The best way to run a hidden service: one or two computers?

[Robert Ransom]

On Mon, 13 Sep 2010 14:12:35 -0400
hikki at Safe-mail.net wrote:

> When running a hidden service, obviously hidden so no one can find the 
> true source and IP of the web server because lives may be depended on 
> that, I've heard that the best and safest way is to use a dedicated 
> server computer with two operating systems and the server being inside a 
> virtual machine. So if the web server should get cracked, the cracker 
> will be locked inside the virtual machine and cannot do side-channel 
> attacks or any other clever methods to reveal the true source.
> 
> Then I read somewhere that theres even a more secure way, and that is by 
> using two dedicated computers. One computer with the web server running,
> 
> being connected with a LAN cable to the second computer which works as a 
> firewalled router with Tor running on it with the hidden service keys. 
> Again, if a cracker cracks the server machine, he will be physically 
> trapped inside the server and cannot access the second computer nor the 
> internet directly.

He *would* be able to access the Ethernet card in the
Internet-connected gateway box, and I have seen reports of at least one
Ethernet card with an unauthenticated remote-update backdoor which
could be used to take over the entire computer through DMA.  At the
very least, virtual network adapters are unlikely to have intentional
backdoors hidden in them.

> What are your opinions on this?
> What should be done and what should be avoided while setting up such 
> systems?

* First, operate the hidden service using software with no security
  holes, and on a (physical) computer that does not operate any
  Internet-visible services (especially not a Tor relay).  Putting your
  hidden service in a virtual machine won't protect you from the
  side-channel attack described in “Hot or Not”.

* Second, if you must use software with security holes to operate your
  hidden service, keep that software in a virtual machine, and do not
  let it communicate with a real network adapter.  (The ‘host-only
  network’ option in VirtualBox should be safe enough, for example.)  I
  don't see a big reason to run Tor in a VM, unless you need to set up
  transparent proxying and don't want to mess up your main OS
  installation.


Robert Ransom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20100913/b9532ddb/attachment.pgp>