AlterCell Attack: Exploiting a Logic Vulnerability in Tor Cell Integrity Validation

The hidden service is used to protect the anonymity of receivers in the Tor network, but it is often exploited for malicious purposes and becomes a breeding ground for crime. To protect the hidden service from abuse, we deeply analysed the Tor specifications and summarised a finite-state machine for Tor cell transmission protocol, deriving a new logical vulnerability of the Tor cell integrity validation. This vulnerability allowed the plaintext field of cell_command in the cell to be arbitrarily modified. Therefore, we proposed the AlterCell attack against potentially malicious hidden services, by introducing malformed cells whose fields of cell_command were modified. In the experiments, when our node acted as the guard for the target hidden service, the AlterCell attack was able to de-anonymise the hidden service if the responsible HSDir was under our control. Otherwise, our attack could block the descriptor publishing process or the client access process, to carry out a denial-of-service attack on the hidden service.