During this time, the adversary did not see you or interact with you and even the calls and website were encrypted. But they collected metadata passively.
- Here is a diagram that displays what occured and what the adversary collected:
+ Here is a diagram that displays what occurred and what the adversary collected:
@@ -130,7 +130,7 @@
In a more general sense, the entire goal of the adversary is to find information that uniquely identifies you.
Metadata provides exactly that: If they know where you go, the groups you interact with, the timing of your activity, the way you speak, the things you look at, etc, the adversary can creative a very identifying profile.
Even if each singular piece of metadata provides minor information, adversaries use it to form associations, connecting each one of those fragments to see an entire picture where your possible profile is narrowed.
- For more context on information and anonymity, this tutorial is recommended as a prequisite.
+ For more context on information and anonymity, this tutorial is recommended as a prerequisite.
We will will focus on understanding most major attack vectors for metadata collection and briefly cover simple mitigation. @@ -166,7 +166,7 @@
- TOR mitigates some of this by making all packets the same size, but the ISP is still able to see the total amount of data transferred and the timing. + TOR mitigates some of this by making all packets the same size, but the ISP is still able to see the total amount of data transferred and the timing.
Let's say that you connect to an anonymous forum account by going You->VPN->Tor->Website. You log in every Wednesday and Thursday between 4-6 P.M., post some comments and interact, and upload about 2GB of data.
The ISP can see that you connected to a VPN and transferred 2GB of data between those times.
@@ -176,20 +176,20 @@
This is a very simple attack which only involves ISP metadata and note that in real scenarios, this is not done by hand but by artificial intelligence and with more variables and information.
- To avoid such analysis, DAITA (Defense Againt AI-Guided Traffic Analysis) should be used which is covered in more detail in this tutorial.
+ To avoid such analysis, DAITA (Defense Against AI-Guided Traffic Analysis) should be used which is covered in more detail in this tutorial.
Combining DAITA with generally not having highly predictable patterns makes network metadata difficult to use and these attacks far harder.
- As simply displayed in the inital example, cell towers and telecommunications are one of the largest spots for metadata collection. Specifically: the exact who, when, and where of every call.
+ As simply displayed in the initial example, cell towers and telecommunications are one of the largest spots for metadata collection. Specifically: the exact who, when, and where of every call.
Unlike networks or other platforms, the identity of every connected phone is known and location can be determined by cell tower triangulation. The metadata is enough to entirely deanonymize and map most actions and is explained in this tutorial.
Simply, anonymity is not compatible with cell towers and they should be avoided entirely.
- To operate and communciate with websites, your web browser sends out various information that is unique and identifiable. + To operate and communicate with websites, your web browser sends out various information that is unique and identifiable.
A non-exhaustive list is as follows: @@ -218,10 +218,10 @@ Moreover, this also stops any form of persona separation because all of your activity is uniquely tied to that browser footprint, regardless of whether you are logged in, what site you're on, or even if you're routing through TOR.
- Mitigation for this is quite straightforward: usage of the Tor Browser since every user is made to look the same. Most of the identifying metadata mentioned before is not a threat since configuration is uniform across all users. + Mitigation for this is quite straightforward: usage of the Tor Browser since every user is made to look the same. Most of the identifying metadata mentioned before is not a threat since configuration is uniform across all users.
- However, metrics like typing speed, mouse patterns, operating system, and a few others will still be leaked, so when consistently visiting the same websites using the Tor Browser, vary your acitvities so the information is not usable. + However, metrics like typing speed, mouse patterns, operating system, and a few others will still be leaked, so when consistently visiting the same websites using the Tor Browser, vary your activities so the information is not usable.
- If these files are uploaded anywhere, the party that recieves the file could potentially pinpoint your exact location. + If these files are uploaded anywhere, the party that receives the file could potentially pinpoint your exact location.
Let's use an example: Say I have a sample image from an iPhone camera, called image.jpeg, taken at the Eiffel Tower.
@@ -331,12 +331,12 @@ File Type : JPEG
Metadata doesn't only exist in EXIF format in images, it can also be embedded in files like PDFs.
-Elsevier, the largest academic publisher, embedded unique hashes in PDF metadata for each download, meaning that your copy was uniquely identifiable. If you downloaded a file like this and then shared it in your anonymous persona, you would instantly be deanonymized since the specifc copy ties back to your account only. Using the same exiftool commands as before will remove this metadata as well.
+Elsevier, the largest academic publisher, embedded unique hashes in PDF metadata for each download, meaning that your copy was uniquely identifiable. If you downloaded a file like this and then shared it in your anonymous persona, you would instantly be deanonymized since the specific copy ties back to your account only. Using the same exiftool commands as before will remove this metadata as well.
Similar identifying methods may be in other files or from general content and it is advised to use plaintext and thoroughly remove all metadata before uploading anything.
- An image of the real world contains a significant amount of data such as the buildings in it or the lighting. Figuring out where a picture was taken is a rather popular activtiy in everything from OSINT to GeoGuessr. + An image of the real world contains a significant amount of data such as the buildings in it or the lighting. Figuring out where a picture was taken is a rather popular activity in everything from OSINT to GeoGuessr.
A few techniques are using shadows to determine timing, perspective to determine distance, bruteforcing after reducing search space, and looking at nature or other details to determine location. @@ -402,7 +402,7 @@ File Type : JPEG Let's look at a few examples:
- - If your forum posts have certain slang, an adversary can estimage your age, which can be 2-3 bits of information.
+ - If your forum posts have certain slang, an adversary can estimate your age, which can be 2-3 bits of information.
- If your writing is consistently highly technical and includes references and wording central to a specific field, the adversary can roughly guess your profession, level of knowledge, and skills, which could be 10+ bits of information.
- Metaphors and word choice, or speaking in multiple languages can reveal ethnicity, location, or content you've read.
