DDOS against guard nodes? : Tor | Torhoo darknet markets
Does it make sense to DDOS all the nodes in the directory one by one or in batches to determine if any given guard node is connected to a hidden service by observing the hidden service go offline?
Wouldn't that still make the node you attacked suspicious? You can get a list of ip's connected to that server at that time and compare it to another attack in the future when you stumble across the current guard node again?
For the sake of simplicity, I have taken only 3 nodes in hsintro, ignored hsdir, and taken two circuits A->1->2 and B->3->4:-
1) True Positive: You attack node A. The website remains online (due to the circuit B->3->4). It forms new circuits C->5->6 and C>7->8. At no point, does it go offline from the greater tor network (though you could theoretically stop updating the onionsite's directory information).
2) False Negative: Already covered this is in the parent comment.
3) False Positive: You attack node C. For unrelated reasons, node A goes down/the website changes its nodes by itself/the website goes offline, rendering the node 2 unusable. You believe that it was connected to node C despite this not occurring.
4) True Negative: You attack node C. Node A and B remain online. You correctly identify the hidden service as not being connected to node C.
In conclusion, this method has a high probability of failing (I have no desire to calculate the exact chances that this occurs-please do tell if you do the calculations yourself). Also, most guards don't keep logs. Hence, this method is likely to fail.
Thank you for the insight into your reasoning. In regards to logs the server hosts are not monitoring on their firewalls who's connected to who and when?
1) True Positive: You attack node A. The website remains online (due to the circuit B->3->4). It forms new circuits C->5->6 and C>7->8. At no point, does it go offline from the greater tor network (though you could theoretically stop updating the onionsite's directory information).
2) False Negative: Already covered this is in the parent comment.
3) False Positive: You attack node C. For unrelated reasons, node A goes down/the website changes its nodes by itself/the website goes offline, rendering the node 2 unusable. You believe that it was connected to node C despite this not occurring.
4) True Negative: You attack node C. Node A and B remain online. You correctly identify the hidden service as not being connected to node C.
In conclusion, this method has a high probability of failing (I have no desire to calculate the exact chances that this occurs-please do tell if you do the calculations yourself). Also, most guards don't keep logs. Hence, this method is likely to fail.