19 ms·
Popular dark-web hosting provider hacked, 6,500 sites down
- new_guy 8y agohttps://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/e... This seems to be the exploit they used?
- draugadrotten 8y agoSo, lots of pages, on one hosting site.
- superkuh 8y agoMan, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.
- hnphillipj 8y agoHow do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.
- sdwisely 8y ago"Tor Hidden Services" are services hosted on the tor network and inaccessible outside it. Hosts are assigned a dns name <id>.onion so clients can connect to that service.
- bambataa 8y agoIs it not fairly trivial to link that to you? How can you make it anonymous?
- Filligree 8y agoOnly if you're omniscient in the network. No single node knows what traffic it's carrying, or that the next node the traffic is meant to be sent to is the final one.
- sp332 8y agoIn normal Tor usage, the client sends a request through three chosen hops, each of which only knows the previous and next hops, so the entry node doesn't know the destination and the exit node doesn't know where the request originated. But this only hides the client, because the client needs to know the server's address to direct the exit node where to send the request. So to hide the server, there is a symmetrical setup with three extra hops on the server's side, and a published "rendezvous" address in the middle. So the server connects to the rendezvous without revealing its real IP, and the client can direct requests to the rendezvous without knowing the server's IP.
- arthurjj 8y ago^ is the most informative comment in the whole thread. So by 'hosting' they mean being the rendezvous address?
- deleted 8y ago[deleted]
- whyleyc 8y agoBackground info on the exploit used at: https://antichat.com/threads/463395/#post-4254681 https://antichat.com/threads/463395/#post-4254681
- pbhjpbhj 8y ago(nb: page is in Russian)
- el_duderino 8y agohttps://translate.google.com/translate?hl=en&sl=ru&tl=en&u=https%3A%2F%2Fantichat.com%2Fthreads%2F463395%2F%23post-4254681 https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=h...
- supakeen 8y agoThe one the owner thinks was not used as he only saw database access not shell access but was mentioned by ZDNet as getting well known around the time this database was emptied.
- ec109685 8y agoBetter explanation: https://www.reddit.com/r/netsec/comments/9wzwgw/0day_bypassing_disabled_exec_functions_in_php_via/ https://www.reddit.com/r/netsec/comments/9wzwgw/0day_bypassi...
- john37386 8y ago"Backups? Forget it. This is the Dark Web. Winzen told ZDNet that there ain’t no such thing as backups on Daniel’s Hosting, by design:" I'm wondering why encrypted backup is not an option for them?
- foepys 8y agoIf the user isn't the sole owner of the key, encryption is pretty much worthless for such services. At this point users can do the backups themselves.
- TrueDuality 8y agoThe dark web is designed to be anonymous. Long term persistence of anything that might hold details about the users of the sites are taboo in the extreme. Since this is a hosting provider for the dark web (and one that advertises they don't do backups, logs, etc), they don't know what the content of the sites or databases involve. Keep backups of that content is an additional liability for their business. Site owners for all hosting providers, including when you're running on clouds like AWS, should put thought into their backup strategies independently of guarantees from their provider. For providers like AWS you will likely use their storage options for backups such as S3, but you are taking a risk especially if you're storing in the same region. Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time.
- FooHentai 8y ago>Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time. >loudest 'Amen' in recorded history emanates from my cubicle
- cronix 8y agoFor the same reason why the NSA siphons up all data from the net, encrypted or not, and stores it. They know one day they'll be able to crack todays crypt. Being able to decrypt a backup 5 or 10 years from now will still provide a lot of useful data, whether it came from the darknet or someones icloud backup while it was in transit to Apples servers. Encryption really only protects you from "today", not what will happen to it in the future. It's one reason I kind of chuckle to myself when people put such high regard into companies that proclaim to be more self conscious about protecting user data and what they do with it. It doesn't really matter if the data is still being collected and stored for later decryption. It's basically just a "delay" of when it can be read. The only thing stopping them, currently, is not having enough qbits in a quantum computer. Things are going to get, strange. https://www.youtube.com/watch?v=vNV_3PkA9WM https://www.youtube.com/watch?v=vNV_3PkA9WM
- jamieweb 8y agoI guess that all of the private keys for the onion services will be gone too. Even if they aren't, they can't be used anymore anyway as they should be assumed to be compromised. I hashed for a month to get a vanity one, others have done longer. Did this hosting service allow custom private key uploads?
- kodablah 8y agoAlso, if private keys were obtained, it's trivial to republish to the same onion address with any changes you want. This is that one scenario where an EV cert that can be revoked has value if you're a non-anonymous hoster. There are other alternative-factor identity verification techniques (e.g. DNS, Alt-Svc HTTP header) but the querying aspect reduces anonymity.
- jamieweb 8y agoWith the DNS and Alt-Src, are you saying that the Onion site identity can be verified by visiting the non-onion version of the site, and then relying on the header/DNS record to take the session onto Tor? Then when the onion service private key is breached, the site operator just changes the header and DNS record to a new, non-breached one? As you say though, querying these does reduce anonymity.
- kodablah 8y agoYup (well, automatically with Alt-Svc when using the Tor browser, some kind of manual TXT record I would guess with DNS, I don't know of anything standardized)
- danieltillett 8y agoIs it wise to have a vanity private key in this circumstance?
- brokenmachine 8y agoI presume OP didn't mean he hashed until the key was his social security number and name.
- qwerty456127 8y agoWhy?
- GordonS 8y ago> Winzen said his priority was to do a full analysis of the log files I wouldn't have thought a darkweb hosting service should have any logs?
- httpsterio 8y agoIt's a server just as any server, instead of serving content through apache or nginx, you are more likely to serve it through thttpd or savant.
- greyfox 8y agoWhy do you say that? Genuinely curious. Though I'm not familiar with thttpd or savant, after briefly looking them over they appear to be http servers just like apache or nginx. What would make them more appealing for a dark web host? They dont seem to be particular "dark-web-centric" with what i could read at face value. though most times dark web stuff has tons of other info thats not found 'at face value'...
- rsync 8y ago"Though I'm not familiar with thttpd or savant, after briefly looking them over they appear to be http servers just like apache or nginx." Not your parent, but it wouldn't surprise me to learn that "dark web sites" are using thttpd ... it's a very simple, lightweight, dependable web server. The major downside - the lack of SSL - is perhaps not an issue as you are running over an encrypted channel anyway. If I just needed to throw something up - perhaps on a remote or throwaway host - thttpd would certainly be my first choice.
- mirimir 8y agoAlso, thttpd[0] is fast, doesn't fork, and is resistant to DoS attacks. The downside is that it's no longer in many repositories, and it can be a pain to compile. 0) https://acme.com/software/thttpd/ https://acme.com/software/thttpd/
- 8y ago
- ccnafr 8y agoSophos blog spam for actual ZDNet report from over the weekend: https://www.zdnet.com/article/popular-dark-web-hosting-provider-got-hacked-6500-sites-down/ https://www.zdnet.com/article/popular-dark-web-hosting-provi... Maybe a mod can replace the link with the actual source.
- burnThemAll 8y agoPHP zero-day vulnerability. Better off offline, honestly.
- sctb 8y agoThanks! We've updated the link from https://nakedsecurity.sophos.com/2018/11/21/hacker-erases-6500-sites-from-the-dark-web/ https://nakedsecurity.sophos.com/2018/11/21/hacker-erases-65....
- Simulacra 8y agoGive it about...a month and there will be 13,000 onion sites to take its place.
- kodablah 8y agos/hidden service/onion service Pedantic, but is the preferred nomenclature today.
- saurik 8y agoI am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance that the traffic was being hosted by this one guy named Daniel?
- alexanderh 8y agodoesn't surprise me that the initial layer of obscurity provided by TOR gave people a false sense of security.
- busterarm 8y agoIf you want to serve some content that's illegal and someone a) offers you hosting, and b) doesn't know who you are, then you absolutely host there because it's zero risk to you.
- dejaime 8y agoThat 30% is clearly a gross estimation, and certainly a wrong one with no data to back it up. Still, even though it is definitely counter productive to host on a widely known host, it still does not expose any users, and that is the main point, not really protecting the host.
- dejaime 8y ago"30% of the dark web was erased." More like "what was loosely estimated to be 30%"
- dmix 8y agoAnd 30% of accessible addresses not 30% of traffic.
- rodolphoarruda 8y ago> there are no backups. Interesting. If I were into this kind of activity I would love to have backups designed, implemented and maintained the "dark" way. It seems to me that by just running the services you are not 100% into this business. You'd have to come up with the whole "dark ops" approach.
- S-E-P 8y agoWhat would you define as a "dark" way. The "dark" way is to assure that any and all traffic and interactions are anonymous as possible. Keeping a record of communications/behaviors is the direct antithesis of this. The "dark" way is to never backup
- rodolphoarruda 8y agoI always thought that communications/behaviors are not a problem once parties remain anonymous or unidentifiable.
- ben509 8y agoIt will be interesting to see a followup in a few months, in particular, to see how many sites come back online. My expectation is that a good number will look to an alternate service, though the ones who are willing to try again would be more likely to have recovery plans.
- dejaime 8y agoThis looks like a good old "Kill the problem and frame him later" type of a take down. The owners (or some users) angered the wrong people, and now they are even the biggest pedos of the whole wide world...
- busterarm 8y agoThey probably were the biggest pedos in the world. That's the only sane reason to host a platform like this, if you have any sense of self-preservation. Moreover, its predecessors, Freedom Hosting and Freedom Hosting II, were both the biggest purveyors of CP when they were taken down. If it walks like a duck...
- yjftsjthsd-h 8y agoOnly the guilty have something to hide? Really?
- jorblumesea 8y agoYeah, and the biggest users of cryptography are criminals. Only the guilty lock their car doors, right?
- busterarm 8y agoYou and the other commenter are missing the point. I'm not stating either of those. The motivation for hosting something like this is to hide what you're hosting in a bunch of noise. Legal or illegal. Your goal is to make it hard to gather metadata about the service. There are perfectly legitimate reasons to want that... That said, it's a foregone conclusion that if you host a service like this, people who want to distribute child pornography are going to flock to it. If you don't police the content, that's even more true. In fact, in the case of Freedom Hosting II, the host was allowing the pedos to circumvent the normal limitations of the platform, in theory because they were paying cold hard cash, as well as allowing scammers to operate on the platform, also for cold hard cash. It's been suggested that as much as 50% of the content hosted on Freedom Hosting II was child porn. If you knowingly allow people to use your service to distribute child pornography or commit other crimes, you're every bit as culpable as your customers. This type of platform costs not-insignificant money to run -- it's a business. Nobody is hosting this many services out of a sense of altruism. And honestly, in the case of CP, if you're hosting it, including running a service that facilitates the hosting of it, you deserve to serve consecutive life sentences in prison and whatever harm befalls those in prison who get found out as pedos.
- excalibur 8y agoMy bad. I signed up for my Free Dark Web Scan, and said my name was Philip'); DROP TABLE customers;--
- paulie_a 8y agoI've done that to sms spammers. I don't know if it worked but I tried ten or so variations. I stopped receiving those messages. I was getting 10 a day at the time. I doubt I actually did any damage but I really hope I did.
- bouncycastle 8y agoHaha! That reminds me of when I once edited my web browser's user agent to something similar, but then I forgot about it. Later, when I was browsing, a lot of the websites just blank screened or returned 500 errors or displayed an SQL error. The other browser worked fine. I finally realized it was my user agent! So yes, a little SQL injection can come up in many unexpected situations as you may have observed :-) Another time, I set my user agent to an XSS string, just because I was testing something, but forgot to set back. A week later, I noticed that my colleague was baffled by a popup coming up each time he was browsing the logs. Oops, that was my XSS user agent... I'm guessing a lot of places don't sanitize logs. You'd be amazed how many places these things work :-)
- xfitm3 8y agoYou can't ever get anonymous layer 1. To the point of other commenters - percentage figures are unreliable on tor.
- doctorless 8y agoThis isn’t true. Wireless mesh networks could make for an anonymous medium.
- mirimir 8y agoIf I were going to attempt such an .onion hosting setup, I'd use a couple levels of isolation between users. Maybe setup several KVM domains, to help limit damage from a compromise. And within each domain, put each website in a Docker container. Given a custom Docker-optimized kernel for the host, and XFS storage, I gather that it's possible to set hard limits on CPU, RAM and storage for containers. Given that Docker containers rely on kernel namespaces and cgroups for isolation, they're not as secure as using full VMs. But they're far lighter, and much better isolated than these late .onions. Alternatively, one could maybe use FreeBSD jails with Docker. And about backups. I get his argument for not backing up. But maybe a setup with relatively fast rotation, and thorough deletion of old backups, would be secure enough. I'd use LUKS with dropbear for server FDE. That's still vulnerable, sure, but attackers would need to take some care while impounding the server. Also, I'd keep backups on another server, with only .onion-.onion connections (maybe OnionCat).
- xena 8y agoWhat's stopping you from writing this then?
- mirimir 8y agoWriting? Do you mean implementing? Basically, the prospect of managing thousands of accounts doesn't appeal to me.
- krageon 8y agoContainers are not at all a security thing. If you really need that caliber of separation, you are looking at VMs at the very least.
- mirimir 8y agoReally "not at all"? Isn't that more secure than chroot? I do agree with you that VMs, at least, would be more secure. But hosting thousands of VMs takes substantial resources. And when there's free shared hosting available, few would understand enough to pay the premium.
- sbhn 8y agoWell, hopefully the dark web version of google kept a nice cache of what was important
- kryogen1c 8y ago>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang. If it was known for a month, it's not an 0day.
- kjeetgill 8y agoHuh, doesn't making it publicly known before patching it in PHP constitute a 0day? Or by unpatched did they mean patched upstream but not here?
- busterarm 8y agoThis is one that people have been getting wrong for decades. "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software)" Patching and knowing about the vulnerability are different things. And so, this is not 0day.
- YouKnowBetter 8y agoNo idea why you are getting downvoted, since this perfectly acceptable explaination of a 0-day.
- PeterisP 8y agoThe article does say that it became widely known only the day before the attack. Day zero starts counting from the time where either the developers/maintainers of the system or the general public are informed about the vulnerability. If the vulnerability has been discussed in some private forums or exploited by a NSA for many years, it doesn't matter, it's still day zero until it goes public (or privately disclosed to, in this case, maintainers of PHP). And as the attack was something like ~24 hours after disclosure, it's close enough to call it a zero-day attack.
- SmellyGeekBoy 8y ago
- adminu 8y agoI don't get Daniel Hosting... Why did he offer free hosting? What was the business model? He said, you are not allowed to host illegal content according to German law, i wonder how he managed to maintain this state with 6.5k pages up. In the end it would be quite easy to raid him for some CP, quite a risk for what gain?
- rootsudo 8y agoBecause why not? Not everything is a business and if you believe Tor as a right of privacy in the digital age and you wish to make it available to everyone, why not? Censorship comes in many forms, and technological literacy in the form of running a LAMP Stack and knowing how to modify apache is slim in the world, php/mysql, forget about it. 6.5K pages is not a lot of data, especially for interactive and probably non-rich dynamic pages. Consider it as a geocities in the 90's. What probably happen was there was an jail escape that enabled a live shell and that person killed it. From who knows whom - As for running a tor site, the most suspicious thing about it is being a tor exit node.
- adminu 8y agoNot everything is a business but many other hobbies have a way lower probability to put you in jail.
- airnomad 8y agoWould it be possible or feasible to compile a site into a single binary? Within binary there would be, say 1GB encrypted file system and embedded SQL lite could write data to it and embedded http process would be able to serve and store static content. On startup you'd enter password and decrypt a baked-in filesystem. I guess this would still be possible to break into as long as the app is working since decryption key would be saved in RAM but as soon as server goes offline data would be inaccessible. Then you host this, say, in Russia or China and you should be safe from USA authorities.