6 ms·

If you need a location hidden service it’s wise to run your own guard.

noident 7y ago
Wouldn't your onion service uptime become correlated with the guard's uptime? DDoS probes as described in the OP plus some basic monitoring of known onion sites could discover onions paired with single guard nodes. And if I can become certain that the guard node is owned by the onion operator, you're one subpoena away from deanonymization.
- Astarte 7y ago
  >Wouldn't your onion service uptime become correlated with the guard's uptime? Yes. This is happening on a fairly regular basis. ddos against a tor node in most cases is just trying to figure out someones IP address or guard node. If you run a big darknet site dealing with things like drugs, CP, fraud, and you want to stay around for a while you need to run lots of nodes otherwise you will be pwned probably within hours. There is no point in doing that for legal onions sites like facebook because everyone knows their real operators. Now when you run lots of nodes and at the same time a big website on the darknet you are in the perfect position to run traffic correlation attacks yourself. There is some tutorial available which suggests using some deceptive methods to spoil such tracing efforts. For example when website A is going down you also shut down your site. Or when there is a big blackout of AWS US etc
hackerfactor1 7y ago
Running your own guard is stupid unless you open it for the world to use. If you're the only person using the guard, then the guard offers you zero anonymity. And if lots of people use your guard, then make sure it doesn't violate your ISP's terms of service. (Most ISPs have a clause about residential customers not running public services.) Also, have a plan in place for when (not if) you receive legal notices about copyright infringement, child porn distribution, and other acts that could be criminal in your country/city.
- bureaucrat 7y ago
  Actually it's not like you think. It's OK to use guards for yourself because 1) there are thousands of non-public guards(bridges) 2) you choose the path to the rendezvous point 3) middle nodes don't know the type of the traffic Also there are a few things wrong with your article. And the rendezvous point must be in this list (because you shouldn't have a private rendezvous node). This is not true. The spec does not specify that. Usually Choopa LLC -- a cloud provider that is regularly used by hostile actors. Choopa LLC is not regularly used by hostile actors. You can't say that citing one report. However, the relay, rendezvous, and exit nodes must be publicly known so that lots of Tor traffic will use them. Not true with rendezvous points.
  - xb95 7y ago
    I work on infrastructure at Discord. Our voice and video infrastructure gets attacked quite frequently and we have pretty good tracking about which ASNs the traffic is coming from as part of our mitigation processes. Anyway, Choopa is a common source of DDoS in our reports, so I can corroborate the OP's comment to some degree. They aren't the largest we see, but they're in the top 10 sources for us.
    - az656 7y ago
      As someone who also has similar visibility, I can also vouch for the fact that Choopa has a very lax and unenforced abuse policy.
    - lima 7y ago
      As someone who used to work for a company that hosted large-scale gaming infrastructure, I can confirm that Choopa was a common source of DDoS. DigitalOcean, too, and lots of eyeball providers. Any provider who allows credit card payments has issues with outbound attacks, and some are better at responding quickly than others. It got so bad we ended up building and deploying our own line-rate packet processing engine at our network edge to be able to deal with the weird UDP protocols gaming uses. How much spoofed traffic do you see nowadays?
- 7y ago
mirimir 7y ago
I don't think that's possible. A private/unpublished bridge, yes. But if you just run a relay with ... PublishServerDescriptor 0 ... I don't think that it would get a guard flag, and so your tor client wouldn't use it. But then, I haven't tested that.

Wouldn't your onion service uptime become correlated with the guard's uptime? DDoS probes as described in the OP plus some basic monitoring of known onion sites could discover onions paired with single guard nodes. And if I can become certain that the guard node is owned by the onion operator, you're one subpoena away from deanonymization.

Astarte 7y ago
>Wouldn't your onion service uptime become correlated with the guard's uptime? Yes. This is happening on a fairly regular basis. ddos against a tor node in most cases is just trying to figure out someones IP address or guard node. If you run a big darknet site dealing with things like drugs, CP, fraud, and you want to stay around for a while you need to run lots of nodes otherwise you will be pwned probably within hours. There is no point in doing that for legal onions sites like facebook because everyone knows their real operators. Now when you run lots of nodes and at the same time a big website on the darknet you are in the perfect position to run traffic correlation attacks yourself. There is some tutorial available which suggests using some deceptive methods to spoil such tracing efforts. For example when website A is going down you also shut down your site. Or when there is a big blackout of AWS US etc

hackerfactor1 7y ago

Running your own guard is stupid unless you open it for the world to use. If you're the only person using the guard, then the guard offers you zero anonymity. And if lots of people use your guard, then make sure it doesn't violate your ISP's terms of service. (Most ISPs have a clause about residential customers not running public services.) Also, have a plan in place for when (not if) you receive legal notices about copyright infringement, child porn distribution, and other acts that could be criminal in your country/city.

bureaucrat 7y ago
Actually it's not like you think. It's OK to use guards for yourself because 1) there are thousands of non-public guards(bridges) 2) you choose the path to the rendezvous point 3) middle nodes don't know the type of the traffic Also there are a few things wrong with your article. And the rendezvous point must be in this list (because you shouldn't have a private rendezvous node). This is not true. The spec does not specify that. Usually Choopa LLC -- a cloud provider that is regularly used by hostile actors. Choopa LLC is not regularly used by hostile actors. You can't say that citing one report. However, the relay, rendezvous, and exit nodes must be publicly known so that lots of Tor traffic will use them. Not true with rendezvous points.
- xb95 7y ago
  I work on infrastructure at Discord. Our voice and video infrastructure gets attacked quite frequently and we have pretty good tracking about which ASNs the traffic is coming from as part of our mitigation processes. Anyway, Choopa is a common source of DDoS in our reports, so I can corroborate the OP's comment to some degree. They aren't the largest we see, but they're in the top 10 sources for us.
  - az656 7y ago
    As someone who also has similar visibility, I can also vouch for the fact that Choopa has a very lax and unenforced abuse policy.
  - lima 7y ago
    As someone who used to work for a company that hosted large-scale gaming infrastructure, I can confirm that Choopa was a common source of DDoS. DigitalOcean, too, and lots of eyeball providers. Any provider who allows credit card payments has issues with outbound attacks, and some are better at responding quickly than others. It got so bad we ended up building and deploying our own line-rate packet processing engine at our network edge to be able to deal with the weird UDP protocols gaming uses. How much spoofed traffic do you see nowadays?
7y ago

mirimir 7y ago

I don't think that's possible. A private/unpublished bridge, yes. But if you just run a relay with ... PublishServerDescriptor 0 ... I don't think that it would get a guard flag, and so your tor client wouldn't use it. But then, I haven't tested that.