A first-hop traffic analysis attack against a femtocell

We introduce an attack against encrypted web traffic passing over the first hop - between a femtocell device and the mobile core network. The attack makes use only of packet timing information on the uplink and so is impervious to packet padding defences. We demonstrate the effectiveness of the attack at identifying the web sites being visited by a mobile broadband user whose traffic goes through a femtocell device, achieving mean success rates of 92%. As well as being of interest in its own right, this timing-only attack serves to highlight deficiencies in existing defences and so to areas where it would be beneficial for VPN designers to focus further attention.