New SnailLoad Attack Exploits Network Latency To Spy On Users' Web Activities (thehackernews.com) 13
Longtime Slashdot reader Artem S. Tashkinov shares a report from The Hacker News: A group of security researchers from the Graz University of Technology have demonstrated a new side-channel attack known as SnailLoad that could be used to remotely infer a user's web activity. "SnailLoad exploits a bottleneck present on all Internet connections," the researchers said in a study released this week. "This bottleneck influences the latency of network packets, allowing an attacker to infer the current network activity on someone else's Internet connection. An attacker can use this information to infer websites a user visits or videos a user watches." A defining characteristic of the approach is that it obviates the need for carrying out an adversary-in-the-middle (AitM) attack or being in physical proximity to the Wi-Fi connection to sniff network traffic. Specifically, it entails tricking a target into loading a harmless asset (e.g., a file, an image, or an ad) from a threat actor-controlled server, which then exploits the victim's network latency as a side channel to determine online activities on the victim system.
To perform such a fingerprinting attack and glean what video or a website a user might be watching or visiting, the attacker conducts a series of latency measurements of the victim's network connection as the content is being downloaded from the server while they are browsing or viewing. It then involves a post-processing phase that employs a convolutional neural network (CNN) trained with traces from an identical network setup to make the inference with an accuracy of up to 98% for videos and 63% for websites. In other words, due to the network bottleneck on the victim's side, the adversary can deduce the transmitted amount of data by measuring the packet round trip time (RTT). The RTT traces are unique per video and can be used to classify the video watched by the victim. The attack is so named because the attacking server transmits the file at a snail's pace in order to monitor the connection latency over an extended period of time.
To perform such a fingerprinting attack and glean what video or a website a user might be watching or visiting, the attacker conducts a series of latency measurements of the victim's network connection as the content is being downloaded from the server while they are browsing or viewing. It then involves a post-processing phase that employs a convolutional neural network (CNN) trained with traces from an identical network setup to make the inference with an accuracy of up to 98% for videos and 63% for websites. In other words, due to the network bottleneck on the victim's side, the adversary can deduce the transmitted amount of data by measuring the packet round trip time (RTT). The RTT traces are unique per video and can be used to classify the video watched by the victim. The attack is so named because the attacking server transmits the file at a snail's pace in order to monitor the connection latency over an extended period of time.
To Infer Guilt. (Score:2)
Just curious, is the current legal system prepared to help me “infer” horrific amounts of questionable traffic upon someone with little more than a cool sounding network butt-sniffing tool that can pin a traffic “fingerprint” like a tail on the donkey? Asking for a victi, er I mean random friend working for the competition..
Re: (Score:3)
I don't think this will be very reliable. I just had two students look at website fingerprinting on encrypted traffic and they had to massively limit the target website set to get anything. Also, this requires the victim to stream a video pretty smoothly, hence from a larger provider.
I'm always amazed at how little data is needed (Score:3)
Probably useless (Score:4, Interesting)
Re: (Score:2)
Unfortunately, humans are easily confused by random variation, it's why we have statistics. But people are remarkably consistent over the short-term: That allows this method to work. Although, as you realize, as the file count increases, the cost of identifying individual files, increases faster.
This will work as a honey-trap, not so much as follow-everyone surveillance.
Re: (Score:2)
This will work as a honey-trap, not so much as follow-everyone surveillance.
My take as well. Email a link to the victim and find whether they are looking at a video on that page.
Does this work with Pornhub? (Score:2)
Just asking for a friend.
Re: (Score:2)
What if my videos have a constant bitrate? (Score:2)
How would it work then?
Re: (Score:2)
You should know the answer to that already.