4 ms·

Someone Is Crawling TorHS Directories: Honeypot

112 points by lelf 12y ago

willvarfar 12y ago
> Setup inetd on port 80 executing a small shell script /usr/local/bin/honeypot.sh Just curious if this was vulnerable to shellshock?
deleted 12y ago
[deleted]
wowaname 12y ago
Old.
- legutierr 12y ago
  Yes, but relevant given recent events: https://news.ycombinator.com/item?id=8580131 https://news.ycombinator.com/item?id=8580131
MichaelGG 12y ago
Why must this be malicious? It could be a researcher, or someone interested in building a hidden service index, etc.
- eksith 12y ago
  I was thinking the same thing. In the reply too, this is mentioned : https://lists.torproject.org/pipermail/tor-talk/2014-September/034752.html https://lists.torproject.org/pipermail/tor-talk/2014-Septemb... you shouldn't assume HSDir is private in any case; and if enumeration is truly a concern, fast flux onions is a thing. these are location hidden, not existence hidden :)
  - userbinator 12y ago
    Indeed, it could just be someone trying to make the equivalent of a search engine. Perhaps these "fast flux onions" should be called "green onions". :)
    - meowface 12y ago
      Not "could", more like "probably is". There are myriad researchers and enthusiasts who crawl hidden services. You can find a bunch on Twitter and reddit. This is very likely not related to Op Onymous.
- baddox 12y ago
  > To know about such TorHS address the attacker must be running a malicious Tor Relay acting as a TorHS Directory, with Tor's code modified to dump from the RAM memory the TorHS list, then harvest them with an http client/script/crawler. Given that, I think a case could be made that even doing this for research is acting in bad faith, if not "malicious."
  - patzerhacker 12y ago
    Tor hidden services announce their existence to their introduction points. The fact that they exist is not something Tor tries to hide. What they do try to hide is the location of these services. Basically, if you don't want people to know that you're running a service over Tor then you're relying on a guarantee that isn't there. If you want to hide your location while announcing that you're running a service then you're relying on a guarantee that Tor actually claims to provide. If this is research then given the above how is it "in bad faith" or "malicious"?
yc1010 12y ago
I had another thought about how the hidden tor sites were found, they were all using Bitcoin what if they were traced via the ip addresses of transactions being issued by their servers running bitcoin deamon?
- nikcub 12y ago
  A few darknet markets were exposed using this method some time ago (as well as other IP leaks, such as email headers). It is the type of leak that gets picked up by curious researchers within hours/days of a market launching - not something that would linger for months and be left for the FBI.
danbruc 12y ago
Here [1] is some research on enumerating hidden services. It would be shocking to me if no one would regularly enumerate hidden services given how cheap it may be. We have demonstrated that collecting the descriptors of all Tor hidden services is possible in approximately 2 days by spending less than USD 100 in Amazon EC2 resources. As far as I know this will no longer work because Tor implemented appropriate changes but there are probably other ways to do it. [1] http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf

112 points by lelf 12y ago

> Setup inetd on port 80 executing a small shell script /usr/local/bin/honeypot.sh Just curious if this was vulnerable to shellshock?

deleted 12y ago

[deleted]

wowaname 12y ago

Old.

legutierr 12y ago
Yes, but relevant given recent events: https://news.ycombinator.com/item?id=8580131 https://news.ycombinator.com/item?id=8580131

MichaelGG 12y ago

Why must this be malicious? It could be a researcher, or someone interested in building a hidden service index, etc.

eksith 12y ago
I was thinking the same thing. In the reply too, this is mentioned : https://lists.torproject.org/pipermail/tor-talk/2014-September/034752.html https://lists.torproject.org/pipermail/tor-talk/2014-Septemb... you shouldn't assume HSDir is private in any case; and if enumeration is truly a concern, fast flux onions is a thing. these are location hidden, not existence hidden :)
- userbinator 12y ago
  Indeed, it could just be someone trying to make the equivalent of a search engine. Perhaps these "fast flux onions" should be called "green onions". :)
  - meowface 12y ago
    Not "could", more like "probably is". There are myriad researchers and enthusiasts who crawl hidden services. You can find a bunch on Twitter and reddit. This is very likely not related to Op Onymous.
baddox 12y ago
> To know about such TorHS address the attacker must be running a malicious Tor Relay acting as a TorHS Directory, with Tor's code modified to dump from the RAM memory the TorHS list, then harvest them with an http client/script/crawler. Given that, I think a case could be made that even doing this for research is acting in bad faith, if not "malicious."
- patzerhacker 12y ago
  Tor hidden services announce their existence to their introduction points. The fact that they exist is not something Tor tries to hide. What they do try to hide is the location of these services. Basically, if you don't want people to know that you're running a service over Tor then you're relying on a guarantee that isn't there. If you want to hide your location while announcing that you're running a service then you're relying on a guarantee that Tor actually claims to provide. If this is research then given the above how is it "in bad faith" or "malicious"?

yc1010 12y ago

I had another thought about how the hidden tor sites were found, they were all using Bitcoin what if they were traced via the ip addresses of transactions being issued by their servers running bitcoin deamon?

nikcub 12y ago
A few darknet markets were exposed using this method some time ago (as well as other IP leaks, such as email headers). It is the type of leak that gets picked up by curious researchers within hours/days of a market launching - not something that would linger for months and be left for the FBI.

danbruc 12y ago

Here [1] is some research on enumerating hidden services. It would be shocking to me if no one would regularly enumerate hidden services given how cheap it may be. We have demonstrated that collecting the descriptors of all Tor hidden services is possible in approximately 2 days by spending less than USD 100 in Amazon EC2 resources. As far as I know this will no longer work because Tor implemented appropriate changes but there are probably other ways to do it. [1] http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf