Re:Popular dark-web hosting provider hacked, 6,500 sites down
by bouncycastle on Wednesday November 21, 2018 @08:12PM
(#18507311)
A way I would pinpoint a hidden server would be to monitor different data center regions / networks for outages or congestion, while at the same time looking at the hidden server's ping reply. The response times alone can reveal a lot of information. Once I have the data center, I'm sure the data center admins can see which servers are using Tor, and help with pinpointing it further. No need for taps.
Re:Popular dark-web hosting provider hacked, 6,500 sites down
by mirimir on Wednesday November 21, 2018 @08:50PM
(#18507413)
Yeah, that too :(
One can route Tor traffic for .onion servers through VPNs, or even through nested VPN chains. That makes it a little harder, because the hosting provider can't easily tell that it's Tor traffic. Also, one can run a private obfsproxy, which isn't listed or indexed by Tor.
However, Tor is vulnerable to traffic analysis. And running a server, adversaries can easily modulate/fingerprint the traffic, which facilitates traffic analysis. If you can see the signal, and have taps on major AS, you can drill down to the server.
0) https://onionshare.org/