Live data from Hacker News

Popular dark-web hosting provider hacked, 6,500 sites down

zdnet.com

91–100 of 160 posts

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#91
post #53

Earlier quoted context omitted.

Genuinly curious: if you don't protect the host, how can you protect the users? Host has the power to change any content, including BTC addresses, text,...

The hoster certainly has the power to scam people, but he doesn't have the power to deanonymise them.

He does, if he drops phone-home malware. As the FBI has done, at least twice.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#92
post #4

Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.

Why not? Just keep a backup like any sane individual.

Yes, site owners should have maintained backups.

But even with backups, the .onion private key has been compromised, so you can't come back with the same .onion address.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#93
post #9

Earlier quoted context omitted.

How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.

"Tor Hidden Services" are services hosted on the tor network and inaccessible outside it. Hosts are assigned a dns name .onion so clients can connect to that service.

OK, I'm being picky, I know. But the .onion hostname has no relation to DNS. It's just the hash of the site's private key, truncated to 16 characters.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#94
I don't get Daniel Hosting... Why did he offer free hosting? What was the business model? He said, you are not allowed to host illegal content according to German law, i wonder how he managed to maintain this state with 6.5k pages up. In the end it would be quite easy to raid him for some CP, quite a risk for what gain?

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#95
post #38

Earlier quoted context omitted.

^ is the most informative comment in the whole thread. So by 'hosting' they mean being the rendezvous address?

If I'm reading this right, it actually hosted the websites but its IP address was hidden. I don't know if each site maybe got its own IP on the host, because after all I'd think it would be trivial for a customer to upload some code to unmask the host's actual IP. https://web.archive.org/web/20170830191551/https://hosting.d...

If the .onion host is competent, they use iptables to restrict output to the Tor process.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#96
post #36
post #26

Earlier quoted context omitted.

Why do you say that? Genuinely curious. Though I'm not familiar with thttpd or savant, after briefly looking them over they appear to be http servers just like apache or nginx. What would make them more appealing for a dark web host? They dont seem to be particular "dark-web-centric" with what i could read at face value. though most times dark web stuff has tons of other info thats not found 'at face value'...

"Though I'm not familiar with thttpd or savant, after briefly looking them over they appear to be http servers just like apache or nginx." Not your parent, but it wouldn't surprise me to learn that "dark web sites" are using thttpd ... it's a very simple, lightweight, dependable web server. The major downside - the lack of SSL - is perhaps not an issue as you are running over an encrypted channel anyway. If I just ne…

Also, thttpd[0] is fast, doesn't fork, and is resistant to DoS attacks. The downside is that it's no longer in many repositories, and it can be a pain to compile.

0) https://acme.com/software/thttpd/

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#97
post #94

I don't get Daniel Hosting... Why did he offer free hosting? What was the business model? He said, you are not allowed to host illegal content according to German law, i wonder how he managed to maintain this state with 6.5k pages up. In the end it would be quite easy to raid him for some CP, quite a risk for what gain?

Because why not? Not everything is a business and if you believe Tor as a right of privacy in the digital age and you wish to make it available to everyone, why not?

Censorship comes in many forms, and technological literacy in the form of running a LAMP Stack and knowing how to modify apache is slim in the world, php/mysql, forget about it.

6.5K pages is not a lot of data, especially for interactive and probably non-rich dynamic pages. Consider it as a geocities in the 90's.

What probably happen was there was an jail escape that enabled a live shell and that person killed it. From who knows whom -

As for running a tor site, the most suspicious thing about it is being a tor exit node.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#99
post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30% At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki. It's not that you don't know where its hosted , it's that you don't know who is using it or where they are. That includes publishers wi…

In 1998, I think 60% of search results were for GeoCities....

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#100
post #87

Earlier quoted context omitted.

How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.

OnionShare is a good choice.[0] However, Tor is vulnerable to traffic analysis. And running a server, adversaries can easily modulate/fingerprint the traffic, which facilitates traffic analysis. If you can see the signal, and have taps on major AS, you can drill down to the server. 0) https://onionshare.org/

A way I would pinpoint a hidden server would be to monitor different data center regions / networks for outages or congestion, while at the same time looking at the hidden server's ping reply. The response times alone can reveal a lot of information. Once I have the data center, I'm sure the data center admins can see which servers are using Tor, and help with pinpointing it further. No need for taps.
Post reply on HN