<story><title>Logs of compromised Tor site released</title><url>https://lists.torproject.org/pipermail/tor-dev/2014-November/007731.html</url></story><parent_chain><item><author>raquo</author><text>Am I understanding this correctly?&lt;p&gt;* Attacker has control of X number of tor nodes&lt;p&gt;* Attacker DDoS-es a hidden service, sending millions of requests to it&lt;p&gt;* Attacker hopes that at least one of these requests will be routed exclusively through their own tor nodes, thus revealing the IP address of the hidden service&lt;p&gt;That sounds neat. Is it a viable way to de-anonimize a hidden service?</text></item></parent_chain><comment><author>AlyssaRowan</author><text>That&amp;#x27;s broadly describing &lt;i&gt;one&lt;/i&gt; possible class of attack. It looks more like a combination of attacks may have been used - traffic confirmation via timing of outages and packets is definitely a strong one, and that&amp;#x27;s what GCHQ&amp;#x27;s QUICKANT was gunning for; ONIONBREATH was targeted at hidden service enumeration and distinguishability, and Tor is seemingly not perfect at that. (I gather HSes were due for an overhaul anyway?)&lt;p&gt;Remember, Tor cannot comprehensively protect against a global passive attacker - which is what GCHQ, DSD, NSA, et al are trying to be, as well as every other kind of attacker of course. (Generally speaking, they try every possible angle at once.)&lt;p&gt;However, they have still not had much success to date identifying &lt;i&gt;users&lt;/i&gt;, especially en masse. We&amp;#x27;re talking here about highly-targeted attacks, combined with a few OPSEC fails.&lt;p&gt;(I still prefer garlic routing in general, but Tor has a huge advantage which has little to do with tech - a massive, diverse userbase to hide amongst.)</text></comment>
<story><title>Logs of compromised Tor site released</title><url>https://lists.torproject.org/pipermail/tor-dev/2014-November/007731.html</url></story><parent_chain><item><author>raquo</author><text>Am I understanding this correctly?&lt;p&gt;* Attacker has control of X number of tor nodes&lt;p&gt;* Attacker DDoS-es a hidden service, sending millions of requests to it&lt;p&gt;* Attacker hopes that at least one of these requests will be routed exclusively through their own tor nodes, thus revealing the IP address of the hidden service&lt;p&gt;That sounds neat. Is it a viable way to de-anonimize a hidden service?</text></item></parent_chain><comment><author>aosmith</author><text>I think you&amp;#x27;re right.  This describes a graph attack that uses a secondary vector of malformed packets to limit other connections.</text></comment>