New Defense Makes Spying on VPN Users Dramatically Harder
Researchers have developed a technique that generates unique, lightweight defenses against traffic fingerprinting—attacks that can identify what websites users visit even through encrypted VPN connections. The approach, already deployed by VPN provider Mullvad for over a year, offers practical protection without the severe speed and bandwidth penalties that have limited adoption of previous defenses.
Originaltitel: Ephemeral Network-Layer Fingerprinting Defenses
<p>Fingerprinting attacks on encrypted network traffic may reveal sensitive information about users of anonymous communication systems, such as visited websites or watched videos, linking users' activities to their identities. Defenses come at the cost of bandwidth and delay overheads, impacting the user experience and making wide-scale deployment challenging. There is a rich history of attacks and defenses, with continual improvements in deep learning as a catalyst, making deployment of defenses an ever more pressing matter. This paper introduces a new defense strategy against fingerprinting attacks---ephemeral defenses---where efficient defense search enables the generation of unique per-connection defenses. We demonstrate that ephemeral defenses are multipurpose network-layer defenses against circuit, website, and video fingerprinting attacks, achieving competitive performance compared to related work. Furthermore, we create tunable ephemeral defenses that are not overly specialized to a particular fingerprinting attack, dataset, or network conditions. Ephemeral defenses are practical, demonstrated through integration with WireGuard and deployment at Mullvad VPN for a year, serving thousands of daily users.</p>