Weaponizing BGP to deanonymize Tor users

This episode explores a chilling new class of vulnerabilities in the Tor network known as "Raptor attacks," detailed in the paper "RAPTOR: Routing Attacks on Privacy in Tor". It shifts the focus from malicious Tor relays to the underlying internet infrastructure, revealing how Autonomous Systems (ASes)—such as large Internet Service Providers—can exploit the Border Gateway Protocol (BGP) to completely deanonymize users. The podcast breaks down the technical mechanics of three distinct but compounding threats. First, it introduces Asymmetric Traffic Analysis. Listeners will learn how an attacker doesn't even need to see the full two-way communication to compromise anonymity; by merely observing the unencrypted TCP sequence and acknowledgment headers in just one direction at both ends of the connection, they can correlate a user's traffic with a staggering 95% accuracy. Second, the episode explains how natural "BGP churn"—the everyday changing of internet routes due to link failures or policy shifts—gradually increases an AS's surveillance power, making long-term Tor usage increasingly risky as new ASes randomly fall onto the user's communication path. Finally, the discussion dives into the most alarming aspect: active routing manipulation. By launching BGP hijacks or stealthy "BGP interception" attacks, a malicious entity can intentionally advertise false internet routes to force a target's Tor traffic through their own servers. Because an interception attack seamlessly routes the traffic back to the actual Tor relay, the connection remains alive and undetected, allowing for the exact deanonymization of the client. The episode concludes by revealing shocking real-world evidence of Tor relays being caught in historical BGP hijacks—such as the 2014 Indosat and Canadian Bitcoin incidents—proving that this theoretical threat is already a practical reality.