0

I'm planning on creating a tor hidden service(in the context of a research project) and am wondering how resilient is it against common (D)DoS attacks(i.e. DNS amplification, UDP flood, etc.) given that the real network address of the server is not known to the attacker? Is it possible to limit the number of open connections to the service via tor in order to avoid resource(open sockets/bandwidth) exhaustion?

  • 1
    Limiting the number of allowed connections makes it easier to consume all your connections, and thereby denying your service to others. – Jobiwan Jul 6 '15 at 11:08
  • Then is it possible to set a timeout on each connection so that you can't hold one open indefinitely? – Sebi Jul 6 '15 at 11:09
  • That is up to the server behind your HS. – Jobiwan Jul 6 '15 at 11:11
  • 3
    There is also this: OnionBalance 0.1.1 Alpha- Hidden Service Load Balancing , lists.torproject.org/pipermail/tor-talk/2015-July/038312.html that can be set up and help with the issue, all though it's currently in alpha. – Stig Atle Steffensen Jul 6 '15 at 13:05
  • @ Stig Atle Steffensen Thanks for the link. Do you know of any other current tor related projects that are in the works? – Sebi Jul 6 '15 at 14:41
2

The examples you mention do not apply: Tor only works with TCP streams, not UDP.

It is probably easier to overload the Tor that hosts the Hidden Service than the actual web server behind it, by just creating lots of connections. Setting up a circuit is much more work than serving up a simple web page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.