Deanonymization of Tor HTTP Hidden Services via Timing & Header Side-Channels
Ionut Cernica demonstrates novel side-channel attacks against Tor HTTP Onion Services, leaking the real backend IP address through HTTP header discrepancies.
Summary
The Anonymity Model of Tor Onion Services
Tor Onion Services are designed to conceal the true IP address and geographic location of web servers, routing traffic through multi-hop rendezvous circuits.
Discovering Web Server Header and Timing Side-Channels
Ionut Cernica analyzes how default web server configurations (Apache, Nginx) leak backend network identifiers and clock skews.
Active Probing and IP Address Correlation Attacks
Cernica demonstrates crafting specialized HTTP requests that induce unique TCP responses, allowing an external observer to correlate the Onion service to a public IP.
Hardening Guidelines for Onion Service Operators
The author provides a comprehensive hardening blueprint—including custom error page sanitization, proxy stripping, and isolated virtualization.
Related talks
Main Stage·24 min
Guevara Noubir · Amirali Sanatinia
Northeastern University researchers expose malicious Tor hidden service directory (HSDir) relays operating honeypots and actively probing onion addresses.
Main Stage·43 min
Roger Dingledine
Tor Project co-founder Roger Dingledine shares operational war stories, censorship battles, and technical milestones from two decades of developing the Tor network.
Main Stage·41 min
G Gegenheuber · M Gunther
Discloses network and timing side channels in end-to-end encrypted messaging apps that allow adversaries to reconstruct contact graphs and user activity.