4 ms·

Here is a technique that is used to uncover hidden services: 1. purchase VPS products at a bunch of providers who accept bitcoin / crypto 2. ddos your target

Here is a technique that is used to uncover hidden services: 1. purchase VPS products at a bunch of providers who accept bitcoin / crypto 2. ddos your target 3. see if you notice any of your hosted boxes go down 4. once you know the provider pop them (they're usually running some shitty WHMCS or similar homebrew solution, old Cpanel, etc. etc. and they're almost always resellers and amateurs) and move laterally to your target When the feds do it against online drug markets (and they have been for years) they have the bonus of having decent network insight / view by working with backbone providers There is just no way to hide multi-Gb of traffic

deleted 6y ago
[deleted]
londons_explore 6y ago
That's why you split your drug empire into a server for images and static stuff, and another server to run the rest. The server for the rest can be proxied through the image server, and through another tor connection. That way the feds only find your image server...
- pstuart 6y ago
  And perhaps throw some needles of steganography into the haystack.
- wp381640 6y ago
  Most of them do that now - the better markets have gateways that are CAPTCHA'd and spread out over other providers that then proxy to the real hidden service (you can do this with a second step over Tor again) Checkout this project which is now being more widely deployed to prevent a lot of these attacks: https://github.com/onionltd/EndGame https://github.com/onionltd/EndGame
  - chromedev 6y ago
    Pretty cool, but you'd think they would just have a Dockerimage ready to be deployed and a network driver or something similar for these types of challenges.
  - iudqnolq 6y ago
    Hope this password advice isn't taken seriously > TORAUTHPASSWORD - Password which is used for your Tor Control Port Authentication with NGINX. Alphanumeric without spaces (example: passwordIcanremembertyping) > KEY - Alphanumeric Key for the shared front session key. Random between 64-128 would do fine. (example: isthis64charactorsalreadyicantbelieveitwowsocoolwaitnotyetohdarn)
  - anon9001 6y ago
    Very cool. I clicked a bunch of links from there and got to here: https://github.com/mikeperry-tor/vanguards/blob/master/README_SECURITY.md https://github.com/mikeperry-tor/vanguards/blob/master/READM... Good overview of threats.
viraptor 6y ago
Are you really saying that feds DDoS hosting providers and actively hack control panels for lateral access? More than once? Have you got any documented cases of this happening? Because it really sounds... Unlikely.
- kevingadd 6y ago
  Hitting a hosting provider (indirectly) with a ddos for a few minutes doesn't sound that difficult to do, and could easily pass as a routing glitch or something like that. If it's the only way to track down the server it seems reasonable that it would get a rubber stamp approval. After all, who's going to be able to prove the feds did it?
  - viraptor 6y ago
    You too have the capability to do it - should we some it's you? I din't disagree it's viable. Just that the parent said "when feds do it", that's a big leap from "it's possible". How do you know feds do it?
- mschuster91 6y ago
  > and actively hack control panels for lateral access I would definitely see this under the umbrella of various secret agencies, especially those with an "offensive" position in cyber-warfare. You won't ever see any of this documented due to the "parallel construction" method. And for what it's worth, almost all of the Wikipedia content on that one (https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction) deals with DEA usage of this. Besides, the general way of "hacking services to distribute malware" has already been done, most famously in 2013 when the feds burned a Firefox 0-day to unmask a child porn ring: https://krebsonsecurity.com/2013/08/firefox-zero-day-used-in-child-porn-hunt/ https://krebsonsecurity.com/2013/08/firefox-zero-day-used-in...
- matheusmoreira 6y ago
  Why not? They're not above sending literal malware to people's computers in order to compromise them: https://en.wikipedia.org/wiki/Network_Investigative_Technique https://en.wikipedia.org/wiki/Network_Investigative_Techniqu... https://www.eff.org/pages/playpen-cases-frequently-asked-questions https://www.eff.org/pages/playpen-cases-frequently-asked-que... A DoS attack is nothing to these people. The only difference between them and cybercriminals is the fact the law legitimizes their work.

deleted 6y ago

[deleted]

londons_explore 6y ago

That's why you split your drug empire into a server for images and static stuff, and another server to run the rest. The server for the rest can be proxied through the image server, and through another tor connection. That way the feds only find your image server...

pstuart 6y ago
And perhaps throw some needles of steganography into the haystack.
wp381640 6y ago
Most of them do that now - the better markets have gateways that are CAPTCHA'd and spread out over other providers that then proxy to the real hidden service (you can do this with a second step over Tor again) Checkout this project which is now being more widely deployed to prevent a lot of these attacks: https://github.com/onionltd/EndGame https://github.com/onionltd/EndGame
- chromedev 6y ago
  Pretty cool, but you'd think they would just have a Dockerimage ready to be deployed and a network driver or something similar for these types of challenges.
- iudqnolq 6y ago
  Hope this password advice isn't taken seriously > TORAUTHPASSWORD - Password which is used for your Tor Control Port Authentication with NGINX. Alphanumeric without spaces (example: passwordIcanremembertyping) > KEY - Alphanumeric Key for the shared front session key. Random between 64-128 would do fine. (example: isthis64charactorsalreadyicantbelieveitwowsocoolwaitnotyetohdarn)
- anon9001 6y ago
  Very cool. I clicked a bunch of links from there and got to here: https://github.com/mikeperry-tor/vanguards/blob/master/README_SECURITY.md https://github.com/mikeperry-tor/vanguards/blob/master/READM... Good overview of threats.

viraptor 6y ago

Are you really saying that feds DDoS hosting providers and actively hack control panels for lateral access? More than once? Have you got any documented cases of this happening? Because it really sounds... Unlikely.

kevingadd 6y ago
Hitting a hosting provider (indirectly) with a ddos for a few minutes doesn't sound that difficult to do, and could easily pass as a routing glitch or something like that. If it's the only way to track down the server it seems reasonable that it would get a rubber stamp approval. After all, who's going to be able to prove the feds did it?
- viraptor 6y ago
  You too have the capability to do it - should we some it's you? I din't disagree it's viable. Just that the parent said "when feds do it", that's a big leap from "it's possible". How do you know feds do it?
mschuster91 6y ago
> and actively hack control panels for lateral access I would definitely see this under the umbrella of various secret agencies, especially those with an "offensive" position in cyber-warfare. You won't ever see any of this documented due to the "parallel construction" method. And for what it's worth, almost all of the Wikipedia content on that one (https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction) deals with DEA usage of this. Besides, the general way of "hacking services to distribute malware" has already been done, most famously in 2013 when the feds burned a Firefox 0-day to unmask a child porn ring: https://krebsonsecurity.com/2013/08/firefox-zero-day-used-in-child-porn-hunt/ https://krebsonsecurity.com/2013/08/firefox-zero-day-used-in...
matheusmoreira 6y ago
Why not? They're not above sending literal malware to people's computers in order to compromise them: https://en.wikipedia.org/wiki/Network_Investigative_Technique https://en.wikipedia.org/wiki/Network_Investigative_Techniqu... https://www.eff.org/pages/playpen-cases-frequently-asked-questions https://www.eff.org/pages/playpen-cases-frequently-asked-que... A DoS attack is nothing to these people. The only difference between them and cybercriminals is the fact the law legitimizes their work.