Are low bandwidth DoS attacks performed over the Tor network a problem to be considered?

Question

For low bandwidth and slow DoS / DDoS attacks (for example Slowloris, SlowLoris and PyLoris) the Tor network seems to be very useful medium. For free it offers two important things to the attacker:

• Nice amount of exit relays
• Anonymity

The low bandwidth attacks do need neither high bandwidth nor low latency which would be problematic for many other types of DoS / DDoS attacks. On the other side the list of exit relays is known so it makes blocking of an ongoing attack easier.

• Is there any other serious obstacle for such attacks over Tor?
• Are there known cases when was the Tor network abused for a successful low bandwidth attack?
• Were any counter-measures against such abuse considered? I can imagine for example limiting number of exit-relays a single Tor client can create circuits to though such a limitation could be overcame by modifying the Tor client or running multiple instances of it.

There is a related question: mitigating anonymous DOS (tor combined with pyloris)

Answer 1

Is there any other serious obstacle for such attacks over Tor?

Many services will automatically block exit nodes, or will be more strict with detecting possible attacks from exit nodes. Even if they are not blocked now, they will be blocked in the future once an attack occurs, screwing over both the attacker and innocent Tor users.

Are there known cases when was the Tor network abused for a successful low bandwidth attack?

Plenty. Since there are utilities which are designed to go over Tor (especially for easy use by script kiddies...), you can bet that this has been done. If it works over a normal network, it works over Tor.

Were any counter-measures against such abuse considered? I can imagine for example limiting number of exit-relays a single Tor client can create circuits to though such a limitation could be overcame by modifying the Tor client or running multiple instances of it.

Low bandwidth DoS attacks are easy to counter in general, such as by changing various timeout parameters. This is commonly done on larger servers, and is easy to implement on smaller ones as well. It largely mitigates these attacks regardless of whether or not they are using Tor.

Answer 2

Tor Network's goal is to provide anonymity and circumvention for the users in need of them. Deploying any kind of attack, is simply abusing the Tor Network. Targets of the attack, or even network providers of the targets, probably will block the exit or all Tor nodes. This would mean seriously degrading the Tor user experience, since they will not be able to access various places in the Internet.

So, all in all, the problem is not the bandwidth. The problem is that an attack is considered and many times proved to be harmful for the Network and it's users.