4 ms·

I cannot imagine a way in which a single-server hidden service is safe from a global, active adversary like FBI, NSA & Friends. This [1] discusses passive anal

I cannot imagine a way in which a single-server hidden service is safe from a global, active adversary like FBI, NSA & Friends. This [1] discusses passive analysis over time. Isn't it really easy to locate one if you can perform active attacks on the global infrastructure? (introduce latencies and/or break links temporarily) If your hidden service is served by a couple of mirrors on each continent, though... then maybe you're safe? edit: This is a genuine question, not a rhetorical one. Am I missing something? [1] http://www.onion-router.net/Publications/locating-hidden-servers.pdf http://www.onion-router.net/Publications/locating-hidden-ser...

avn2109 12y ago
Good point. Noises have been made for a long time that Tor is compromised given a sufficiently motivated adversary. For instance, [0], among many others. In light of those noises, my non-rhetorical question is this: Why would any Ulbright wannabe reside within the US DoJ's sphere of influence? Get thee to Russia, and quickly! And while you're at it, keep your hardware in some third, fourth, and fifth locations, neither American nor Slavic. [0] https://www.schneier.com/blog/archives/2013/08/has_tor_been_co.html https://www.schneier.com/blog/archives/2013/08/has_tor_been_...
- yourad_io 12y ago
  > Why would any Ulbright wannabe reside within the US DoJ's sphere of influence? Get thee to Russia, and quickly! 100% agree with this. I imagine it is mostly that people never think they'll get caught - or they view the risk of getting caught as much lower than the benefit of not moving, in any case. Edit 1: To add: I think "people" also underestimate just how easy it is to get caught. Getting caught doesn't mean you're stupid, or inexperienced, or anything except that you slipped once. You forgot the proxy, once. You sent your personal pubkey your rather your darknet pubkey, once. It takes next to nothing at all to get caught. Edit 2: The link you posted was about a javascript 0day exploit in the Tor Browser Bundle. Implementation flaws will always be there, but if the theory is broken as well... My question is about if the tor protocol itself could theoretically shield a hidden service from a global, active adversary. Which I think it couldn't.
  - pcthrowaway 12y ago
    Hopefully anyone doing this in the future would be doing so only from Tails and public internet cafes
- rhino369 12y ago
  Russia has its own war on drugs and if you think the USA is a police state, just LOL at Russia. Their version of the speaker of the house said that drug dealers should be thrown into forced labor camps. I'd go to Abu Dabi or Dubai and just be prepared to bribe the fuck out of local police.
jim_dnaley 12y ago
IIRC, Silk Road 1.0 (is this what we're calling it now?) had mirroring servers. As we know, somehow the IP of the main server was leaked, whether through the CAPTCHA or by other means. Security by obscurity always fails - especially against the FBI. Given that Tor is essentially an obscuring mechanism for servers that have to function to some degree on the clearnet, if the FBI really wants to find a hidden service there are apparently many points of failure to exploit. However, given that Ulbricht and now Benthall both had poor OpSec, criminals on the internet have as a last resort the ability to have no identifying information on their servers, even if their servers get owned.
- yourad_io 12y ago
  I'm not sure "security by obscurity" applies to Tor, even in the context that you mean (which I understood as the routing-to-hidden-services bit of it, rather than Tor in its entirety). Based on the info and understanding I currently have, the only information that can be used to track a hidden service is, basically, uptime* . If you own a significant percentage of both the network (Tor), and its carrier (Internet), you can start introducing latencies at will to exclude routes. That will basically allow you to find the IP by elimination. As a passive adversary, you have to do the above passively - meaning loads of accurate uptime/time data for the hidden service, which you'd then have to correlate with known outages in various sections of the internet, yada yada. Passively it could take forever. Security by obscurity is when the process being kept secret is the duct tape making it "secure" (think XORing against a fixed key and calling it "encryption"). This clearly not the case here, but rather that the protocol cannot protect a single server hidden service on an adversarial carrier network. I can't imagine a HS with mirrors in 10-20 different DCs would be susceptible even with active capabilities. > have to function to some degree on the clearnet How so? They certainly don't have to, and AFAIK "marketplaces" don't. * I'm obviously not counting leaking the native IP through the app layer, which is what the FBI claims happened with "Silk Road 1.0" (yes, I think this is what it's called now. Who got dibs on the silk road 2.0 name, and how?) If not eliminate to just one IP, at least eliminate to few enough that you can DDoS them and see what happens to the HS.
Absentinsomniac 12y ago
So, it seems possible to build a p2p based market. I'm pretty sure I read something about there already being one. Like, a distributed network based market where sales and buys are processed by users, much in the way bitcoin does, or torrenting. Then the network could be accessed by clients, even web based ones. Perhaps. Like i2p based markets? Which can even be accessed over tor?
- aaren 12y ago
  like this? https://openbazaar.org/ https://openbazaar.org/
  - Absentinsomniac 12y ago
    Holy shit, thanks for linking that. That's pretty awesome.
  - synchronise 12y ago
    BitXBay is another concept, using Bitmessage as its primary protocol. https://github.com/bitxbay/BitXBay https://github.com/bitxbay/BitXBay
mpyne 12y ago
> Isn't it really easy to locate one if you can perform active attacks on the global infrastructure? (introduce latencies and/or break links temporarily) Seems like it wouldn't even take too long if you apply the same type of logic that makes binary search O(log n), even with mirrored servers. And as long as you don't need perfection (i.e. just to narrow to a list of candidates for further inspection) then mixing that with Bayesian statistics would probably work wonders too.
Nursie 12y ago
I wonder if the next step in service hiding is to do this on a service more like freenet? I haven't checked the status of the project in a long time, but one of freenet's features was distributed hosting, with encryption making sure that nodes could not inspect their own content. I don't think you can do a lot more than disseminate documents that way though, rather than actually useful sites...

avn2109 12y ago

Good point. Noises have been made for a long time that Tor is compromised given a sufficiently motivated adversary. For instance, [0], among many others. In light of those noises, my non-rhetorical question is this: Why would any Ulbright wannabe reside within the US DoJ's sphere of influence? Get thee to Russia, and quickly! And while you're at it, keep your hardware in some third, fourth, and fifth locations, neither American nor Slavic. [0] https://www.schneier.com/blog/archives/2013/08/has_tor_been_co.html https://www.schneier.com/blog/archives/2013/08/has_tor_been_...

yourad_io 12y ago
> Why would any Ulbright wannabe reside within the US DoJ's sphere of influence? Get thee to Russia, and quickly! 100% agree with this. I imagine it is mostly that people never think they'll get caught - or they view the risk of getting caught as much lower than the benefit of not moving, in any case. Edit 1: To add: I think "people" also underestimate just how easy it is to get caught. Getting caught doesn't mean you're stupid, or inexperienced, or anything except that you slipped once. You forgot the proxy, once. You sent your personal pubkey your rather your darknet pubkey, once. It takes next to nothing at all to get caught. Edit 2: The link you posted was about a javascript 0day exploit in the Tor Browser Bundle. Implementation flaws will always be there, but if the theory is broken as well... My question is about if the tor protocol itself could theoretically shield a hidden service from a global, active adversary. Which I think it couldn't.
- pcthrowaway 12y ago
  Hopefully anyone doing this in the future would be doing so only from Tails and public internet cafes
rhino369 12y ago
Russia has its own war on drugs and if you think the USA is a police state, just LOL at Russia. Their version of the speaker of the house said that drug dealers should be thrown into forced labor camps. I'd go to Abu Dabi or Dubai and just be prepared to bribe the fuck out of local police.

jim_dnaley 12y ago

IIRC, Silk Road 1.0 (is this what we're calling it now?) had mirroring servers. As we know, somehow the IP of the main server was leaked, whether through the CAPTCHA or by other means. Security by obscurity always fails - especially against the FBI. Given that Tor is essentially an obscuring mechanism for servers that have to function to some degree on the clearnet, if the FBI really wants to find a hidden service there are apparently many points of failure to exploit. However, given that Ulbricht and now Benthall both had poor OpSec, criminals on the internet have as a last resort the ability to have no identifying information on their servers, even if their servers get owned.

yourad_io 12y ago
I'm not sure "security by obscurity" applies to Tor, even in the context that you mean (which I understood as the routing-to-hidden-services bit of it, rather than Tor in its entirety). Based on the info and understanding I currently have, the only information that can be used to track a hidden service is, basically, uptime* . If you own a significant percentage of both the network (Tor), and its carrier (Internet), you can start introducing latencies at will to exclude routes. That will basically allow you to find the IP by elimination. As a passive adversary, you have to do the above passively - meaning loads of accurate uptime/time data for the hidden service, which you'd then have to correlate with known outages in various sections of the internet, yada yada. Passively it could take forever. Security by obscurity is when the process being kept secret is the duct tape making it "secure" (think XORing against a fixed key and calling it "encryption"). This clearly not the case here, but rather that the protocol cannot protect a single server hidden service on an adversarial carrier network. I can't imagine a HS with mirrors in 10-20 different DCs would be susceptible even with active capabilities. > have to function to some degree on the clearnet How so? They certainly don't have to, and AFAIK "marketplaces" don't. * I'm obviously not counting leaking the native IP through the app layer, which is what the FBI claims happened with "Silk Road 1.0" (yes, I think this is what it's called now. Who got dibs on the silk road 2.0 name, and how?) If not eliminate to just one IP, at least eliminate to few enough that you can DDoS them and see what happens to the HS.

Absentinsomniac 12y ago

So, it seems possible to build a p2p based market. I'm pretty sure I read something about there already being one. Like, a distributed network based market where sales and buys are processed by users, much in the way bitcoin does, or torrenting. Then the network could be accessed by clients, even web based ones. Perhaps. Like i2p based markets? Which can even be accessed over tor?

aaren 12y ago
like this? https://openbazaar.org/ https://openbazaar.org/
- Absentinsomniac 12y ago
  Holy shit, thanks for linking that. That's pretty awesome.
- synchronise 12y ago
  BitXBay is another concept, using Bitmessage as its primary protocol. https://github.com/bitxbay/BitXBay https://github.com/bitxbay/BitXBay

mpyne 12y ago

> Isn't it really easy to locate one if you can perform active attacks on the global infrastructure? (introduce latencies and/or break links temporarily) Seems like it wouldn't even take too long if you apply the same type of logic that makes binary search O(log n), even with mirrored servers. And as long as you don't need perfection (i.e. just to narrow to a list of candidates for further inspection) then mixing that with Bayesian statistics would probably work wonders too.

Nursie 12y ago

I wonder if the next step in service hiding is to do this on a service more like freenet? I haven't checked the status of the project in a long time, but one of freenet's features was distributed hosting, with encryption making sure that nodes could not inspect their own content. I don't think you can do a lot more than disseminate documents that way though, rather than actually useful sites...