Details of a recent FBI operation on mass closure of onion sites — how hidden services are revealed
Details of the closure of the FBI, not only of Silk Road 2.0, but also of more than 400 pages ( 27 sites ), which worked as hidden services on the Tor network, have become known . Last week, Operation Onymous was jointly attended by representatives from 16 European countries, the FBI, and the American Immigration Control Service (ICE).
As a result of the operation, the sites were not only closed, but 17 people associated with them were arrested. Among the closed services were those who organized the drug trade, hired killers and did other interesting things.
The operator of the site Doxbin , a database with personal information that avoided this fate, contacted the developers of the Tor network so that they could figure out a way to protect other members of the network from such attacks. The operator, who calls himself nachash, believes that a DDoS attack was carried out on his site, as a result of which his real IP became known. The site is hosted on the VPN-hosting of the famous German company Hetzner. It also does not exclude an attack that exploits a vulnerability in PHP code.
')
However, during the investigation of the incident, a theory was developed according to which it was not a DDoS attack, but an attempt to pass traffic from the site through as many Tor nodes as possible, while operatives raised the nodes they monitored and tracked traffic. By building a sufficient number of random chains in the Tor network, control over the nodes could lead to the fact that the real IP address of the server became known.
Such a scenario leads to worry all those who advocate for the possibility of network anonymity - journalists, political activists, whistleblowers and other caring citizens who are fighting against despotic regimes. In the meantime, developers digest this alarming information, I want to once again sagitate everyone to join the network and install a relay program to increase the number of nodes and make it difficult to carry out similar attacks on services in the future.
As a result of the operation, the sites were not only closed, but 17 people associated with them were arrested. Among the closed services were those who organized the drug trade, hired killers and did other interesting things.
The operator of the site Doxbin , a database with personal information that avoided this fate, contacted the developers of the Tor network so that they could figure out a way to protect other members of the network from such attacks. The operator, who calls himself nachash, believes that a DDoS attack was carried out on his site, as a result of which his real IP became known. The site is hosted on the VPN-hosting of the famous German company Hetzner. It also does not exclude an attack that exploits a vulnerability in PHP code.
')
However, during the investigation of the incident, a theory was developed according to which it was not a DDoS attack, but an attempt to pass traffic from the site through as many Tor nodes as possible, while operatives raised the nodes they monitored and tracked traffic. By building a sufficient number of random chains in the Tor network, control over the nodes could lead to the fact that the real IP address of the server became known.
Such a scenario leads to worry all those who advocate for the possibility of network anonymity - journalists, political activists, whistleblowers and other caring citizens who are fighting against despotic regimes. In the meantime, developers digest this alarming information, I want to once again sagitate everyone to join the network and install a relay program to increase the number of nodes and make it difficult to carry out similar attacks on services in the future.
Source: https://habr.com/ru/post/356564/
All Articles