[tor-talk] How to identify owners of .onion services?

[Mirimir]

On 07/01/2014 11:10 PM, williamwinkle at openmailbox.org wrote:
> 
> With all the talk about the N_S_A targeting traffic between exit nodes
> and destination websites, I am wondering how this may work for hidden
> services (.onion domains). There are no exit nodes as everything occurs
> within the hidden services network.

See posts in the Tor Project blog with the "hidden-services" tag[1].
Also see Øverlier and Syverson (2006) Valet Services: Improving Hidden
Servers with a Personal Touch[2], Biryukov et al. (2013) Trawling for
Tor Hidden Services: Detection, Measurement, Deanonymization[3], and
Jansen et al. (2014) The Sniper Attack: Anonymously Deanonymizing and
Disabling the Tor Network[4], which are cited and discussed therein.

Then see Tor ticket 8106[5] for discussion and progress re Robert
Ransom's proposal for making .onion addresses harder to harvest by
directory servers. Proposal 224 (initially XXX) on this issue is
discussed in tor-dev, starting in October 2013[6,7]. Also see Hopper
(2014) Proving Security of Tor's Hidden Service Identity Blinding
Protocol Tor Project, Tech Report 2013-12-001[8]. As of 2014-03-14, the
milestone is "Tor: 0.2.6.x-final".

I haven't yet tracked the other key issues.

> How would it be possible for an adversary to learn that Person X rented
> a Tor hidden server from a hosting company that provided .onion domains
> and hosting (assuming that Person X paid for his/her hosting with
> Bitcoins and did not do anything stupid to tie his or her 'clear web'
> identity to his or her .onion identity)?

That depends on how thoroughly Person X had avoided association with the
server. They would have used Tor for all contacts and server
administration, of course. And they would have paid anonymously. Cash in
the mail is one option, given adequate protocol. Bitcoins are another,
but only after thorough anonymization via Tor.

Person X would have anonymized the Bitcoins through a chain of anonymous
wallets (e.g., Multibit clients in Whonix instances) using multiple
anonymous mixing services. And they would have carefully checked for
residual association using the "Taint Analysis" tool at
https://blockchain.info/. But even then, there may be traces.

[1] https://blog.torproject.org/category/tags/hidden-services
[2] http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf
[3] http://freehaven.net/anonbib/cache/valet:pet2006.pdf
[4] http://www.robgjansen.com/publications/sniper-ndss2014.pdf
[5] https://trac.torproject.org/projects/tor/ticket/8106
[6] https://lists.torproject.org/pipermail/tor-dev/2013-October/005534.html
[7] https://lists.torproject.org/pipermail/tor-dev/2013-November/005877.html
[8] https://www-users.cs.umn.edu/~hopper/basic-proof.pdf