I have a hidden (v2 onion) apache server running on a machine. Nothing of interest nor sensitive, just for learning and testing purpose.
I have NEVER disclosed its v2 onion address to anybody, nor did I post it, or broadcast it in any way. I am pretty sure the machine itself has not been compromised. It runs a ferm service wich enforces Tails-like iptables: the machine is only accessible from Tor and local network. It also runs a SSH hidden service with stealth authentication.
However, lately, while routinely checking the apache logs, I saw that the hidden website has been regularly crawled every night. The pattern is always the same: all webpages are visited in a few seconds. Headers show a Ubuntu machine, but headers can be forged and I think it’s more probably a bot using a curl script doing its job.
The question is HOW is it possible that the server is being crawled if the address has never been disclosed to anyone? I thought it was mathematically impossible to bruteforce onion addresses? Can a rogue entry node reveal my hidden server onion address? Or worse, its real public IP address? Would a v3 onion also be subject to this kind of behaviour?
I assume there’s some confusion here. v2 onion services are the ones with the shorter addresses. These are not private by default unless you configure authenticated access. Only v3 are. If you mean v3 then I would report this to the Tor mail list because that would be a big deal. I doubt they would design something with such a obvious flaw going unnoticed.
Thanks HulaHoop, yes I am talking about a v2 onion, not v3!
So you mean that by “not private”, they are some kinds of lists of running onion services publicly available? I thought that by design if you didn’t disclose an onion v2 service it could not be automatically indexed and crawled, as long as nobody knew the address (because onion addresses, even v2, are generated unpredictably)? Is it really not the case? If it really is like this, how come there are no “google-like” services indexing all v2 onion servers?
Yes. In v2 Hidden Service directories could track this information and access the onion addresses they see. This was a drawback of th old design and was improved with v3.
I see. So it is more a vulnerability than a feature? I assume this is not encouraged behaviors and some rogue directory leaked my onion address? Does it also affect anonymity of my onion service (public IP leak)?
)