Background info on the exploit used at: https://antichat.com/threads/463395/#post-4254681
(nb: page is in Russian)
Popular dark-web hosting provider hacked, 6,500 sites down
21–30 of 160 posts
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#22"Backups? Forget it. This is the Dark Web. Winzen told ZDNet that there ain’t no such thing as backups on Daniel’s Hosting, by design:" I'm wondering why encrypted backup is not an option for them?
The dark web is designed to be anonymous. Long term persistence of anything that might hold details about the users of the sites are taboo in the extreme.
Since this is a hosting provider for the dark web (and one that advertises they don't do backups, logs, etc), they don't know what the content of the sites or databases involve. Keep backups of that content is an additional liability for their business.
Site owners for all hosting providers, including when you're running on clouds like AWS, should put thought into their backup strategies independently of guarantees from their provider.
For providers like AWS you will likely use their storage options for backups such as S3, but you are taking a risk especially if you're storing in the same region. Everything in this industry is a series of trade offs, you need to be aware of what trade offs you're making at any given time.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#23s/hidden service/onion service
Pedantic, but is the preferred nomenclature today.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#24Earlier quoted context omitted.
How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.
"Tor Hidden Services" are services hosted on the tor network and inaccessible outside it. Hosts are assigned a dns name .onion so clients can connect to that service.
Is it not fairly trivial to link that to you? How can you make it anonymous?
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#25Earlier quoted context omitted.
How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.
"Tor Hidden Services" are services hosted on the tor network and inaccessible outside it. Hosts are assigned a dns name .onion so clients can connect to that service.
"Web services" are hosted on the internet and inaccessible outside it.
"Chat lines" are hosted on telephone networks and inaccessible outside it.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#26> Winzen said his priority was to do a full analysis of the log files I wouldn't have thought a darkweb hosting service should have any logs?
It's a server just as any server, instead of serving content through apache or nginx, you are more likely to serve it through thttpd or savant.
Why do you say that? Genuinely curious.
Though I'm not familiar with thttpd or savant, after briefly looking them over they appear to be http servers just like apache or nginx.
What would make them more appealing for a dark web host? They dont seem to be particular "dark-web-centric" with what i could read at face value. though most times dark web stuff has tons of other info thats not found 'at face value'...
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#27Earlier quoted context omitted.
"Tor Hidden Services" are services hosted on the tor network and inaccessible outside it. Hosts are assigned a dns name .onion so clients can connect to that service.
Is it not fairly trivial to link that to you? How can you make it anonymous?
Only if you're omniscient in the network. No single node knows what traffic it's carrying, or that the next node the traffic is meant to be sent to is the final one.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#28> Winzen said his priority was to do a full analysis of the log files I wouldn't have thought a darkweb hosting service should have any logs?
It wouldn't surprise me if this was limited to system logs and simple request logs. All the source IPs coming from Tor gateways are going to be from localhost. By default in Apache and Nginx logs also include the user agent but diligent dark web operators disable that.
System logins, auditd, supporting services logs, etc all may provide clues as to what happened.
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#29Man, why do people insist on using others to host their tor hidden services? It seems like the last thing you'd want or need to do. It's super simple to set up a hidden service from your home computer and host. I've been putting all my clear web sites on tor as well for years. Lots of bot traffic but never any problems and plenty of real traffic too.
How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.
Onion (née hidden) services are easily hosted from any computer, even behind a NAT/ISP due to how it publishes its descriptor and relies on reachable relays for rendezvous. It's easy with the Tor executable and a torrc file, there are plenty of guides out there.
Even though you're new to all this, for others wanting to do this programmatically, there is Stem for Python and I've written one for Go [0]. It's such an easy self-hosting NAT traversal technique, I'm surprised it's not used more often in situations not requiring great bandwidth/latency (e.g. p2p chat).
Re: Popular dark-web hosting provider hacked, 6,500 sites down
#30Earlier quoted context omitted.
"Tor Hidden Services" are services hosted on the tor network and inaccessible outside it. Hosts are assigned a dns name .onion so clients can connect to that service.
Is it not fairly trivial to link that to you? How can you make it anonymous?
In normal Tor usage, the client sends a request through three chosen hops, each of which only knows the previous and next hops, so the entry node doesn't know the destination and the exit node doesn't know where the request originated. But this only hides the client, because the client needs to know the server's address to direct the exit node where to send the request. So to hide the server, there is a symmetrical setup with three extra hops on the server's side, and a published "rendezvous" address in the middle. So the server connects to the rendezvous without revealing its real IP, and the client can direct requests to the rendezvous without knowing the server's IP.