2

In this forum many user talk about virtualbox,vmware, to isolate the server from the system.And Protecting Hidden services .onion private key from your host its better to store outside from that isolated place what the server is running.But i think it's not enough.Programs like Xampp,Wamp in windows try to install in system drive C:/.With this is the problem if this happend the attacker will acces the system in virtualbox.And they can install more viruses,and backdoor.I think its a way 1. to put the server in a encrypted file (like a VeraCrypt volume,2.Copy this file in the virtual mashine,+ encrypt the virtual mashine too with full disk encryption but with another keys what use the host mashnine.3.Mount this file and run the serven in a non system patrition drive.4 disable USB ports,block drivers,CD,DVD,ports,in virtual mashine block.Turn on network discovery to protect the system to acces back and forth to acces the encrypted virtual system or non system patrition drives.

How can i give more extra protection to protect the system in virtual mashine if the server are cracked like C99 shell,to block the attacker to acces in the operating system in the virtual mashine?

my resoults: Os:Windows 7

Server Xampp for window 7.1.2 / PHP 7.1.2

Tor 0.9.9.10

Run time 3 week

Service: hidden forum

The server installed in a non system patrition drive!!!

The setup:Another programs blocked.Port 80,MSQL allowed,another program activity blocked with firewall.The server installed in a non system patrition drive.Only the MSQL and Apache runned.

The 1. attack: The attackers scanned all bublic and non public URL-s what can accesable from a simple browser.Like server-info,server-status,and defaultly the hidden server information.They can acessed all links what possible available in normal browse without passwords or cracking the server.

The 2. attack: The attackers saved all this page informations and several times goes back some certain links which can contain major information like: User information,website public change information,. They have been saved and fallowed this status.

The 1-2. attack:Some robots constantly but slowly scanned the website.

The 3. attack:Cracking the server.After the first visitor.About 3 week later they have been cracked my server.They uploded a PHP vírus in the phpmyadmin folder.

What did this virus know?: This virus name was c99 shell.And the attacker renamed the file to abc.php They can search and download files not just the server but another patritions,portable usb,pendrive etc.Its have a web interface.Its looks like a website or a browser. Before this happend i enable all the xampp server cache moduls. This virus script upload the attackers through the server.But its somhow can not acessed the system patrition drive.

|improve this question

closed as off-topic by cacahuatl, Jens Kubieziel♦ May 19 '17 at 6:55

  • This question does not appear to be about Tor, within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'm voting to close this question as off-topic because Tor is tangential to the real question, which is: "How do websites get hacked?" – cacahuatl May 18 '17 at 11:47
  • This is how to TOR! HIDDEN SERVICES get hacked and attackers get informations.Its affect all users who run Tor hidden services!Tor hidden services are using encrypted connection,but this way Hackers,NSA,secret services can deanonymize these services.This thing happened in my server.With the first methode possible to track what's happening in the server without cracking it!Like profile information,comment,chat,and other changes.The second was the server cracking and whole system acces.This combination ideal used to attack specialy for encrypted TOR hidden services. – yetikeku May 18 '17 at 16:15
  • There is nothing different as to how onions are hacked as to how normal websites are. This isn't a question about Tor. – cacahuatl May 18 '17 at 20:08
  • 1
    I dont understend in this furum why we can not talk frealy a security issue what affect all TOR users who run a hidden service!This was a special attack combination to deanonymize this encrypted services!Why off topic a hidden service security question?Why can not i public my results from this attack?And why can not ask a simple question like how to can we made it this services more securely?And why i cant public this attacks in this forum which the attackers cracked my server,and track the server? – yetikeku May 19 '17 at 15:12
  • When i installed the server in a non system patrition drive somhow with this C99 shell php script the attackers can not acessed the operating system patrition drive.But they can acessed al another non system patrition,portable HDD,pendrive. – yetikeku May 19 '17 at 15:41
1

The first thing, the internet what your use,how you used, and never strore you self private informations in the server mashine! If someone try deanonymize you they will try get private informations from the server and try to get your internet provider IP address! If you can, do not use that internet access for your own private skype,msn,E-mail,facebook,others.

This attacks,i think It's the simple way to get easy informations,read private msg, and deanonimyze the users and the server administrator,crack not juts the server but the whole system in a hidden service.Tor will protect you to sniffing someone the internet traffic but this thing a big problem. Tor and hidden service will connect to localhost 127.0.0.1.Wamp,Xampp,.In locallhost allow more acess to the system unlike other Ip adress. Its important to set up other IP adress in wm. If you use another wifi like hot spot and not your Internet subscription. It gives the same security, anonymity,like TOR.But its inportant use USB wifi adapter AP,Router,Range extenders are not the best choice.If you use USB adapter all sensytive information are strored in your encrypted PC and not in unencrypted and easy to crackable Router,AP memory.If have another bug in the system this will protect you.If you encrypt the full HDD in a running mashine tourgh USB,CD/DVD,and other ports its possible to acess your system.The WM virtualbox gives you the most inportant protection to protect your system.

|improve this answer
  • Yes with defaultly Tor and the server and users connected together through localhost.The server in localhost allow more functions than another IP adress.Like the PHP admin control panel,and some extra unwanted permissions.The users possible to access with it if the are connect through 127.0.0.1 Ip adress in the server.Its a special connection! – yetikeku May 18 '17 at 16:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.