Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular dark-web hosting provider hacked, 6,500 sites down

zdnet.com

Post reply on HN
Print view View original

131–140 of 160 posts

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#131

Post by belorn »

runn1ng wrote: post #121
saurik wrote: post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

If you saw the state of hidden web, you would agree. There are very few hidden services and most of them are... questionable. The article cites child porn. That's about right.

Either the HN link has changed or the article has been edited but the word porn is not found in the article.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#132

Post by xena »

mirimir wrote: post #67

If I were going to attempt such an .onion hosting setup, I'd use a couple levels of isolation between users. Maybe setup several KVM domains, to help limit damage from a compromise. And within each domain, put each website in a Docker container. Given a custom Docker-optimized kernel for the host, and XFS storage, I gather that it's possible to set hard limits on CPU, RAM and storage for containers. Given that Docker…

What's stopping you from writing this then?

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#133

Post by bouncycastle »

paulie_a wrote: post #108
excalibur wrote: post #55

My bad. I signed up for my Free Dark Web Scan, and said my name was Philip'); DROP TABLE customers;--

I've done that to sms spammers. I don't know if it worked but I tried ten or so variations. I stopped receiving those messages. I was getting 10 a day at the time. I doubt I actually did any damage but I really hope I did.

Haha! That reminds me of when I once edited my web browser's user agent to something similar, but then I forgot about it. Later, when I was browsing, a lot of the websites just blank screened or returned 500 errors or displayed an SQL error. The other browser worked fine. I finally realized it was my user agent! So yes, a little SQL injection can come up in many unexpected situations as you may have observed :-)

Another time, I set my user agent to an XSS string, just because I was testing something, but forgot to set back. A week later, I noticed that my colleague was baffled by a popup coming up each time he was browsing the logs. Oops, that was my XSS user agent... I'm guessing a lot of places don't sanitize logs.

You'd be amazed how many places these things work :-)

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#134

Post by na412 »

saurik wrote: post #118
syn0byte wrote: post #59

Earlier quoted context omitted.

No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30% At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki. It's not that you don't know where its hosted , it's that you don't know who is using it or where they are. That includes publishers wi…

Your second paragraph is not, in my understanding, the goal of a hidden service: that is merely the goal of Tor itself and would apply to a non-hidden service being accessed via Tor. The goal of the hidden services feature is to allow hosts to have the same level of anonymity as users, making it nearly impossible to shut them down or know where to tap their traffic (for timing attacks).

Onion services can have various goals. Hiding the server is a very common one, but it's not always the case.

For example facebook runs an onion server for their service, they don't need to hide the service itself. So they configure their Tor relays with no anonymity on the service side (HiddenServiceSingleHopMode 1) and get better performance.

Such non-anonymous onion services can have many goals, for example: * Reducing load on Tor exit nodes * Providing users a secure, authenticated connection without depending on the CA system (assuming you got the URL through a secure channel the first time, you know only the key holder can provide service on that host). * NAT traversal for services that otherwise have no need for anonymity

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#135

Post by krageon »

mirimir wrote: post #67

If I were going to attempt such an .onion hosting setup, I'd use a couple levels of isolation between users. Maybe setup several KVM domains, to help limit damage from a compromise. And within each domain, put each website in a Docker container. Given a custom Docker-optimized kernel for the host, and XFS storage, I gather that it's possible to set hard limits on CPU, RAM and storage for containers. Given that Docker…

Containers are not at all a security thing. If you really need that caliber of separation, you are looking at VMs at the very least.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#136

Post by [deleted] »

belorn wrote: post #131
runn1ng wrote: post #121

Earlier quoted context omitted.

If you saw the state of hidden web, you would agree. There are very few hidden services and most of them are... questionable. The article cites child porn. That's about right.

Either the HN link has changed or the article has been edited but the word porn is not found in the article.

[deleted]

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#137

Post by vectorEQ »

siliconunit wrote: post #39
cronix wrote: post #31

Earlier quoted context omitted.

For the same reason why the NSA siphons up all data from the net, encrypted or not, and stores it. They know one day they'll be able to crack todays crypt. Being able to decrypt a backup 5 or 10 years from now will still provide a lot of useful data, whether it came from the darknet or someones icloud backup while it was in transit to Apples servers. Encryption really only protects you from "today", not what will hap…

Just xor bit by bit against real random noise,embed it in a massive stream of other pure random, remember the offset, if it's really that important..

the only proven secure crypto is the one-time pad. rest is all junk relying on computation times to stay 'secure'. and this onee time pad you can never send over a wire to anyone because of chicken-egg problem. so this would be something you would need to exchange offline for decryption to be possible.

if you are not doing that, best stick with known good encryption schemes.

that being said you can implement a lot of encoding schemes like you say in ways that make it arbirarily hard for people to decide what is junk and what is data, to make it nearly impossible to crack especially if you say do that xor with random values etc. because if you'd receive a data intercept you have a hard time to rebuild the data from the junk and then decode it

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#138

Post by pure-awesome »

belorn wrote: post #131
runn1ng wrote: post #121

Earlier quoted context omitted.

If you saw the state of hidden web, you would agree. There are very few hidden services and most of them are... questionable. The article cites child porn. That's about right.

Either the HN link has changed or the article has been edited but the word porn is not found in the article.

Weird, you're right.

It definitely referenced it when I first read the article.

I wonder what the motivation would be for removing that reference.

EDIT: Note that I am not user "runn1ng"; I am corroborating what they referenced about the contents of the article

EDIT2: They even mentioned three-or-so specific forums or websites, or something.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#139

Post by vectorEQ »

jpatokal wrote: post #69
taylorfinley wrote: post #66

Earlier quoted context omitted.

I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?

In theory, but getting that stream of "real random" and above all distributing that one time pad securely to the recipient (chicken, meet egg) so they can read the message make this highly impractical.

dont need the random really. just need an offline method for exchanging the pad :D or just use an unexpected channel like radio or so to send it

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#140

Post by YouKnowBetter »

busterarm wrote: post #81
kjeetgill wrote: post #77

Earlier quoted context omitted.

Huh, doesn't making it publicly known before patching it in PHP constitute a 0day? Or by unpatched did they mean patched upstream but not here?

This is one that people have been getting wrong for decades. "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who would be interested in mitigating the vulnerability (including the vendor of the target software)" Patching and knowing about the vulnerability are different things. And so, this is not 0day.

No idea why you are getting downvoted, since this perfectly acceptable explaination of a 0-day.
Post reply on HN