Selfrando: Securing the Tor Browser Against De-Anonymization Exploits
Total Page：16
File Type：pdf, Size：1020Kb
Proceedings on Privacy Enhancing Technologies ; 2016 (4):454–469 Mauro Conti, Stephen Crane, Tommaso Frassetto, Andrei Homescu, Georg Koppen, Per Larsen, Christopher Liebchen, Mike Perry, and Ahmad-Reza Sadeghi Selfrando: Securing the Tor Browser against De-anonymization Exploits Abstract: Tor is a well-known anonymous communica- 1 Introduction tion system used by millions of users, including jour- nalists and civil rights activists all over the world. The The Tor Project provides a suite of free software and Tor Browser gives non-technical users an easy way to a worldwide network designed to facilitate anonymous access the Tor Network. However, many government or- information exchange and to prevent surveillance and ganizations are actively trying to compromise Tor not fingerprinting of these interactions. The Tor network only in regions with repressive regimes but also in the is open to anyone and widely used by civil rights ac- free world, as the recent FBI incidents clearly demon- tivists, whistleblowers, journalists, citizens of oppressive strate. Exploiting software vulnerabilities in general, regimes, etc. Many sensitive websites, including the late and browser vulnerabilities in particular, constitutes a Silk Road black market, are only accessible over Tor. clear and present threat to the Tor software. The Tor Consequently, the Tor Network is continually facing de- Browser shares a large part of its attack surface with the anonymization attacks by law enforcement, intelligence Firefox browser. Therefore, Firefox vulnerabilities (even agencies, and foreign nation states. A de-anonymization patched ones) are highly valuable to attackers trying to attack aims to disclose information, such as the identity monitor users of the Tor Browser. or the location, of an anonymous user. While many de- In this paper, we present selfrando—an enhanced and anonymization attacks rely on weaknesses in the net- practical load-time randomization technique for the Tor work protocol, they often require that adversaries con- Browser that defends against exploits, such as the one trol a large number of Tor nodes [26] or only work in a FBI allegedly used against Tor users. Our solution sig- lab environment [39]. nificantly improves security over standard address space An alternative and practical way to de-anonymize layout randomization (ASLR) techniques currently used Tor users is to exploit security vulnerabilities in the soft- by Firefox and other mainstream browsers. Moreover, ware used to access the Tor network. The most common we collaborated closely with the Tor Project to ensure way to access Tor is via the Tor Browser (TB) [73], that selfrando is fully compatible with AddressSanitizer which includes a pre-configured Tor client. Since TB is (ASan), a compiler feature to detect memory corrup- based on Mozilla’s Firefox browser, they share a large tion. ASan is used in a hardened version of Tor Browser part of their attack surfaces. In 2013, the Federal Bu- for test purposes. The Tor Project decided to include reau of Investigation (FBI) exploited a known software our solution in the hardened releases of the Tor Browser, vulnerability in Firefox [71] to de-anonymize Tor users which is currently undergoing field testing. that had not updated to the most recent version of Keywords: De-anonymization exploits, code- TB [27, 57, 74]. Due to the success of this operation, randomization, privacy-oriented software, Tor Browser. exploit brokers [79] (and, presumably, governments and criminals) are currently soliciting exploits for the TB. DOI 10.1515/popets-2016-0050 Received 2016-02-29; revised 2016-06-02; accepted 2016-06-02. In early 2016, it was confirmed that the FBI contin- ues to monitor the Tor network, this time using a de- Mauro Conti: Università degli Studi di Padova, E-mail: [email protected] Christopher Liebchen: CASED/Technische Stephen Crane: Immunant, Inc., E-mail: [email protected] Universität Darmstadt, Germany, Tommaso Frassetto: CASED/Technische Universität Darm- E-mail: [email protected] stadt, Germany, E-mail: [email protected] Mike Perry: The Tor Project, Andrei Homescu: Immunant, Inc., E-mail: [email protected] E-mail: [email protected] Ahmad-Reza Sadeghi: CASED/Technische Universität Georg Koppen: The Tor Project, E-mail: [email protected] Darmstadt, Germany, E-mail: [email protected] Per Larsen: Immunant, Inc., E-mail: [email protected] Selfrando: Securing the Tor Browser against De-anonymization Exploits 455 anonymization attack devised by Carnegie Mellon Uni- avoids risky binary rewriting or the need to use a versity researchers [19]. custom compiler, and instead works with existing The Open Technology Fund commissioned a study build tools. Moreover, it is fully compatible with on current and future hardening efforts to reduce the ASan, which required additional implementation ef- attack surface of the TB [58]. One of the recommenda- fort since the randomization interferes with ASan. tions was to use compiler techniques to detect mem- – Increased Entropy and Leakage Resilience ory corruption (buffer overflow, use-after-free, unini- selfrando reduces the impact of information leak- tialized variables, etc.) such as the AddressSanitizer age vulnerabilities and increases entropy relative (ASan) feature [61]. Another key recommendation was to ASLR, making selfrando more effective against to use address space layout randomization (ASLR) to guessing attacks. Our use of load-time randomiza- prevent exploitation of memory corruption vulnerabili- tion mitigates threats from attackers observing bi- ties. While ASan imposes a high runtime overhead [61], naries during download or after the executable files ASLR is very efficient. However, ASLR was recom- have been stored on disk. mended because it is widely supported by compilers – Hardening the Tor Browser We demonstrate and operating systems, not for its security properties. In the practicality of selfrando by applying it to the en- fact, the shortcomings of ASLR are well documented in tire TB without requiring any code changes. Our de- the academic literature [8, 16, 33, 62, 64, 68]. ASLR can tailed and careful evaluation shows that the startup be made significantly stronger by randomizing not just and performance overheads of selfrando are negligi- the base address of modules but also the code inside each ble. module. Address space layout permutation (ASLP) [44], for instance, randomizes the location of each function individually, thwarting many of the techniques used to 2 Background bypass ASLR. Until now, however, the ASLR improve- ments suggested in the literature have suffered from one or more drawbacks that have prevented their use 2.1 Exploiting Memory Corruption in practice. Some techniques rely on binary rewriting, ++ which does not scale to complex programs such as web Unlike modern programming languages, C and C rely browsers [22, 38]; others randomize the code using a cus- on manual memory management, trading reliability for tomized compiler [35], or require each user to download flexibility and performance. Hence, memory manage- their own unique binary [42]. ment errors often create vulnerabilities that can be ex- Goals and Contributions The goal of this ploited to hijack control flow and perform other mali- paper is to demonstrate a load-time randomization cious operations that were never intended by the pro- technique—named selfrando—that improves security gram authors. over ASLR while preserving the features that enabled Traditionally, attackers used a buffer overflow to di- ASLR’s widespread adoption. While technically chal- rectly inject malicious code into a program and exe- lenging, our use of load-time function layout permuta- cute it [6]. However, the introduction of the W⊕X pol- tion ensures that the attack surface changes from one icy that requires memory pages to either be writable run to another. Load-time randomization also ensures or executable, but not both, made most code-injection compatibility with code signing and distribution mech- attacks [49] obsolete. As W⊕X became commonplace, anisms that use caching to efficiently serve millions of attackers changed their tactics from code injection to users. Finally, we worked in close collaboration with the code reuse. These attacks reuse existing, legitimate code TB developers to ensure that selfrando was fully com- for malicious purposes and have therefore proven far patible with ASan so that users can use both techniques harder to stop than code injection. Return-into-libc simultaneously. ASan is used in a hardened version of (RILC) attacks, for example, arrange the stack con- TB to detect and diagnose memory corruption errors. tents so the attacker can call dangerous functions inside Summing up, our main contributions are: the C library with attacker-controlled arguments [52]. – Practical Randomization Framework Unlike Researchers later demonstrated a more general class of other solutions that have only been tested on bench- code reuse attacks called return-oriented programming marks, selfrando can be applied to the TB with- (ROP) [63]. The insight behind ROP is that attackers out any changes to the source code. To the best of can build a malicious virtual machine out of short in- our knowledge, selfrando is the first approach that struction sequences—called gadgets in ROP parlance— Selfrando: Securing the Tor Browser against De-anonymization Exploits 456 ending with a return (or some other indirect branch). 2.3 Trust in Privacy-preserving Software These gadgets are