Sophos blog spam for actual ZDNet report from over the weekend: https://www.zdnet.com/article/popular-dark-web-hosting-provi... Maybe a mod can replace the link with the actual source.
PHP zero-day vulnerability.
Popular dark-web hosting provider hacked, 6,500 sites down
61–70 of 160 posts
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#62Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.
It’s not super simple to safely and securely host a hidden service. Not at all.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#63Sophos blog spam for actual ZDNet report from over the weekend: https://www.zdnet.com/article/popular-dark-web-hosting-provi... Maybe a mod can replace the link with the actual source.
Thanks! We've updated the link from https://nakedsecurity.sophos.com/2018/11/21/hacker-erases-65....
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#64You can't ever get anonymous layer 1. To the point of other commenters - percentage figures are unreliable on tor.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#65"30% of the dark web was erased." More like "what was loosely estimated to be 30%"
And 30% of accessible addresses not 30% of traffic.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#66Earlier quoted context omitted.
Just xor bit by bit against real random noise,embed it in a massive stream of other pure random, remember the offset, if it's really that important..
Don't roll your own crypto. If that was much better encryption, everyone would be using it.
I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#67If I were going to attempt such an .onion hosting setup, I'd use a couple levels of isolation between users. Maybe setup several KVM domains, to help limit damage from a compromise. And within each domain, put each website in a Docker container. Given a custom Docker-optimized kernel for the host, and XFS storage, I gather that it's possible to set hard limits on CPU, RAM and storage for containers.
Given that Docker containers rely on kernel namespaces and cgroups for isolation, they're not as secure as using full VMs. But they're far lighter, and much better isolated than these late .onions. Alternatively, one could maybe use FreeBSD jails with Docker.
And about backups. I get his argument for not backing up. But maybe a setup with relatively fast rotation, and thorough deletion of old backups, would be secure enough. I'd use LUKS with dropbear for server FDE. That's still vulnerable, sure, but attackers would need to take some care while impounding the server. Also, I'd keep backups on another server, with only .onion-.onion connections (maybe OnionCat).
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#68"Backups? Forget it. This is the Dark Web. Winzen told ZDNet that there ain’t no such thing as backups on Daniel’s Hosting, by design:" I'm wondering why encrypted backup is not an option for them?
The dark web is designed to be anonymous. Long term persistence of anything that might hold details about the users of the sites are taboo in the extreme. Since this is a hosting provider for the dark web (and one that advertises they don't do backups, logs, etc), they don't know what the content of the sites or databases involve. Keep backups of that content is an additional liability for their business. Site owners…
>Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time.
>loudest 'Amen' in recorded history emanates from my cubicle
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#69Earlier quoted context omitted.
Don't roll your own crypto. If that was much better encryption, everyone would be using it.
I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?
In theory, but getting that stream of "real random" and above all distributing that one time pad securely to the recipient (chicken, meet egg) so they can read the message make this highly impractical.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#70Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.
If you're hosting illegal content, traffic analysis could be used to catch you.
Only illegal content? Of course the legality of the content could vary quite a lot, a Falun Gong[1] site would be 100% legal in Canada, and 100% illegal in the PRC.