News Feed
  • DrugHub has agreed to fully refund all users who lost money in the SuperMarket exit scam.  
  • Retro Market has gone offline. Circumstances of the closure unknown.  
  • SuperMarket has closed following an exit scam by one of the admins.  
  • The admin of Incognito Market, Pharoah, has been arrested by the FBI several months after exit scamming.  
  • Silk RoadTorhoo mini logo
  • darknet markets list
  • Popular P2P exchange LocalMonero has announced it is closing.  

DDOS against guard nodes? : Tor | Torhoo darknet markets

Does it make sense to DDOS all the nodes in the directory one by one or in batches to determine if any given guard node is connected to a hidden service by observing the hidden service go offline?
/u/conscrpuz
2 points
1 year ago
By default, it uses different guard nodes for the circuits. Also, if you DDOS one of the guard nodes, it could just connect to another guard node.
/u/HiddenSentinel 📢
1 points
1 year ago
Wouldn't that still make the node you attacked suspicious? You can get a list of ip's connected to that server at that time and compare it to another attack in the future when you stumble across the current guard node again?
/u/conscrpuz
2 points
1 year ago*
For the sake of simplicity, I have taken only 3 nodes in hsintro, ignored hsdir, and taken two circuits A->1->2 and B->3->4:-

1) True Positive: You attack node A. The website remains online (due to the circuit B->3->4). It forms new circuits C->5->6 and C>7->8. At no point, does it go offline from the greater tor network (though you could theoretically stop updating the onionsite's directory information).

2) False Negative: Already covered this is in the parent comment.

3) False Positive: You attack node C. For unrelated reasons, node A goes down/the website changes its nodes by itself/the website goes offline, rendering the node 2 unusable. You believe that it was connected to node C despite this not occurring.

4) True Negative: You attack node C. Node A and B remain online. You correctly identify the hidden service as not being connected to node C.

In conclusion, this method has a high probability of failing (I have no desire to calculate the exact chances that this occurs-please do tell if you do the calculations yourself). Also, most guards don't keep logs. Hence, this method is likely to fail.
/u/HiddenSentinel 📢
1 points
1 year ago
Thank you for the insight into your reasoning. In regards to logs the server hosts are not monitoring on their firewalls who's connected to who and when?
/u/HeadJanitor Moderator
1 points
1 year ago
One can overload a node, but doing it one by one may .................... take a long time.