Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large botnet cause of recent Tor network overload

blog.fox-it.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Large botnet cause of recent Tor network overload

#11

Post by fiatpandas »

brazzy wrote: post #7
jruthers wrote: post #6

I wonder if it is conceivable that a government agency that wouldn't like what Tor offers, could reduce Tor's attractiveness by bombing it from a botnet, much like what they've done by arresting people who host a tor node for traffic that runs across it. With that said, I accept that this is much less likely explanation than just some Russian group just using it to facilitate their usual crime.

So far the new users are showing little activity (according to the article), so that seems unlikely.

I don't think the little activity disproves that theory beyond a reasonable doubt. If it really was a govt agency wanting to flood the network, they may be waiting for a particular event to initiate the flood.

Re: Large botnet cause of recent Tor network overload

#12

Post by eli »

fiatpandas wrote: post #11
brazzy wrote: post #7

Earlier quoted context omitted.

So far the new users are showing little activity (according to the article), so that seems unlikely.

I don't think the little activity disproves that theory beyond a reasonable doubt. If it really was a govt agency wanting to flood the network, they may be waiting for a particular event to initiate the flood.

As is the nature of conspiracy theories, it is impossible to definitively disprove.

Re: Large botnet cause of recent Tor network overload

#13

Post by marshray »

fiatpandas wrote: post #11
brazzy wrote: post #7

Earlier quoted context omitted.

So far the new users are showing little activity (according to the article), so that seems unlikely.

I don't think the little activity disproves that theory beyond a reasonable doubt. If it really was a govt agency wanting to flood the network, they may be waiting for a particular event to initiate the flood.

Anyone with a botnet this large effectively has a kill switch on Tor.

If this botnet actually relies upon Tor for its primary means of C&C, and the botherders are in fact motivated by ordinary financial crime, then it would seem to be the largest botnet that would be least likely to try to shut down Tor.

The most dangerous scenario for Tor is if this botnet continues to grow exponentially, its operators command it to go into an uncontrolled DDoS mode, or some other glitch in its software causes Tor to fall over. The C&C hidden service would become unreachable, the operators could lose control of their botnet, and it could end up essentially stuck in a perma-DoS mode upon itself and Tor.

Re: Large botnet cause of recent Tor network overload

#14

Post by maxk42 »

brazzy wrote: post #7
jruthers wrote: post #6

I wonder if it is conceivable that a government agency that wouldn't like what Tor offers, could reduce Tor's attractiveness by bombing it from a botnet, much like what they've done by arresting people who host a tor node for traffic that runs across it. With that said, I accept that this is much less likely explanation than just some Russian group just using it to facilitate their usual crime.

So far the new users are showing little activity (according to the article), so that seems unlikely.

Unless this is attack on the anonymity of TOR rather than the speed.

Re: Large botnet cause of recent Tor network overload

#15

Post by brazzy »

fiatpandas wrote: post #11
brazzy wrote: post #7

Earlier quoted context omitted.

So far the new users are showing little activity (according to the article), so that seems unlikely.

I don't think the little activity disproves that theory beyond a reasonable doubt. If it really was a govt agency wanting to flood the network, they may be waiting for a particular event to initiate the flood.

If they wanted to flood the network at a particular time, why would they in advance create low-volume traffic that reveals the existence of the botnet?

Re: Large botnet cause of recent Tor network overload

#16

Post by mavhc »

eli wrote: post #12
fiatpandas wrote: post #11

Earlier quoted context omitted.

I don't think the little activity disproves that theory beyond a reasonable doubt. If it really was a govt agency wanting to flood the network, they may be waiting for a particular event to initiate the flood.

As is the nature of conspiracy theories, it is impossible to definitively disprove.

When you eliminate the falsifiable, whatever remains, however improbable, must be a conspiracy theory

Re: Large botnet cause of recent Tor network overload

#17

Post by gwern »

chmike wrote: post #2

Could the anonymity of tor users be compromized by these presumed bots ? As for bitcoin which could be subverted if one users holds more than 50% of the bitcoins.

> As for bitcoin which could be subverted if one users holds more than 50% of the bitcoins.

You're thinking of the 50% attack where you have half the hashing power, not half the bitcoins.

Post reply on HN