Can captchas expose hidden services? And how?

Question

I heard that the server location of the Silk Road hidden service was caught by employing an IP leak caused by a Captcha prompt on the site's login page. That got me a little confused. Aren't captchas used to prevent bots and attackers from taking down or harming websites? How could a captcha leak an IP address and be used to track a hidden service's server location? Could a similar method be implimented for other hidden services' captchas or was this just specific to the Silk Road hidden service? (I don't mean just illegal hidden services, just any hidden service in general).

Answer 1

It's not clear if that story is true or not:

https://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/
https://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/

But generally, your onion service can directly leak personal information in two ways:

1. Onion service connects to a third-party server without connecting through Tor. For example reCAPTCHA requires the service itself to connect to reCAPTCHA to verify that the user completed the verification correctly, which the service must make sure to route through Tor or else the reCAPTCHA server will learn the IP address of the onion service.
2. The server software on your onion service may also add personally-identifying information in its responses to user requests, leaking service information to the user. For example, if the server software (or some library/package that the server was using) added its public IP address to a user response.

This is why it's a bad idea to use server software or libraries in your onion service without thoroughly vetting them first. For more information see here and here.