4 ms·

Why would people spend effort trying to deanonymize an Internet Archive server? Are try trying to deanonymize every single hidden service? And why would they t

Why would people spend effort trying to deanonymize an Internet Archive server? Are try trying to deanonymize every single hidden service? And why would they try to DDOS the services once deanonymized? I don't see how anyone would gain anything from that. If you DDOS some big website you get famous from all the news articles being written about you, but DDOSing a hidden service won't make you famous.

Nextgrid 7y ago
From what I understand the DDoS is necessary to force the Tor daemon to choose a new guard which is what they need for their attack. As far as deanonymizing it goes, one theory could be that it’s an automated process that crawls the open web for onion links and tries to deanonymize them all.
jimrandomh 7y ago
If they want to find out whether a deanonymization technique works, they would choose a target whose identity and location is already known, so that they can confirm that the attack produced the right answer.
hackerfactor1 7y ago
I don't know this attacker's reason. I only see the attack. But I can offer some baseless suspicions: I'm forwarding traffic from Tor to the Internet Archive. During the last French election, someone DoS'ed most of their media outlets. As a result, lots of French people used Tor to access the current news from the Internet Archive's collection. Shortly after that, someone tried to DDoS my onion service. With all of the voting and elections and the impeachment vote coming up, I'm expecting attacks since the Internet Archive stores lots of information that the current administration tried to remove from the Internet. Then again, it could be a "researcher", or just someone seeing if it can be done. Perhaps they will decide what they want to do after their attack succeeds.
- incompatible 7y ago
  Perhaps countries that have already blocked the Internet Archive? But Tor users can already access it through Tor without a hidden service. If the IA itself was DoSed then wouldn't your relay stop working?
  - gruez 7y ago
    random guess: the servers are reached via anycast. if you DDoS from the US, you'll take down access from the US, but not from other regions.
    - oofabz 7y ago
      It's not much of a DDoS if it's from a single country.
      - az656 7y ago
        That’s pretty invalid — I often see large attacks that are almost entirely made up of bots from one country.
        lima 7y ago
        I've even seen 100+ Gbps from a single ASN in a single country.
    - az656 7y ago
      Isn’t the point of anycast to absorb the brunt of the attack? If your traffic is localized, maybe dropping the announcement for that PoP would be useful.
- aasasd 7y ago
  Now we have a mystery of why Frenchmen had to use Tor to read the Internet Archive.

Nextgrid 7y ago

From what I understand the DDoS is necessary to force the Tor daemon to choose a new guard which is what they need for their attack. As far as deanonymizing it goes, one theory could be that it’s an automated process that crawls the open web for onion links and tries to deanonymize them all.

jimrandomh 7y ago

If they want to find out whether a deanonymization technique works, they would choose a target whose identity and location is already known, so that they can confirm that the attack produced the right answer.

hackerfactor1 7y ago

I don't know this attacker's reason. I only see the attack. But I can offer some baseless suspicions: I'm forwarding traffic from Tor to the Internet Archive. During the last French election, someone DoS'ed most of their media outlets. As a result, lots of French people used Tor to access the current news from the Internet Archive's collection. Shortly after that, someone tried to DDoS my onion service. With all of the voting and elections and the impeachment vote coming up, I'm expecting attacks since the Internet Archive stores lots of information that the current administration tried to remove from the Internet. Then again, it could be a "researcher", or just someone seeing if it can be done. Perhaps they will decide what they want to do after their attack succeeds.

incompatible 7y ago
Perhaps countries that have already blocked the Internet Archive? But Tor users can already access it through Tor without a hidden service. If the IA itself was DoSed then wouldn't your relay stop working?
- gruez 7y ago
  random guess: the servers are reached via anycast. if you DDoS from the US, you'll take down access from the US, but not from other regions.
  - oofabz 7y ago
    It's not much of a DDoS if it's from a single country.
    - az656 7y ago
      That’s pretty invalid — I often see large attacks that are almost entirely made up of bots from one country.
      - lima 7y ago
        I've even seen 100+ Gbps from a single ASN in a single country.
  - az656 7y ago
    Isn’t the point of anycast to absorb the brunt of the attack? If your traffic is localized, maybe dropping the announcement for that PoP would be useful.
aasasd 7y ago
Now we have a mystery of why Frenchmen had to use Tor to read the Internet Archive.