Someone Created a Tor Hidden Service to Phish My Tor Hidden Service

http://incoherency.co.uk/blog/stories/hidden-service-phishing.html

by jstanley • 9 years ago

273 87 9 years ago

incoherency.co.uk

XR0CSWV3h3kZWg2• 9 years ago

0.002 BTC seems generous these days!

Interesting post, I wonder how common this is.

krisives• 9 years ago

Very common look up rancid tomato proxy

jstanley14• 9 years ago

Google: No results found for "rancid tomato proxy".

DuckDuckGo: this HN thread is the only result.

Did you get the name slightly wrong?

finnn3• 9 years ago

I wonder what the requests look like coming through the proxy. Is there a distinct user agent? or some other header send with the request

jstanley14• 9 years ago

It passes through the client User-Agent unchanged. I've not yet looked at anything else although I doubt it will do anything but pass through the client headers.

It might be interesting to send confusing or contradictory request headers and see how it reacts.

finnn3• 9 years ago

yeah, i'd definitely try sending it all sorts of weird things. Can you setup a path that will respond with a ton of data? Maybe a bunch of things that it will try to parse? etc

larkeith• 9 years ago

Excellent writeup, and a good example of what types of attacks to expect as we move forward towards a more decentralized web.

ewams• 9 years ago

We are moving towards a more centralized web, not decentralized. The technology industry, and the Internet, is consolidating. Look at the news for all the companies being purchased by facebook, google, microsoft, amazon, apple, hpe and cisco. Also look at ISPs, Timewarner and spectrum, verizon, att, etc all are consolidating. It will continue to become harder to hide, or be anonymous, as we make this path because not only will data be held by just a few players, but so will the transmission lines only be held by a few.

jstanley14• 9 years ago

The more the "mainstream" web becomes centralised, the more technical people are being pushed towards working on tools for decentralisation and anonymity.

It's happening, just not in the places that most people tend to look.

SEJeff• 9 years ago

And not just them, the Content Delivery Networks as well.

Look how massive a problem cloud bleed was when that vuln was found in Cloud Flare.

PhisherPrice2• 9 years ago

Hit it offline with a denial of service attack.

zethraeus• 9 years ago

Welcome to the dark web. It's terrible here.

jstanley14• 9 years ago

Note that since the phishing site proxies requests to the legit site, this also has a high risk of knocking the legit site offline.

PhisherPrice2• 9 years ago

Maybe with a layer 7 attack, but not with a layer 3 attack. The author also described the difference between the proxy request and a legit request, so he can just block the proxy requests. Try using slowhttptest. You don't even need a botnet.

driverdan• 9 years ago

The seemingly easy way to DoS it would be to hit pages with Bitcoin addresses.

You could even setup a hidden static page with hundreds or thousands of addresses and call it through that proxy. No load on the legit server but heavy load on the rogue proxy.

bflesch• 9 years ago

I'm not a tor expert, but could this be solved by using something like namecoin for DNS within tor? So there would be a "proper" domain system for the .onion routes?

The whole confusion comes from the fact that tor domains have this random string added to the name you actually want to take, right?

koolba2• 9 years ago

The string isn’t random. It’s a public key with the private key of the service able to decrypt content sent to it.

Anyone can generate a key with a vanity prefix, it just takes computing power and the longer the match, the greater the computing power involved.

flashmob• 9 years ago

Facebook's hidden service address is particularly impressive: https://facebookcorewwwi.onion/

It seems like everything except the 'i' is a prefix, a lot of computing must have went in to generating it.

One tool to do it is called 'Shallot' https://github.com/katmagic/Shallot

The readme includes a table of estimated computing time required. A 15 char prefix like Facebook's is not even on the table, and a 14 char prefix is estimated to take 2.6 million years. There is also a GPU version which should be an order of magnitude faster: https://github.com/lachesis/scallion/blob/gpg/README.md

Also, technically. the onion addresses not public keys, but derived from a public key. It's actually a hash of the public key.

It appears that the hashing algorithm used is SHA1. Source: The last few lines of the easygen function https://github.com/katmagic/Shallot/blob/master/src/math.c

djsumdog• 9 years ago

As explained in other comments, onion addresses are keys. However what you'd taking about does exist on zeronet, where people can buy .biz domains.

ornitorrincos• 9 years ago

uh, out of curiosoty, how do they handle conflicts with already stablished domains on that tld?

jerheinze4• 9 years ago

This is properly solved by the switch to stronger encryption, the new v3 onion addresses protocol (available with Tor 0.3.2.x-alpha) replaces SHA1/DH/RSA1024 with SHA3/ed25519/curve25519. Onion addresses are now 56 characters long, example: http://ffqggapqevcmylx6vtk5357i7bfjwbb6qchds3hlohangshxrwvdd...

Also something you may be interested in: OnionNS https://www.freehaven.net/anonbib/cache/onion-ns-pets2017.pd...

the_stc5• 9 years ago

That does not solve anything. It just means the addresses are so long you are guaranteed no one is eyeball-comparing them. This makes phishing easier.

pbhjpbhj• 9 years ago

If you can get js to execute on the server, can't you get info that disambiguates the server?

Is the a way to make the server run a bitcoin miner, for fun really ...?

jstanley14• 9 years ago

The JavaScript I talked about ran in browsers when accessed via the phishing site, it didn't run on the server.

ageisp0lis• 9 years ago

Isn't this connected to crimewave's "Rotten Onions"? The author doesn't seem to make the connection: https://twitter.com/campuscodi/status/917231902033104896

jstanley14• 9 years ago

Thanks, I hadn't come across this. It could very well be the same thing.

I didn't notice any XMR mining though, FWIW.

firloop• 9 years ago

crimewave claims to donate 25% of their stolen coins to charity: https://www.reddit.com/r/onions/comments/4c9xlp/robbin_the_h...

nrki• 9 years ago

Interestingly, the smsprivacy guy sent a payment to a faked bitcoin address, and that address has since paid an address associated with the Human Rights Foundation: https://blockchain.info/address/1GM6Awv28kSfzak2Y7Pj1NRdWiXs...

Mizza2• 9 years ago

The guy who runs the phishing servers, "crimewave", (everything is automated, all hidden services have these BTC phisher clones) actually posts on r/onions sometimes. I had a good discussions about possible counter-measures with him.

devhead• 9 years ago

do tell

Mizza2• 9 years ago

Here's one of the threads from last year: https://www.reddit.com/r/onions/comments/45k2ux/mitm_phishin...

I appear to be suggesting a) sending BTC addresses as images and b) a 3rd party login visual verification service

campuscodi• 9 years ago

The fake site was most likely created by the Rotten Onions crew.

the_stc5• 9 years ago

This is why we need SSL certs for .onions. DigiCert was doing this, but they told me it is on hold. Maybe when V3 hidden services are out?

With an SSL cert, you get a cert for your .onion PLUS your clearnet domain. Then users can access the .onion and see your real enterprise's name.

This should be doable even for extrajurisdictional companies like mine. The key is that your clearnet site should be a TCP-level proxy to the hidden service. That way the SSL keys are never on an easily-discoverable system so only IP addresses can be logged, not any contents. Slight plug: Here's the tech design for our system: https://medium.com/@PinkApp/pink-app-trading-latency-for-ano... (ignore the clickbait title). This should work just fine for .onions too, even with the clearnet entry point. For a DarkNet Market, most small buyers are probably safe visiting over clearnet.

jerheinze4• 9 years ago

SSL certs for .onions exist for years now, here are two examples: https://www.facebookcorewwwi.onion and https://protonirockerxow.onion

Also v3 onion services are available now with Tor 0.3.2.x-alpha.

the_stc5• 9 years ago

But DigiCert says they are no longer issuing them. Probably because the .onion is an 80-bit truncation of a SHA1 hash so it doesn't meet baseline reqs?

wybiral3• 9 years ago

What's the purpose of running a hidden service if you're clearly identifying yourself?

Couldn't Tor users still visit your "clearnet" domain privately (it is just an onion-routing proxy, after all)?

the_stc5• 9 years ago

The point is to remain user-friendly while hiding the actual webservers, databases, and anything else that LE might want to take. An onion-routing proxy is easily setup and torn down and moved around quickly, making it a harder target for persistent surveillance.

Buge• 9 years ago

Are you talking only about EV certs? Because DV certs don't really display your enterprise name, at least not in an easily accessible location for users to see.

tyingq4• 9 years ago

Not much you can do other than fight a war of escalation.

If you want to give the phisher lots to do, create say 10 versions of your site where the html/css/js are tightly intertwined. Such that html version "a" only works with css/versiona.css and js/versionb.js. Mismatches create a site you can't view, interact with etc.

Then, for each version, put your countermeasures in your main js and css files, and tweak your site so that it doesn't work at all without those main js and css files. Add subresource integrity to the each version of the main html that pulls them in. Obfuscate each version of js and css.

And vary up the countermeasures per version. Like displaying the bitcoin address with css (selector:after {content: 'abc'}, with an image, dynamically with obfuscated javascript, etc).

Round robin which version of the page is served. This will make caching anything hard for the phisher, and the variations of countermeasures might get them to find a softer target.

Shitload of work, though, just because some ahole wants to skim money.

grubles• 9 years ago

Javascript is disabled out of the box in Tor Browser if I remember correctly. At least it should be.

tyingq4• 9 years ago

Nope.. https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...

meowface• 9 years ago

If they just reverse proxy the site (and strip or change subresource integrity tags), how would any of this actually help?

I don't think there's really a way to prevent someone from creating a phishing version of your website. You can get alerted to it by checking your web server access logs, but beyond that you can probably only take legal measures.

tyingq4• 9 years ago

The proxy is altering the JavaScript, css, and HTML to get rid of various countermeasures.

Maybe one version dynamically pulls in crucial js with subresource integrity, with obfuscated text that isn't as simple to strip out. Another version where the main obfuscated js bombs if the subresource integrity has been stripped from the HTML, etc.

The approach I described means they need to solve for X different variations of different types of countermeasures. Think things like obfuscated JS that checks location.host, or the Bitcoin address. And responds in different ways. Buried in the main js. But each variation of the site using slightly different countermeasures, div ids, ways to encode the text of the bitcoin address, etc.

Like copy protection. Yes, you can break it. But time and effort are expended.

The article already suggests some laziness from the scraper. He only substituted the hostname if it was lower case. The general idea here is lots of countermeasures, and ones that change with every request. Wearing them down.

You can get alerted to it by checking your web server access logs

Maybe. Hard on tor, there may be nothing unique about the requests.

ezoe• 9 years ago

How can customers protect themselves?
SMS Privacy customers should make sure they're browsing either smsprivacy.org using HTTPS, or, if using Tor, smspriv6fynj23u6.onion is the only legitimate hidden service. Anything else is almost certainly harmful in one way or another.

Posting this very important information which must not be modified by the middle man on Non-TLS web site.

I really wondered the author's ability to operate the privacy centric SNS on Tor network.

Or am I reading the web page through malicious proxy?

jstanley14• 9 years ago

Absolutely right. It's shameful that I still don't have HTTPS on my blog. I've got no excuse.

wybiral3• 9 years ago

IMO the risk here is that onion link lists and search engines can't be trusted. How else are people getting these bogus onions? There's no authority on these "hidden services" and hiding identity is kinda the point of Tor so phishing is easy.

Onion addresses are basically hashes of the public key of the hidden service. Trusting only the first few characters for match (for these "vanity onions") to identify the service is just a bad idea...

peteretep• 9 years ago

Is this significantly different from the original site being at anonymoussms.com and me registering anonymoussms.io and doing the same thing?

I don’t think I buy that this attack isn’t just as possible on the real web.

nomadiccoder• 9 years ago

I like the simplicity of this website design!

ris• 9 years ago

So clearly the random garble in smspriv6fynj23u6.onion isn't recognizable enough for a user to spot a bogus one. And so as long as an adversary is willing to spend the same amount of money mining their bogus key as you are in generating the original, you're never going to win.

My suggestion would be to, during the mining process, search the "random" portion of the domain for "recognizable strings" (probably just any dictionary words) and keep mining until a domain is found with a suitable level of "recognizability". This way you get the extra "strength" of having mined for a significantly longer string at only a fraction of the cost whilst an adversary would have to search for a much more specific string to mimic you convincingly.

This is somewhat similar to facebook having "corewwwi" following their domain - not words they were specifically looking for I'm sure, but notable and so would be necessary to bruteforce.

Consider it to be a bit like having "correcthorsebatterystaple" on the end of your domain (yeah I know it's too long).

jstanley14• 9 years ago

You could equally say that a user isn't going to be able to spot the difference between "news.ycombinator.com" and "news.ycombinator.io".

I think the answer is not to blindly trust convincing-looking strings and to actually ensure that you're browsing the correct site.

noobermin• 9 years ago

Whenever talking about security, it's all about probability. The probability of a user distinguishing "io" from "com" is higher than then distinguishing "frh2dj3" and "frh2di3".

phire• 9 years ago

Regarding the delay when generating addresses:

It's probably just doing an RPC call to an actual bitcoin node, which (in my experience) can actually take a few seconds depending on how fast of a computer the node is running on.

vmp2• 9 years ago

Maybe reducing the entropy by almost half for a vanity key/domain name wasn't such a good idea.

nsuser3• 9 years ago

What are you talking about?

vmp2• 9 years ago

The address, 7 out of 16 characters are fixed.

DyslexicAtheist• 9 years ago

thanks for disclosing this https://smsprivacy.org/info-leak in such a proactive way. Delloite, Equifax & Co all could learn something from you.

Someone Created a Tor Hidden Service to Phish My Tor Hidden Service

Related Stories