I've been researching methods to monitor hidden services for a university project. I came across this paper which talks about injecting relays as hidden service directories to gather onion addresses. To make this affordable, the researchers take advantage of what they call "shadowing".
From the paper:
However, by inspecting the Tor source code we noticed that while only two relays per IP appear in the Consensus, all running relays are monitored by the authorities; more importantly, statistics on them is collected, including the uptime which is used to decide which flags a relay will be assigned.
This would allow them to get the necessary flags to get the HSDir flag for more than two relays on a single IP.
Our approach is based on shadow relays described in the previous section. An attacker can use this artifact of Tor’s design as follows. She can rent 50 IP addresses and run 24 relays on each of them for 25 hours thus running 1200 Tor instances in total; 100 of them should appear in the consensus. The fingerprints of the public keys of the relays should fall into every second gap in the fingerprint circle. At the end of 25 hour time period all of the relays will have HSDir flags but only 100 of them will appear in the consensus and the rest will be shadow relays. The idea is to gradually make active relays unreachable to the Tor authorities so that shadow relays become active and thus gradually cover all gaps in the circular list during 24 hours.
I was wondering if this technique is still possible given that the paper is from 2013 and this might have been patched since then.
Additional question:
Now that the "stable" flag is a requirement to get the HSDir flag, how long does a relay need to run in order to get the HSDir flag?
From the Tor documentation:
"Stable" -- A router is 'Stable' if it is active, and either its Weighted MTBF is at least the median for known active routers or its Weighted MTBF corresponds to at least 7 days.
Does this mean that 7 days of uptime is not a requirement for the "stable" flag?
