I've observed the following:

The Tor client establishes reverse connections to random relays and any further hidden service traffic is tunneled trough these connections.

This means:

  • There are no new connections that could be rate limited by a firewall.
  • It is not easy to monitor the connections for malicious traffic, like an unusual large number of requests from one of the relays.

As security folks will know, layer 7 attacks are anyway difficult to mitigate but how can it be done in this case? How can you detect a flood originating from one of the relays?

The other question is, would it hurt the hidden service functionality or anonymity to ban "misbehaving relays", thus abused circuits temporarily?

And why isn't there any information about this issue on the web? Am I overlooking something?

  • 1
    Possible duplicate of Launching a Distributed Denial of Service attack on a hidden service, (which was found by Googling). Oct 11 '15 at 19:02
  • 1
    This is a question about mitigation!
    – user9609
    Oct 11 '15 at 19:35
  • Yep, understood. One of the sub-questions in that thread concerns mitigation :-) The latter half of the accepted answer mentions Nginx (admittedly briefly - it could probably be fleshed out). Also of use might be the following Tor blog entry, though it's not specific to Layer 7: blog.torproject.org/blog/… Oct 11 '15 at 19:58
  • Unfortunately neither of these posts are addressing what I'm asking for. My question is about monitoring and filtering hidden service requests and not about software you might want to use because it is "resilient". (that's no mitigation at all) Usually you use a firewall to do so, but (considering the reasons I pointed out earlier) this isn't working for hidden services, so I'm asking for a workaround. I hope it's a bit clearer now. Nevertheless, thanks for caring!
    – user9609
    Oct 12 '15 at 1:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.