How to protect a hidden service against DDOS attack?

Question

How to protect a hidden service against DDOS attack? I did some research and found that it is possible to do load balancing with HAProxy. Is there any other solution that could be implemented?

Answer 1

A DDOS attack is a type of cyber-attack that uses multiple compromised systems to target a single system, such as a server or website. The goal of the attack is to make the targeted system unavailable by flooding it with requests from the attacking systems.

There are many ways to protect a hidden service against DDOS attack. One way is to use an anti-DDoS service like Cloudflare, which provides protection for both HTTP and HTTPS traffic. Another way is to use an anti-DDoS solution like Incapsula, which provides protection for HTTP traffic only. .If your hidden service is not using an anti-DDoS solution like Cloudflare, Incapsula, or Sucuri Security the most important thing you can do is to enable a rate limit on the server. In other words, the server should only accept a certain number of requests per second. .Why are there limits on the number of requests per second?As mentioned in the previous question, it is important to limit the number of requests per second for security reasons. If a hidden service gets DDOSed and it does not have a rate limit, then anyone can make an unlimited number of requests and overwhelm the server. . .

How do I set up a rate limit for my hidden service? .-- If you are using port 80, then you can use the standard Apache httpd configuration file to enable a rate limit. For example, add this line in your Apache httpd configuration file: LimitRequestBody 1000000.-- If you are using port 443 (HTTPS), then you should use the mod_security module to limit request rates. For example, add this line in your mod_security configuration file: SecFilterEngine Off SecFilterRule \ "id:'1011' match => string:10 action => 'deny'SecFilterRule \ "id:'1012' match => string:10 action =>

Answer 2

You can use EndGame, which was a system designed to protect Onion Services from DDoS attacks.

• https://github.com/onionltd/EndGame

In May 2020, Onion Ltd released EndGame on GitHub. It uses nginx frontend proxies ("fronts") to put the users in queues and require them to solve a CAPTCHA (generated with python).

After waiting some seconds, the user is presented with a CAPTCHA from one of the fronts. If the user solves the CAPTCHA correctly, then their session is forwarded to the actual Onion Service backend.

If the CAPTCHA works, then the DDoS will be mitigated against the backend, and the Onion Service administrator only needs to scale-up their fronts. EndGame's README recommends at least 3 fronts.

At the time of writing, EndGame is what's used in many popular Onion Services, such as the Elude Tech Collective and the Dread Forums.

EndGame's README says that it helps mitigate DDoS attacks, but that it "isn't perfect" and suggests that the Tor developers add a POW at the introduction point to make Onion Services more DDoS resilient

EndGame isn't perfect. It can't protect against introduction cell type attacks (the Tor project will need to add POW at the introduction points to fix that). But it does provide good protection and scaling which makes it much harder to take you down overall for whatever people throw at you.

source: https://github.com/onionltd/EndGame/blob/master/README.MD

Further Reading

For more information about protecting Onion Services from DDoS attacks, see the following articles published by the Tor Project:

• Jun 2022 https://status.torproject.org/issues/2022-06-09-network-ddos/
• Aug 2020 https://blog.torproject.org/stop-the-onion-denial/
• Jan 2014 https://blog.torproject.org/new-tor-denial-service-attacks-and-defenses/