Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular dark-web hosting provider hacked, 6,500 sites down

zdnet.com

Post reply on HN
Print view View original

81–90 of 160 posts

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#81

Post by busterarm »

kjeetgill wrote: post #77
kryogen1c wrote: post #75

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang. If it was known for a month, it's not an 0day.

Huh, doesn't making it publicly known before patching it in PHP constitute a 0day? Or by unpatched did they mean patched upstream but not here?

This is one that people have been getting wrong for decades.

"A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software)" Patching and knowing about the vulnerability are different things.

And so, this is not 0day.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#82

Post by PeterisP »

kryogen1c wrote: post #75

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang. If it was known for a month, it's not an 0day.

The article does say that it became widely known only the day before the attack.

Day zero starts counting from the time where either the developers/maintainers of the system or the general public are informed about the vulnerability. If the vulnerability has been discussed in some private forums or exploited by a NSA for many years, it doesn't matter, it's still day zero until it goes public (or privately disclosed to, in this case, maintainers of PHP). And as the attack was something like ~24 hours after disclosure, it's close enough to call it a zero-day attack.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#83

Post by dmurray »

Drdrdrq wrote: post #53
dejaime wrote: post #49

Earlier quoted context omitted.

That 30% is clearly a gross estimation, and certainly a wrong one with no data to back it up. Still, even though it is definitely counter productive to host on a widely known host, it still does not expose any users, and that is the main point, not really protecting the host.

Genuinly curious: if you don't protect the host, how can you protect the users? Host has the power to change any content, including BTC addresses, text,...

Not if the content is cryptographically signed by the author, so at least some content can be served safely. I'm not sure if it's possible to have a dynamically generated website that encrypts or signs all content without having the signing key accessible to the host, though.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#84

Post by mirimir »

superkuh wrote: post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

Maybe because they lack the expertise to do it right?

Especially, they arguably lack the expertise to do remote hosting right. Also, as spurgu says, because they don't want stuff hosted locally. And if they thought it through, they wouldn't want the traffic back to their location.

Given all that, they arguably figure that these shared-hosting sites must know what they're doing.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#85

Post by busterarm »

dejaime wrote: post #51

This looks like a good old "Kill the problem and frame him later" type of a take down. The owners (or some users) angered the wrong people, and now they are even the biggest pedos of the whole wide world...

They probably were the biggest pedos in the world. That's the only sane reason to host a platform like this, if you have any sense of self-preservation.

Moreover, its predecessors, Freedom Hosting and Freedom Hosting II, were both the biggest purveyors of CP when they were taken down. If it walks like a duck...

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#86

Post by kodablah »

jamieweb wrote: post #56
kodablah wrote: post #42

Earlier quoted context omitted.

Also, if private keys were obtained, it's trivial to republish to the same onion address with any changes you want. This is that one scenario where an EV cert that can be revoked has value if you're a non-anonymous hoster. There are other alternative-factor identity verification techniques (e.g. DNS, Alt-Svc HTTP header) but the querying aspect reduces anonymity.

With the DNS and Alt-Src, are you saying that the Onion site identity can be verified by visiting the non-onion version of the site, and then relying on the header/DNS record to take the session onto Tor? Then when the onion service private key is breached, the site operator just changes the header and DNS record to a new, non-breached one? As you say though, querying these does reduce anonymity.

Yup (well, automatically with Alt-Svc when using the Tor browser, some kind of manual TXT record I would guess with DNS, I don't know of anything standardized)

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#87

Post by mirimir »

hnphillipj wrote: post #6
superkuh wrote: post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.

OnionShare is a good choice.[0]

However, Tor is vulnerable to traffic analysis. And running a server, adversaries can easily modulate/fingerprint the traffic, which facilitates traffic analysis. If you can see the signal, and have taps on major AS, you can drill down to the server.

0) https://onionshare.org/

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#88

Post by mirimir »

arthurjj wrote: post #32
sp332 wrote: post #30

Earlier quoted context omitted.

In normal Tor usage, the client sends a request through three chosen hops, each of which only knows the previous and next hops, so the entry node doesn't know the destination and the exit node doesn't know where the request originated. But this only hides the client, because the client needs to know the server's address to direct the exit node where to send the request. So to hide the server, there is a symmetrical s…

^ is the most informative comment in the whole thread. So by 'hosting' they mean being the rendezvous address?

No, by "hosting" they mean shared hosting, with multiple .onion sites on one physical server.

Each of those .onion sites would have its own Tor entry guard relays, and would negotiate its own rendezvous points. An .onion service, just like a Tor user, selects a few entry guards that it uses consistently. And gradually replaces with new ones, over some weeks. But rendezvous points get picked fresh for each client-server connection.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#89

Post by jekrb »

dewey wrote: post #11
superkuh wrote: post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

The same reason people host their emails, websites, photos somewhere else or host their infrastructure in the cloud instead of colocating. It’s not hard but just another thing you have to care for when your real focus should be on what you provide not how you provide it.

I mean you should have some focus on how you provide your service. By all means, take advantage of services that make your life easier, but you should at least know how they work on a high level should they ever go down and you need to take more ownership of what you provide.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#90

Post by stjohnswarts »

superkuh wrote: post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

Why not? Just keep a backup like any sane individual.
Post reply on HN