Recently, I have seen more and more forums, image boards, and market places that are shifting to Tor for the safety of their users. This undoubtedly brings the many attackers that dislike these people with them.

This brings me to a simple question, could a person (granted that they have enough bandwidth, and the attack is layer 7) launch a DDoS attack that would be strong enough to bring down a web server, but not slow down the network. How would they do it? I know botnets have run over Tor, and I know that Tor has used in the past to hide DDoS attackers (mainly skids).

In addition, how could someone protect against a DDoS attack within the Tor network? Given the nature of Tor, is it even possible to set up a firewall that would prevent against it?

  • 1
    I don't know but here are some thoughts: If you make a clearnet server also available as a hidden service, then the real IP is known and the best way to attack it is not through Tor. When using Tor to perform a DDoS, you use the exit nodes. My guess is that when you DDoS a hidden service, it would hit the Tor that hosts it way more than the web server behind it and that it would not take much bandwidth, but making lots of connections through different circuits. A firewall will have limited effect as it can not see individual streams and you can not reliably filter on source IP address. – Jobiwan Dec 23 '14 at 21:41
  • I think that depend by the type of ddos attack.. in other words... you can ddos a web server without a lot of bandwidth for example overloading CPU or RAM: for example if you open a connection in stream mode and not in connect mode the server will handle the request until the connection drops out... so you can occupy RAM and CPU because the server is waiting your response.... you can avoid this type of ddos attack by setting a max for incoming connections and the delay time... I hope that this will help you.... PS: in fact web server use this type of connection for the upper cited reason – user3524 Dec 30 '14 at 22:46
  • @Pielco11 hence why I stated that the attack would have to be Layer-7. I am aware of slow, memory consuming attacks such as slowlowris, and I think that this would be an attackers choice when attacking a hidden service. – Aurora Dec 31 '14 at 0:53

Using something like tor's Hammer could may work, however what will work and what won't depends a lot on the target server, Nginx, for example, tends to be able to cope with level 7 attacks much better than Apache or IIS.


Just to be clear, with Level 7 attacks (well the above attack anyway) it's not so much about bandwidth but about resources, Nginx (IIRC, it's been a while since I read the technical info) will drop connections that take a long time, and so go some way to preventing this. Also, depending on how the hidden service is structured, you could (I think, I've not idea how you would go about doing this) prevent/block POST requests, this would also prevent tor's Hammer/slowloris style attacks.

For more info on this type of attack see http://ha.ckers.org/slowloris/

  • I was looking more for how to defend against one, but you get it. – Aurora Jan 2 '15 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.