Off-Path Website Fingerprinting Through Shared Hardware Bottlenecks

Abstract

Website Fingerprinting (WF) is the practice of deanonymizing end hosts in a network connection by recognizing the time series of packets sent from a site upon load. Current WF research relies on the assumption of on-path adversaries and thus accounts only for threats where a node or link in the BGP (Border Gateway Protocol) route is compromised. This work aims to prove an off-path attack vector for WF through shared hardware resources. The attack occurs as follows: the adversary connects to a link that is also in the victim’s BGP route and weaponizes queuing in the buffer to saturate it and infer the time series of the victim packets from the inter-arrival times of adversarial packets. Then the adversary uses a trained triplet-fingerprinting model to find an embedding for the post-queue trace that best deanonymizes the end host. This work shows the efficacy of this attack in live hardware tests, and uses a simulation to analyze potential responsive queuing mechanisms in more detail.