Spam protection Future anonymity Political speech Censorship avoidance

Why people operate r ers Belief in the right to anonymity Necessity of r er network Certainty of uncompromised r er Exercise applied Cypherpunk technology

Corporate uses Research of competitors Avoidance of information leakage Thwarting industrial espionage Employee feedback

Commercial anonymity Reasons why selling anonymity is difficult –Payment collection (no anonymous cash!) –Cost of operating service –Need for a large anonymity set –Uncertain demand –Legal restrictions –Abuse complications

Commercial anonymity Reasons why buying anonymity is difficult –Payment rendering (no anonymous cash!) –Uncertainty of anonymity strength –Availability of service –Local network restrictions –Ease of use

Types of Anonymity on the Internet

Weak anonymity Protection from the casual attacker Spam avoidance Anonymous online forums

Strong anonymity Protection from ISP snooping Protection from government monitoring Protection in the case of server compromise (hacker-proofing)

Examples Free web mail accounts SSL anonymous proxies Anonymous ISPs Anonymous mail relays Mix-net r er systems

History of strong r ers anon.penet.fi Cypherpunk r ers (Type 1) Mixmaster r ers (Type II) Zero Knowledge Freedom mail Mixminion (Type III -- forthcoming)

The Mechanics of Strong Anonymity

David Chaum’s mix-nets Multi-layered encyption chains indistinguishable message packets Random reordering at each hops Return address reply blocks

Mixmaster A mix-net implimentation Clients available for Windows, Macintosh, Unix Servers available for Unix and Windows Low hardware resource requirements Reliable network connection Mail server capabilities

A Mixmaster Packet

Journey of a mixed message Chain selection Encryption Padding/splitting Transmission What an all-seeing observer would know Importance of a large anonymity set Cover traffic

Flaws in Mixmaster Tagging attacks Flooding attacks Key compromise Need for forward secrecy Reliability failings Ease of use Lack of return address capability

Inside a Mixmaster R er

Walk-through of a live system R er program location Mail handling R er packet handling Logging Abuse processing

Types of Abuse

Spam R ers are ill-suited for spam High latency, easy detection Open-relays are much better Usenet spam is still a problem

Piracy Most r ers block binary transfers Anonymity is decreased by sending large, multi-packet messages is a poor medium for file transfer Throw-away shell/ftp accounts, irc, and p2p systems are more popular for warez

Targeted harassment Directed abusive messages at individuals Floods from one or more r ers Usenet flames

R ers and terrorism Media hype Immediate increase in # of r ers Political opinion of anonymity R ers: Tools against terror What about public libraries?

Getting around the R er Dead-End

Means of tracking abusers Seizing r er servers won’t work Snooping traffic will reveal little Carnivore not very useful Flooding/tagging won’t work after the fact (if at all) Honeypot r ers and chain manipulation Literary forenics Side-channel leakage

Stopping abuse Individual r er block-lists The R er Abuse Blacklist – Local filtering Do not need to know the ID of abuser Ways to avoid being a target of abuse Spam and flood detection tools for remops

Information an Anonymity Service Provider is Able to Reveal

The downfall of anon.penet.fi What Penet couldn’t provide Scientology vs. The Internet Why Julf Helsingius closed anon.penet.fi

Why remops don’t keep logs Disk space / resource drain Local user privacy concerns Not useful for abuse investigations

“Black-bagging a r er” Only the last hop is usually known No logs No chain information Keys aren’t useful in last hop All chained hops are needed START-TLS forward secrecy Future message compromise potential

Asking for help What to ask a remop when investigating abuse What will encourage a remop to be helpful What will discourage a remop Personal experiences

Comments Len Sassaman