Tor Hidden Services Research Articles

Tor Hidden Services: A Systematic Literature Review

Anonymous communications networks were created to protect the privacy of communications, preventing censorship and traffic analysis. The most famous anonymous communication network is Tor. This anonymous communication network provides some interesting features. Among them, we can mention that Tor can hide a user’s IP address when accessing to a service such as the Web, and it also supports Tor hidden services (THS) (now named onion services) as a mechanism to conceal the server’s IP address, used mainly to provide anonymity to websites. THS is an important research field in Tor. However, there is a lack of reviews that sum up the main findings and research challenges. In this article, we present a systematic literature review that aims to offer a comprehensive overview of the research made on THS by presenting the state-of-the-art and the different research challenges to be addressed. This review has been developed from a selection of 57 articles and presents main findings and advances regarding Tor hidden services, limitations found, and future issues to be investigated.

Phishing detection on tor hidden services

Phishing is the act of impersonating another party to attack a user, usually stealing information or money. In darknets, where participants are usually anonymous, phishing is a huge problem. We describe the current state of phishing in darknets, especially the Tor network. We analyse what techniques attackers can use to impersonate other services as well as develop some metrics to automatically detect phishing pages. Existing solutions against phishing are presented and phishing detection in the clearnet is examined on the transferability to darknets.

An Ensemble Approach to Identify Firearm Listing on Tor Hidden-Services

An Ensemble Approach to Identify Firearm Listing on Tor Hidden-Services

Improving named entity recognition in noisy user-generated text with local distance neighbor feature

Recognizing infrequent or emerging named entities in a user-generated text is a challenging task, especially when informal or slang text is used. Some recent works propose to use a gazetteer to solve this problem, but this solution is not general because the gazetteer is task-specific and its maintenance is costly. In this paper, we overcome this drawback by presenting Local Distance Neighbor (LDN), a novel feature that substitutes the gazetteer and makes that the model obtains state-of-the-art results. LDN captures an initial guess for each input token based on the categories of its neighboring tokens within an embedding space. We evaluated the proposed network on the W-NUT-2017 dataset, and we obtained the state-of-the-art F1 score for the Group, Person, and Product categories. We employed our new feature together with the model proposed by Aguilar et al. to recognize named entities in the Tor Darknet related to suspicious activities associated with weapons and drug selling. After increasing the samples of the W-NUT-2017 dataset with 851 manually annotated entries, we repeated our evaluation in this extended version of the dataset, achieving entity and surface F1 scores of 52.96% and 50.57%, respectively. Furthermore, we demonstrate that our proposal can be useful for Law Enforcement Agencies in mining the textual information in the Tor hidden services, being especially adequate for the Group, Person, and Product categories.

Toward a Comprehensive Insight Into the Eclipse Attacks of Tor Hidden Services

Tor hidden services (HSs) are used to provide anonymity services to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor HSs use decentralized architecture that makes it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor HSs that allow an adversary with an extremely low cost to block arbitrary Tor HSs. We found that the dominant cost of this attack is IP address resources, the experimental results show that we can use only three IP addresses to eclipse an arbitrary HS with 100% success probability. To understand the severity of the Eclipse attack problems on Tor HSs, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of HSs at any time. Finally, we discuss countermeasures and future works.

ToRank: Identifying the most influential suspicious domains in the Tor network

The Tor network hosts a significant amount of hidden services related to suspicious activities. Law Enforcement Agencies need to monitor and to investigate crimes hidden behind the anonymity provided by Tor. In this paper, we propose a new algorithm, named ToRank, that ranks hidden services in Tor better than the known algorithms used for the Surface Web. We also thoroughly analyze the content present in Tor, creating a dataset, DUTA-10K, that extends the previous Darknet Usage Text Address (DUTA) dataset. We quantitatively compared ToRank with some of the most popular ranking algorithms, like PageRank, HITS, and Katz. Results showed that our proposal obtains a higher harm to the Tor network robustness than all of them, what indicates its superiority for this problem. The analysis of DUTA-10K reveals that only 20% of the hidden services that can be accessed are related to suspicious activities, and 48% are associated with normal ones. We also discovered that domains related to suspicious activities usually present multiple clones under different addresses, what could be used as an additional feature for identifying them. We consider that our new algorithm, the extended dataset, and the findings obtained from the analysis carried out are helpful for LEAs to fight against crimes that take place in the Tor hidden services.

Leakage of .onion at the DNS Root: Measurements, Causes, and Countermeasures

The Tor hidden services, one of the features of the Tor anonymity network, are widely used for providing anonymity to services within the Tor network. Tor uses the .onion pseudo-top-level domain for naming convention and to route requests to these hidden services. The .onion namespace is not delegated to the global domain name system (DNS), and Tor is designed in such a way that all .onion queries are routed within the Tor network. However, and despite the careful design of Tor, numerous .onion requests are still today observed in the global DNS infrastructure, thus calling for further investigation. In this paper, we present the state of .onion requests received at the global DNS and as viewed from two large DNS traces: a continuous period of observation at the A and J DNS root nodes over a longitudinal period of time and a synthesis of Day In The Life of the Internet data repository that gathers a synchronized DNS capture of two days per year over multiple years. We found that .onion leakage in the DNS infrastructure to be both prevalent and persistent. Our characterization of the leakage shows various features, including high volumes of leakage that are diverse, geographically distributed, and targeting various types of hidden services. Furthermore, we found that various spikes in the .onion request volumes can be correlated with various global events, including geopolitical events. We attribute the leakage to various causes that are plausible based on various assessments, and provide various remedies with varying benefits.

Efficient botnet herding within the Tor network

During 2013 the Tor network had a massive spike in new users as a botnet started using Tor hidden services to hide its C&C (Command and Control) servers. This resulted in network congestion and reduced performance for all users. Tor hidden services are attractive to botnet herders because they provide anonymity for both the C&C servers and the bots. The aim of this paper is to present a superior way that Tor hidden services can be used for botnet C&C which minimises harm to the Tor network while retaining all security benefits.