Breaking Tor's Anonymity by Modifying Cell's Command

Tor is a relay-based communication network that provides users with anonymous access to the Internet. This paper proposes a new attack to associate the anonymous communication relationship between the client and the server in the Tor network, which exploits defects of the Tor protocol, resulting in deanonymizing the Tor network. In this attack, a malicious entry onion router modifies the command field of cell sequences derived from the client to embed a signal sequence. While the exit onion router detects a signal sequence consistent with the embedded signal sequence, the anonymous communication relationships between the client and the server can be confirmed. We have implemented the attack in a private Tor network and our experiments validate its feasibility and effectiveness, with 100% accuracy, 97.5 % true positive rate, and zero false positive rate.