News for hackers. Stuff that matters.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by saurik on Wednesday November 21, 2018 @03:01PM (#18505555)
I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance that the traffic was being hosted by this one guy named Daniel?
Re:Popular dark-web hosting provider hacked, 6,500 sites down by syn0byte on Wednesday November 21, 2018 @04:41PM (#18506327)
No. That would be like someone taking GeoCities down in 1998 and claiming you took down 30% of "The Internet. You would have gotten a bunch of stuff, but obviously not 30%

At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki.

It's not that you don't know where its hosted, it's that you don't know who is using it or where they are. That includes publishers with hosted content, even from the host itself. 5Eyes couldn't just drop a tap in front of Danial's Host and see anything useful, just intermediate nodes with no idea what was on the other end. (barring a >51% attack where they own the first and last nodes in the circuit.)

Re:Popular dark-web hosting provider hacked, 6,500 sites down by saurik on Wednesday November 21, 2018 @10:56PM (#18507768)
Your second paragraph is not, in my understanding, the goal of a hidden service: that is merely the goal of Tor itself and would apply to a non-hidden service being accessed via Tor. The goal of the hidden services feature is to allow hosts to have the same level of anonymity as users, making it nearly impossible to shut them down or know where to tap their traffic (for timing attacks).
Re:Popular dark-web hosting provider hacked, 6,500 sites down by na412 on Thursday November 22, 2018 @06:10AM (#18509281)
Onion services can have various goals. Hiding the server is a very common one, but it's not always the case.

For example facebook runs an onion server for their service, they don't need to hide the service itself. So they configure their Tor relays with no anonymity on the service side (HiddenServiceSingleHopMode 1) and get better performance.

Such non-anonymous onion services can have many goals, for example: * Reducing load on Tor exit nodes * Providing users a secure, authenticated connection without depending on the CA system (assuming you got the URL through a secure channel the first time, you know only the key holder can provide service on that host). * NAT traversal for services that otherwise have no need for anonymity

Re:Popular dark-web hosting provider hacked, 6,500 sites down by kodablah on Wednesday November 21, 2018 @10:11PM (#18507643)
> At best they took down 30% of hidden web services with published addresses at aggregator sites like Hidden Wiki

30% is wrong, but there are other ways these metrics [0] are extrapolated [1]. You can see a dip in that first chart, didn't check dates to see if related.

0 - https://metrics.torproject.org/hidserv-dir-onions-seen.html 1 - https://blog.torproject.org/some-statistics-about-onions

Re:Popular dark-web hosting provider hacked, 6,500 sites down by thomasdd on Wednesday November 21, 2018 @10:40PM (#18507712)
Don't confuse, and don't mix .onion domains or hidden services with web-sites running on a hidden service. If a hidden service exist, it don't have to be a website!

Here is your Data about .onion websites: https://www.reddit.com/r/onions/comments/9yfwfb/my_personal_...

About 7000 .onion sites worked before, about 3100 after...

Re:Popular dark-web hosting provider hacked, 6,500 sites down by ryacko on Wednesday November 21, 2018 @08:11PM (#18507308)
In 1998, I think 60% of search results were for GeoCities....
Re:Popular dark-web hosting provider hacked, 6,500 sites down by dejaime on Wednesday November 21, 2018 @03:19PM (#18505716)
That 30% is clearly a gross estimation, and certainly a wrong one with no data to back it up. Still, even though it is definitely counter productive to host on a widely known host, it still does not expose any users, and that is the main point, not really protecting the host.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by thomasdd on Wednesday November 21, 2018 @10:35PM (#18507697)
Here is the Data: https://www.reddit.com/r/onions/comments/9yfwfb/my_personal_...

About 7000 .onion sites worked before, about 3100 after...

Re:Popular dark-web hosting provider hacked, 6,500 sites down by dejaime on Thursday November 22, 2018 @12:31AM (#18508073)
Exactly, all they have is some questionable data about onion links. Onion links is one way of using deep web, one of many.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by Drdrdrq on Wednesday November 21, 2018 @03:52PM (#18505984)
Genuinly curious: if you don't protect the host, how can you protect the users? Host has the power to change any content, including BTC addresses, text,...
Re:Popular dark-web hosting provider hacked, 6,500 sites down by dmurray on Wednesday November 21, 2018 @06:49PM (#18506968)
Not if the content is cryptographically signed by the author, so at least some content can be served safely. I'm not sure if it's possible to have a dynamically generated website that encrypts or signs all content without having the signing key accessible to the host, though.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by pathseeker on Wednesday November 21, 2018 @04:30PM (#18506262)
In this case: protecting the users == hiding their origin
Re:Popular dark-web hosting provider hacked, 6,500 sites down by jstanley on Wednesday November 21, 2018 @04:22PM (#18506221)
The hoster certainly has the power to scam people, but he doesn't have the power to deanonymise them.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by mirimir on Wednesday November 21, 2018 @07:30PM (#18507149)
He does, if he drops phone-home malware. As the FBI has done, at least twice.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by sandworm101 on Thursday November 22, 2018 @12:46AM (#18508123)
That in turn only works where the users havent taken additional steps beyond Tor. Tor was never meant to solve every problem.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by alexanderh on Wednesday November 21, 2018 @03:06PM (#18505603)
doesn't surprise me that the initial layer of obscurity provided by TOR gave people a false sense of security.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by busterarm on Wednesday November 21, 2018 @06:41PM (#18506937)
If you want to serve some content that's illegal and someone a) offers you hosting, and b) doesn't know who you are, then you absolutely host there because it's zero risk to you.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by runn1ng on Thursday November 22, 2018 @12:33AM (#18508080)
If you saw the state of hidden web, you would agree.

There are very few hidden services and most of them are... questionable.

The article cites child porn. That's about right.

Re:Popular dark-web hosting provider hacked, 6,500 sites down by belorn on Thursday November 22, 2018 @04:38AM (#18508958)
Either the HN link has changed or the article has been edited but the word porn is not found in the article.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by pure-awesome on Thursday November 22, 2018 @06:40AM (#18509389)
Weird, you're right.

It definitely referenced it when I first read the article.

I wonder what the motivation would be for removing that reference.

EDIT: Note that I am not user "runn1ng"; I am corroborating what they referenced about the contents of the article

EDIT2: They even mentioned three-or-so specific forums or websites, or something.

Re:Popular dark-web hosting provider hacked, 6,500 sites down by dejaime on Thursday November 22, 2018 @04:07PM (#18512563)
They changed the link. It was pointing to another one that cited this one as the source and added -even more- speculation on top of it.
Re:Popular dark-web hosting provider hacked, 6,500 sites down by dejaime on Thursday November 22, 2018 @04:23PM (#18512668)
Here you go https://nakedsecurity.sophos.com/2018/11/21/hacker-erases-65...

This adds speculation and sensationalism on top of an ill informed article. They even defined it as a 0-day vulnerability, when it is obviously not the case as explained by the article itself. Can't simply trust the quality of the information in there.