http://g7ee5otfyict57k24vjujuqzi6pd7iwvnsry2mt3svsgwzn6o6iynsad.onion/popets/2018/popets-2018-0011.php
This attack uses the possibility to send dummy cells that are silently dropped by onion services, in accordance with the flexible protocol design, and the possibility to observe those cells by inspecting public bandwidth measurements, which act as a side channel. Our attack against Tor clients, called the dropmark attack, is an efficient 1-bit conveying active attack that correlates flows.