In response to the threat of intelligence agencies like NSA and GCHQ, Security researchers from American and Israeli academics have developed a new advanced Tor client called Astoria specially designed to make eavesdropping harder.
Tor (The Onion Router) is the most popular anonymity network that is intended to allow a user to browse the Internet anonymously via a volunteer network of more than 6000 relays/nodes.
The encrypted traffic of a user is being routed through multiple relays in the network. The user-relay connection is known as a circuit.
Tor does not share your identifying information like your IP address and physical location with websites or service providers on the receiving end because they don't know who is visiting.
Timing Attacks yet a major issue:
However, Tor isn't as safe from the prying eyes of network level attackers as we once thought. Big spying agencies like the United States intelligence agency NSA and the British Government Communications Headquarters GCHQ has have developed a way to de-anonymize user data using "timing attacks."
In timing attacks, all an attacker need to do is take control of both the exit and the entry relays, then with the help of statistical analysis they can discover the identity of a Tor user in a matter of minutes.
A research shows that about 58 percent of Tor circuits are vulnerable to network-level attacks. However, to deal with the threats, the researchers have built new Tor client, Astoria.
New Tor Client — Astoria
Tor Astoria allows users to reduce the chance of using a malicious TOR circuit from 58 percent to 5.8 percent. The tool has been designed to beat even the most recently proposed asymmetric correlation attacks on Tor.
According to the researchers, timing attack will always be a threat to the Tor environment, and it would be impossible to completely eliminate this threat, but it could be minimized by using Astoria Tor client.
Tor Astoria uses an algorithm which is designed to more accurately predict attacks and then accordingly chooses the best and secure route to make a connection that mitigate timing attack opportunities.
"In addition to providing high-levels of security against [timing] attacks, Astoria also has performance that is within a reasonable distance from the current available Tor client," the researchers wrote.
"Unlike other AS-aware [autonomous system aware] Tor clients, Astoria also considers how circuits should be built in the worst case," when no safe relays are available. "Further, Astoria is a good network citizen and works to ensure that all the circuits created by it are load-balanced across the volunteer-driven Tor network."
In an attempt to make Tor even more usable for an average user, Astoria provides multiple security features and the Tor client is both most effective and most usable at its highest level of safety, Daily Dot reports.
Therefore, "Astoria is a usable substitute for the vanilla Tor client only in scenarios where security is a high priority," the researchers say.
You can read the full research paper titled "Measuring and mitigating AS-level adversaries against Tor" from here [PDF].
So far, we have not come across a download link for the Astoria Tor client. We will post a URL as soon as it is available to us.
