Hacker News Reader

Comment by wp381640 | Hacker News Reader

Here is a technique that is used to uncover hidden services:

1. purchase VPS products at a bunch of providers who accept bitcoin / crypto

2. ddos your target

3. see if you notice any of your hosted boxes go down

4. once you know the provider pop them (they're usually running some shitty WHMCS or similar homebrew solution, old Cpanel, etc. etc. and they're almost always resellers and amateurs) and move laterally to your target

When the feds do it against online drug markets (and they have been for years) they have the bonus of having decent network insight / view by working with backbone providers

There is just no way to hide multi-Gb of traffic

View on HN

That's why you split your drug empire into a server for images and static stuff, and another server to run the rest. The server for the rest can be proxied through the image server, and through another tor connection. That way the feds only find your image server...

And perhaps throw some needles of steganography into the haystack.

Most of them do that now - the better markets have gateways that are CAPTCHA'd and spread out over other providers that then proxy to the real hidden service (you can do this with a second step over Tor again)

Checkout this project which is now being more widely deployed to prevent a lot of these attacks:

https://github.com/onionltd/EndGame

Pretty cool, but you'd think they would just have a Dockerimage ready to be deployed and a network driver or something similar for these types of challenges.

Hope this password advice isn't taken seriously

> TORAUTHPASSWORD - Password which is used for your Tor Control Port Authentication with NGINX. Alphanumeric without spaces (example: passwordIcanremembertyping)

> KEY - Alphanumeric Key for the shared front session key. Random between 64-128 would do fine. (example: isthis64charactorsalreadyicantbelieveitwowsocoolwaitnotyetohdarn)

Very cool. I clicked a bunch of links from there and got to here: https://github.com/mikeperry-tor/vanguards/blob/master/READM...

Good overview of threats.

Are you really saying that feds DDoS hosting providers and actively hack control panels for lateral access? More than once? Have you got any documented cases of this happening? Because it really sounds... Unlikely.

Hitting a hosting provider (indirectly) with a ddos for a few minutes doesn't sound that difficult to do, and could easily pass as a routing glitch or something like that. If it's the only way to track down the server it seems reasonable that it would get a rubber stamp approval. After all, who's going to be able to prove the feds did it?

You too have the capability to do it - should we some it's you? I din't disagree it's viable. Just that the parent said "when feds do it", that's a big leap from "it's possible". How do you know feds do it?

> and actively hack control panels for lateral access

I would definitely see this under the umbrella of various secret agencies, especially those with an "offensive" position in cyber-warfare.

You won't ever see any of this documented due to the "parallel construction" method. And for what it's worth, almost all of the Wikipedia content on that one (https://en.wikipedia.org/wiki/Parallel_construction) deals with DEA usage of this.

Besides, the general way of "hacking services to distribute malware" has already been done, most famously in 2013 when the feds burned a Firefox 0-day to unmask a child porn ring: https://krebsonsecurity.com/2013/08/firefox-zero-day-used-in...

Why not? They're not above sending literal malware to people's computers in order to compromise them:

https://en.wikipedia.org/wiki/Network_Investigative_Techniqu...

https://www.eff.org/pages/playpen-cases-frequently-asked-que...

A DoS attack is nothing to these people. The only difference between them and cybercriminals is the fact the law legitimizes their work.

That's not a documented case of DDoSing a company to get location.

They're examples of a US federal agency using malware to compromise the computer systems of suspects and collect evidence to use against them. If they're willing to exploit vulnerabilities in order to break into computers, surely they won't balk at denial of service attacks. They even let the suspect go free in order to avoid revealing the vulnerability they exploited.

Reply on news.ycombinator.com