I've observed the following:
The Tor client establishes reverse connections to random relays and any further hidden service traffic is tunneled trough these connections.
- There are no new connections that could be rate limited by a firewall.
- It is not easy to monitor the connections for malicious traffic, like an unusual large number of requests from one of the relays.
As security folks will know, layer 7 attacks are anyway difficult to mitigate but how can it be done in this case? How can you detect a flood originating from one of the relays?
The other question is, would it hurt the hidden service functionality or anonymity to ban "misbehaving relays", thus abused circuits temporarily?
And why isn't there any information about this issue on the web? Am I overlooking something?