Provably Avoiding Geographic Regions for Tor’s Onion Services

Tor, a peer-to-peer anonymous communication system, is one of the most effective tools in providing free and open communication online. Many of the attacks on Tor’s anonymity occur when an adversary can intercept a user’s traffic; it is thus useful to limit how much of a user’s traffic can enter potentially adversarial networks. Recent work has demonstrated that careful circuit creation can allow users to provably avoid geographic regions that a user expects to be adversarial. These prior systems leverage the fact that a user has complete control over the circuits they create. Unfortunately, that work does not apply to onion services (formerly known as “hidden services”), in which no one entity knows the full circuit between user and hidden service. In this work, we present the design, implementation, and evaluation of DeTor \(_{OS}\) , the first provable geographic avoidance system for onion services. We demonstrate how recent work to build and deploy programmable middleboxes onto the Tor network allows us to take existing techniques like these and deploy them in scenarios that were not possible before. DeTor \(_{OS}\) is immediately deployable as it is built using programmable middleboxes, meaning it does not require either the Tor protocol or its source code to be modified. This work also raises a number of interesting questions about extensions of provable geographical routing to other scenarios and threat models, as well as reinforces how the notion of programmable middleboxes can allow for the deployment of both existing and new techniques in novel ways in anonymity networks.