3

Recently, I have seen more and more forums, image boards, and market places that are shifting to Tor for the safety of their users. This undoubtedly brings the many attackers that dislike these people with them.

This brings me to a simple question, could a person (granted that they have enough bandwidth, and the attack is layer 7) launch a DDoS attack that would be strong enough to bring down a web server, but not slow down the network. How would they do it? I know botnets have run over Tor, and I know that Tor has used in the past to hide DDoS attackers (mainly skids).

In addition, how could someone protect against a DDoS attack within the Tor network? Given the nature of Tor, is it even possible to set up a firewall that would prevent against it?

Improve this question
3
  • 1
    I don't know but here are some thoughts: If you make a clearnet server also available as a hidden service, then the real IP is known and the best way to attack it is not through Tor. When using Tor to perform a DDoS, you use the exit nodes. My guess is that when you DDoS a hidden service, it would hit the Tor that hosts it way more than the web server behind it and that it would not take much bandwidth, but making lots of connections through different circuits. A firewall will have limited effect as it can not see individual streams and you can not reliably filter on source IP address.
    – Jobiwan
    Commented Dec 23, 2014 at 21:41
  • I think that depend by the type of ddos attack.. in other words... you can ddos a web server without a lot of bandwidth for example overloading CPU or RAM: for example if you open a connection in stream mode and not in connect mode the server will handle the request until the connection drops out... so you can occupy RAM and CPU because the server is waiting your response.... you can avoid this type of ddos attack by setting a max for incoming connections and the delay time... I hope that this will help you.... PS: in fact web server use this type of connection for the upper cited reason
    – user3524
    Commented Dec 30, 2014 at 22:46
  • @Pielco11 hence why I stated that the attack would have to be Layer-7. I am aware of slow, memory consuming attacks such as slowlowris, and I think that this would be an attackers choice when attacking a hidden service.
    – Aurora
    Commented Dec 31, 2014 at 0:53

1 Answer 1

Reset to default
1
+50

Using something like tor's Hammer could may work, however what will work and what won't depends a lot on the target server, Nginx, for example, tends to be able to cope with level 7 attacks much better than Apache or IIS.

UPDATE

Just to be clear, with Level 7 attacks (well the above attack anyway) it's not so much about bandwidth but about resources, Nginx (IIRC, it's been a while since I read the technical info) will drop connections that take a long time, and so go some way to preventing this. Also, depending on how the hidden service is structured, you could (I think, I've not idea how you would go about doing this) prevent/block POST requests, this would also prevent tor's Hammer/slowloris style attacks.

For more info on this type of attack see http://ha.ckers.org/slowloris/

Improve this answer
1
  • I was looking more for how to defend against one, but you get it.
    – Aurora
    Commented Jan 2, 2015 at 5:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .