Tor 0day: Finding IP Addresses
An Anonymous Coward writes:
Tor 0day: Finding IP Addresses - The Hacker Factor Blog:
Last February, my Tor onion service came under a huge Tor-based distributed denial-of-service (DDoS) attack. I spent days analyzing the attack, developing mitigation options, and defending my server. (The Tor service that I run for the Internet Archive was down for a few hours, but I managed to keep it up and running through most of the attack.)
While trying to find creative ways to keep the service up, I consulted a group of friends who are very active in the network incident response field. Some of these are the people who warn the world about new network attacks. Others are very experienced at tracking down denial-of-service attacks and their associated command-and-control (C&C) servers. I asked them if they could help me find the source of the attack. "Sure," they replied. They just needed my IP address.
I read off the address: "152 dot" and they repeated back "152 dot". "19 dot" "19 dot" and then they told me the rest of the network address. (I was stunned.) Tor is supposed to be anonymous. You're not supposed to know the IP address of a hidden service. But they knew. They had been watching the Tor-based DDoS. They had a list of the hidden service addresses that were being targeted by the attack. They just didn't know that this specific address was mine.
As it turns out, this is an open secret among the internet service community: You are not anonymous on Tor.
It turns out that there are some flaws in the design of Tor services, which this story very ably explains. Quite readable, too.
[NB: SoylentNews has supported Tor Since April 1, 2014 (yes, really). In light of today's story, is this something that SoylentNews should continue to support? I suspect bots are making use of it to create accounts here. It would probably require some work to disable Tor properly, so I am not anticipating immediate removal. This is more trying to get input from the community. What say you? --martyb]
Read more of this story at SoylentNews.