Researcher says technology exists to spot Tor users

A security researcher based in Barcelona claims that his proof-of-concept can identify anyone using anonymity software Tor based on mouse movements.

Jose Carlos Norte created a number of methods that employ fingerprinting technology based on a script that measures time, movements of the mouse wheel, and CPU benchmarks.

Norte said that if websites are able to offer unique fingerprints that identify any user that visits the page, that user’s activity can be tracked.

Norte explained his findings to Vice’s Motherboard via a web chat, saying:

“Every user moves the mouse in a unique way. If you can observe those movements in enough pages the user visits outside of Tor, you can create a unique fingerprint for that user.”

Norte advised users to disable JavaScript in order to avoid having their fingerprints generated.

Fellow security professional Lukasz Olejnik also voiced his opinion to Motherboard when he claimed that far more data would be needed to identify a threat actor, such as curvature, distance, angle and acceleration.

Developers, it appears, are investigating the issue after two bug reports were made that referenced Norte’s exploits.

It is a delicate issue and we wait to learn whether Norte’s claims have any validity. Either way, fingerprinting technology is likely just scratching the surface of what it will be used for in the future. It will undoubtedly be utilised to offer further protection, but in the meantime, businesses in the UK will need to employ whatever technology is available to them at the time. They also need to make IT security jobs available to those who can make the most of that technology.