Thoughts and Concerns about Operation Onymous

What happened





How did they locate the hidden services?



Operational Security


SQL injections


Bitcoin deanonymization



Attacks on the Tor network







Advice to concerned hidden service operators





Final words









November 09, 2014


Too much Inertia hurts us all...

Tor Project is soo focused on Tor Tor Tor, Tor is great, we're 501c3, world peace, blah blah blah. Over FIFTEEN years of Tor totally focused on one particular narrow anonymity design, it's own onion routing.

The anonymity community seriously needs to all step the fuck back from their own pet projects, literally sit their asses the fuck down at a roundtable at some con and seriously ask themselves the following:


Tor, Freenet, I2P, Gnunet, Maidsafe, Retroshare, Bitcoin, etc, etc, everyone just STOP, sit the fuck down with everyone else, and rip things apart, put things together, whiteboard that shit... whatever. But for the love of god, don't keep going forward with broken crap just because it's your pet project or the best you think there is.

This is not claiming any project is broken, but that there are all sorts of technologies that need to be fronted, reviewed, ranked, sorted, and plugged and played and layered and interleaved.

You don't do that while head down in your own little projects. And that sux for anonymity. 2015... the year of the global anonymity summit, review, realignment and rework. Make it happen.

Agree,.There's some decent intelligence about how to do the whole anonymous thing properly and correctly in those groups and it's high time they got together and did just that. Waiting to see how the different sources managed to locate HS owners is not going to get publicised so stop kidding yourselves if you think its going to happen. There appears to be disquiet growing that Tor is now fallible and whilst this may or may not be true wth the latest takedown it doesn't do anyone any favors. Work it out and make anonymous exactly that.

Before you go criticizing Tor why don't you do actual research into how Tor and other anonymity systems work. Yes, there are flaws; some of the design choices limit usability or pose security threats. Yes, some of the side effects of the design choices were unknown when they were made. That doesn't necessarily mean that different decisions would be made if the present knowledge was known. Tor isn't perfect; it's impossible to design a system to give you perfect anonymity in communication without risk of attack, let alone to use the underlying system of the internet which doesn't promote anonymity and actually implement that.

The goal isn't to achieve perfection: that's impossible; the goal is simply to do the best they can. With that said, like any other piece of software it works best if used properly. In the past authorities were able to unmask both simple users and hidden services because they did something stupid. If you want to remain anonymous, you need to know how to use Tor safely. Read as much documentation as you can. As a plus, when you complain about how something needs to work differently in Tor you can give a specific example.


November 10, 2014


"low-latency web services is a very hard problem"

With present tor architecture this problem will be persistent.

Therefore tor netdata flow really needs some kind of permanent blank white noise
net traffic?


November 10, 2014


If "Tor currently doesn't have funding for improving the security of hidden services", is possible to do like wikipedia, put on the top of every page on a message for funding.
Wikipedia wrote that it has no adv, but to survive need x dollars (and Wikipedia obtain milions of dollars).
Tor can write: to improve security for hidden service we need x dollars and make a list of payment methods.

An alternative can be a crowdfunding site.

What do you think about this? Is possible?

May I ask a question. Is this possible?

1. Create a list of hidden services you want to find.
2. Create a list of hosts where these servers might be located based on history, anonymous payment options etcetera.
3. DDoS/attack each host one-by-one and check if any of the hidden services are affected in the same way as other hosted sites.

> 1. Create a list of hidden services you want to find.
Already done by

> 2. Create a list of hosts where these servers might be located

1. User set "StrictNodes 1" and "ExcludeNodes {au(not us)}{}{}...".
2. User try to connect whichiwanttoumnask.onion
3. If user can't connect to it, then hidden service might located in {au}.


If you have enough PC and network like NSA, then you can do it.

There is really no need for DoS. Just monitor web hotels and when they go offline check if any hidden service is down. Or maybe NSA can just ask major web hotels to go offline for 10s.

The most likely reason that some of the largest illegal sites are still online is probably that they are not found. The same reason as why some of these sites weren't taken down 6 months ago.

I guess that these kind of methods can be used to locate the servers. Perhaps it's more likely that the server software leaks the ip or other info. I guess some web hotels also scan the hosted data for hidden services.

Please can we create a list of all the onion sites with their current setups like: Operating system, Serversoftware, TorVersion, bitcoin-client(yes/no), PHPVersion, CMS(yes/no/cmsname), ServerHoster(Home/Paid)? Something like that? I am guessing that none of the services used Whonix?? If yes, it would be a strong indicator that it is really a problem of the tor software!!!! Please we need more infos? I also think it was no SQL injection attack or something similiar, because I had a look on many of those sites and they were not vulnerable to such attacks, while I know some still existing sites that are vulnerable and are not being attacked! And yes I can provide proof for that!
Version: GnuPG v1


Why am I allowed to view videos on Tor now? I went to a website that automatically started playing a video. I don't have any plugins installed because flash exposes IPs. The only extra addons I have are Classic Theme Restorer which Tor recommended & AdblockPlus.

I went to a news website and temporarily allowed NoScript. That resulted in the video on the page to automatically play. I then went to Youtube to test if I could view their videos and I could view everything after temporarily allowing NoScript through.

I have the latest version Tor browser bundle 4.0.1.

Since this version of TBB supports MP4 playback, its compatible with more videos now. So that's probably the reason.

HTML 5 video. Your browser now handles videos, not flash.

Firefox can play VP8 videos without using plugins.

HTML5 video. Flesh player or other plugins are not required for them so it must be safe IMHO

>Flesh player

Nooo, the p0rn, it burns my eyes, make it stop!

where can i get that player?!! is it opensource or google's?

because youtube can use HTML5

HTML5 (the new HTML standard) allows video without Flash or other plugins:

Probably what you are seeing is HTML5 video. No Flash required.

For whichever site supports it, the browser will play the video natively without needing a proprietary closed-source plugin. So it's safe and shouldn't compromise anonymity (in theory anyway).

because websites started adopting HTML5 video player instead of Flash.


> Why am I allowed to view videos on Tor now?

HTML5. Built into Firefox, it doesn't require any plug-ins.

Check that Scripts are banned globally,
Then go to Options > Embeddings
And Enable Additional Restrictions for Java/ Adobe Flash/ Silverlight/ etc.

I hope that solves your problem.


Hello, is anyone reading this? I too can view videos on Tor when we're not suppose to. I use the addon Flash Control on Firefox and thought to try it out now on Tor to block all the flash videos but they STILL PLAY. What is going on? Flash is suppose to be disabled because it exposes real IP.

It's HTML5, not Flash. I'm pretty sure Javascript has to be enabled for HTML5 videos to play, and if you want to be especially secure you will disable Javascript. Go to URL about:config, search for javascript.enabled and double click the value field so that it changes to 'false'.

sometimes in my tor browser 4.0.1 no script switches itself to allow scripts globally,i don't know why

idk, maybe it was HTML5 video

Nowadays, videos are officially supported by HTTP standards. You don't Need Flash anymore, and sites start to make use of HTTP video more and more.

HTML 5 ?

It might have been html5 videos you've been watching

You are talking about youtube? They support html5 which is built into the browser, no flash needed. You can watch streaming video with torbrowser quite well know on any site that supports html5 video (though you are correct you must enable scripting for this to work for some reason).

When using Tor youtube and I presume other websites play videos through HTML5 if you don't have flash enabled; you still need to have javascript enabled though.

Tor Browser (and the Firefox 31 ESR that it is based on) supports HTML5 video elements and can play webm (but not yet mp4) videos natively, meaning some videos will work without any plugins. This is normal expected behavior if you are allowing scripts.

Please do NOT install addons or plugins into Tor Browser. Seriously, remove them now. Most people will not have any addons, so using them will make you obvious; clicking New Identity will still give you a new circuit but a website will be able to recognize you are that same user that always uses Tor, Adblock and Theme Restorer together. If you want to be anonymous you simply have to accept that you will see ads and will have to deal with whatever Firefox UI is current.

Don't just take my word for it, the Tor Project recommend never to install extra features to Tor Browser: . I did see Mike Perry's comment about the Classic Theme Restorer, he wasn't saying it was safe or tested with Tor, simply that people who know and understand the risks can check it out.

Can you 'get smart' - changing you useragent from ten highest popular strings _do not_ 'harm you privacy'!! Don't be stupid! It's just like 'i win - i vote for winners'!!

it's HTML5 video, welcome to the future.

It's enabled because it doesn't cause any known IP address leaks in TBB (but if you find any, please report it!)

is it just the same myth as the sentence "you ports are closed - nothing to be bothered about" ( 'use your little grey cells' - any packet need to be investigated by the driver and the ip stack ... )

Well, how to know if your eve server is on the route to a hidden service?
* contibute a small delay pattern (on eve relay node) and check if you can see the same delaypattern on probing/attacking machine
* measure time between sending a request and seeing a particular pattern on your eves relay: attacker to eve to hs
* mesaure time between response from hs and your eve relay to attacker
* try to maximize attack to eve relay by chance to get closer to guard
* measure time from attacker to hs and back (rtt) subtract time of attacker to eve, eve to attacker, and delay pattern
* i call this result network to network time
* if you have lots of pinging statistics from one network to another (like some have), you can measure and guess which network you is of your interest and take all asn of your list with too bad rtt
* guard will change some day
* now do all the measuring again
* if you are lucky enough you are the last hop before the guard.
* try to remove asn by asn from your list, until you end up with one to ten.

doesn't the NSA and other adversaries have the capability to monitor large parts of the internet ?

this should make the following possible:

carefully construct an innocent looking GET request with a hidden but fingerprintable signature.

send it through the TOR network to your target hidden service.
monitor the internet for that fingerprint.

voila, IP revealed...

you should your HS somewhere out of monitor reach, which is likely impossible.

HTTP normalization. which would also be very hard or maybe even impossible because of the openness of the protocol.

I can remember a very long thread on a message board a year or two ago about a hacking organisation that had at least 20 entry and exit nodes in use. At the time the nodes were all held on 4 servers.

The worry was that accessing Tor through an entry node and exit node operated by the same people on the same server could help them to end-to-end match a user and the sites (s)he visited

So now we have nodes identified, sites identified and users identified. Interesting.

BTW, the organisation? CCC - the Chaos Computer Club. I'm not accusing them (why not?, I ask myself), but maybe NSA or GCHQ or Echelon have taken their idea and put it to their own use.

Court docs show Defcon was not using tor but Google chrome. They used that including NSA helping him with admin to locate his server location sure you can fig the rest out. Tor needs help $ someine with business at stake needs to help them $ we are going to lose this whole operation soon if the minds and $ DONT stip to take a time with basics in this darkweb game

Scallion/Scorpion can generate Tor hidden site's private key.
If FBI has much PC power to use, it's easy to generate private_key and setup fake server to tor network.