How strong is the anonymity of a hidden service compared to an average Tor client? How much easier is it to learn the Hidden Service's IP address?

Question

Another way of putting this: How hard would it be to de-anonymize a hidden service? By "de-anonymize" I mean revealing the IP address of whatever server the hidden service is hosted on. Of course, this wouldn't necessarily mean revealing the identity of the person who is running the server (or paying someone to run the server). And there are other complications: it could be running on a VPS, and so on.

But I don't want to over-complicate this. The question is, how easily could an attacker find out the IP address of a hidden service compared to finding a Tor user's IP?

I am assuming that this blog post is still accurate in describing some of the current problems with hidden services that need to be addressed.

Answer 1

Alaf's answer is a good start. Describing all known attacks on Tor and how they apply to hidden services is a broad task and not really suited for a little text box here. :)

But I'll give you an example. If I run a middle relay (neither a Guard nor an Exit), then I can visit your hidden service over and over and eventually you will use my relay in one of the circuits you make to answer my requests. That won't tell me where you are, because there's still another relay in the way. And that's exactly what guards are for: https://www.torproject.org/docs/faq#EntryGuards

This attack is described in more detail in http://freehaven.net/anonbib/#hs-attack06

This attack works better on hidden services than on normal Tor users, because I can control the rate at which the hidden service makes new circuits (whereas for normal Tor users I typically have to wait until they choose to make another circuit).

Then the question is: how do I use knowledge of your guard relays to deanonymize you? One answer is to break into the guard and/or watch its network. Maybe some large adversaries would find that a reasonable attack.

Another answer is to run a few guards, and wait and be patient. Eventually (meaning months) the hidden service will rotate its guard nodes, and it might pick my guards. Then I can do the attack again and win. Some further reading:

https://blog.torproject.org/blog/research-problem-better-guard-rotation-parameters

http://freehaven.net/anonbib/#wpes12-cogs

http://freehaven.net/anonbib/#ccs2013-usersrouted

Now, this isn't a complete set of possible attacks. Maybe an adversary who finds breaking 1024-bit crypto easy would find it more fun to just break all the layers of crypto (assuming the hidden service hasn't upgraded to Tor 0.2.4.x yet).

Answer 2

Running a hidden service with safety can be really complicated.

Hidden service administrator has to make sure that no application running on the server can be exploited remotely. Α hidden website may be vulnerable to the same threats every other website is. If the software a server uses to show a website is vulnerable, for example apache server or a wordpress installation or the database, then an adversary may use these vulnerabilities to gain access to the server, perhaps get privilege escalation(in many cases that won't be necessary) and finally be able to find your real IP address.

A hidden service may leak various other information that characterize your server and might lead an adversary to the real location of the service. This can be software's versions, encoding, time zone, or even the content itself.

Depending on the resources of the adversary, some adversaries might validate their suspicions about the location of the hidden service, by attacking part of the network the server resides in. Correlating when a certain part of a network is unreachable with the downtime of your hidden service, might indicate the vague location of your hidden service. This may also happen accidentally, when for example your provider has some kind of outage.

Don't forget that a hidden service just as an ordinary user of Tor Browser, makes use of Tor as a client. Using Tor can be easily distinguishable if your connection is under surveillance. Depending on the depth of surveillance, an adversary apart from telling that you're using Tor as a client (adversary can easily tell that you're not a relay by reading the public consensus of Tor), he may use time and data quota correlation for your outgoing traffic.

As a last point, the answer really depends of the resources of the attacker and whether he already has some kind of clue about the Tor user.