Attaque par analyse du trafic

Résumé

Dans le domaine du renseignement et de la sécurité informatique, l'attaque par analyse du trafic désigne les méthodes permettant de tirer des informations de flux de communication de tout type (émissions radio, trafic internet, mais également courrier papier, rencontres entre agents…) sans nécessairement avoir accès au contenu des messages échangés (notamment lorsque les messages sont chiffrés. Ce type d'attaque peut être considéré comme une attaque par canal auxiliaire. Principe L'attaquant en interceptant des éléments sur la communication entre ses cibles peut déduire des indices sur leur activité. Plusieurs données peuvent être étudiées par exemple :

fréquence et volume des communications : un trafic important peut indiquer un regain d'activité, la préparation d'une action. Inversement une baisse du trafic peut indiquer une diminution des ressources, une mise en sommeil de certaines cellules.
distribution des messages : une analyse expéditeur-destinataire peut donner

Source officielle

https://fr.wikipedia.org/wiki/Attaque_par_analyse_du_trafic

À propos de ce résultat

Cette page est générée automatiquement et peut contenir des informations qui ne sont pas correctes, complètes, à jour ou pertinentes par rapport à votre recherche. Il en va de même pour toutes les autres pages de ce site. Veillez à vérifier les informations auprès des sources officielles de l'EPFL.

Publications associées (9)

Publications associées

Chargement

Personnes associées (1)

Personnes associées

Chargement

Unités associées (1)

Unités associées

Chargement

Concepts associés (14)

Concepts associés

Chargement

Cours associés (5)

Cours associés

Chargement

Séances de cours associées (9)

Séances de cours associées

Chargement

Using Data Stream Management Systems for Traffic Analysis

Andrea Bergamini

Many traffic analysis tasks are solved with tools that are developed in an ad-hoc, incremental, and cumbersome way instead of seeking systematic solutions that are easy to reuse and understand. The huge amount of data that has to be managed and analyzed together with the fact that many different analysis tasks are performed over a small set of different network trace formats, motivates us to study whether Data Stream Management Systems (DSMSs) might be useful to develop traffic analysis tools. We have performed an ex-perimental study to analyze the advantages and limitations of using DSMS in practice. We study how simple and complex analysis tasks can be solved with TelegraphCQ, a public domain DSMS, and present a preliminary performance analysis.

2004

Chargement

Encrypted DNS double right arrow Privacy? A Traffic Analysis Perspective

Carmela González Troncoso, Sandra Deepthy Siby, Narseo Vallina Rodriguez

Virtually every connection to an Internet service is preceded by a DNS lookup. Lookups are performed without any traffic-level protection, thus enabling manipulation, redirection, surveillance, and censorship. To address these issues, large organizations such as Google and Cloudflare are deploying standardized protocols that encrypt DNS traffic between end users and recursive resolvers: DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). In this paper, we examine whether encrypting DNS traffic can protect users from traffic analysis-based monitoring and censoring. We propose a novel feature set to perform traffic analysis attacks, as the features used to attack HTTPS or Tor traffic are not suitable for DNS' characteristics. We show that traffic analysis enables the identification of domains with high accuracy in closed and open world settings, using 124 times less data than attacks on HTTPS flows. We also show that DNS-based censorship is still possible on encrypted DNS traffic. We find that factors such as end-user location, recursive resolver, platform, or DNS client do negatively affect the attacks' performance, but they are far from completely stopping them. We demonstrate that the standardized padding schemes are not effective. Yet, Tor -which does not effectively mitigate traffic analysis attacks on web traffic- is a good defense against DoH traffic analysis.

INTERNET SOC2020

Chargement

Most communication systems (e.g., e-mails, instant messengers, VPNs) use encryption to prevent third parties from learning sensitive information.However, encrypted communications protect the contents but often leak metadata: the amount of data sent and the time it was sent, the way the data should be decrypted, the identity of the sender and the recipient.These metadata are a pervasive threat to privacy: They enable a variety of attacks that range from recovering plaintext contents from encrypted communications to inferring communicating parties.Our goal in this thesis is two-fold: First, to raise awareness about this problem by demonstrating attacks that threaten user privacy; and second, to propose novel solutions that reduce the metadata leakage and maintain acceptable usability and costs.To achieve the first goal, we present the first work that performs an in-depth analysis of the communications of wearable devices under the lens of traffic analysis.We demonstrate that the metadata of Bluetooth communications of wearable devices (smartwatches, fitness trackers, and blood-pressure monitors) leak sensitive information to a passive observer, despite the use of encryption.By design, these devices handle fine-grained and long-term, personal, medical and lifestyle-related data from their users.Our work highlights the need to rethink how sensitive data is exchanged in this setting.More generally, we confirm that metadata can pose a threat to user privacy, even in settings where traffic-analysis attacks are perhaps not an immediate threat.For the second goal, we begin by presenting a theoretical contribution that concerns ciphertext formats:Padmé, a padding function designed to reduce the metadata leakage of files and messages through their length.Padmé efficiently hides the size of objects even when they have very different sizes.Padmé is a part of PURBs, a ciphertext format that does not leak metadata, except for a small amount about the size.Then, we design systems that enable communicating while reducing metadata leakage: Anonymous Communication Networks (ACNs).ACNs protect against some metadata leakage (e.g., who is communicating and when).Traffic-analysis resistant ACNs have not seen widespread adoption yet, possibly due to their technical shortcomings.We focus on two aspects that remain unsolved: small-scale traffic-agnostic communication that achieves low latency, and large-scale asynchronous messaging that handles millions of users.We present PriFi, an ACN that provides provable traffic-analysis resistance and low-latency in the context of a local-area network.The protocol hides the source and recipient of a message by ensuring that the communication patterns of all participants are equal, even in the presence of active attacks.PriFi ensures low-latency and traffic-agnostic communication for a small set of users.We then present Rubato, an ACN for anonymous messaging that handles millions of users.Other large-scale ACNs have an important limitation: A sender and a recipient need to be online at the same time to resist intersection attacks.As participants are uncoordinated, they need to be online and to send cover traffic at all times, which is infeasible for many users.Rubato is a circuit-based mixnet that enables its users to be asynchronous; they can participate in the network according to their own schedule.Unlike previous ACNs, this enables users to participate using their mobile devices.

EPFL2021

Chargement

EPFL2021