Black Hat Briefings

Recent Spike In Tor Hidden Services

On his blog, Prof Woodward wrote that the surge maybe caused by a botnet or malware creating unique hidden addresses to trick users so as to get their computers infected.

Tor has become something of a hot debate lately. A security expert has spotted an unprecedented surge in the number of Tor hidden addresses (onion site).

The metrics reported by the Tor themselves has indicated that the number of unique hidden addresses has recently spiked by well over 25,000.

University of Surrey’s Professor Alan Woodward was the first person to make this shocking discovery.

Professor Woodward became aware that between 15^th and 18^th February, the number of Tor .onion sites on the dark web spiked to over 60,000 sites from the original 35,000 sites.

Prof Woodward said he wasn’t sure how to explain the sudden surge.

On his blog, he wrote that there has never been such an increase before.

He further wrote that it appears the new Tor .onion sites were being created for some purpose that no one is yet to understand.

Professor Woodward noted that in spite of the latest increase, there was no increase in traffic.

Instead, activities on the network’s hidden services remained constant, and reported a small drop on the date the surge started.

The number of the Tor .onion sites, however, started to decline again nearly as fast as they had surged.

The primary cause of both the increase and the fall remains a mystery, but Prof.

Woodward came up with a few potential theories.

On his blog, Prof Woodward wrote that the surge maybe caused by a botnet or malware creating unique hidden addresses to trick users so as to get their computers infected.

However, none of these provide particularly useful insights into the subsequent fall in these addresses.

Speaking with the BBC, Professor Alan Woodward stated that these attacks are not uncommon, but usually don’t occur on a large scale.

On the other hand, another theory is that the source of this jump could be traced back to an app known as Ricochet.

Ricochet is an app that uses the Tor network to enable anonymous instant messaging between persons who want to chat anonymously.

Ricochet achieves all that without revealing either the user’s IP address or location and that, rather than the username, every participant is assigned a unique address.

Tor has become something of a hot debate lately. A security expert has spotted an unprecedented surge in the number of Tor hidden addresses (onion site).

Woodward went on to say that the jump could have happened if Tor had stopped calculating the number of hidden websites correctly although this was unlikely.

While he found that a jump of over 25,000 new users in three days quite shocking, he said that the fact the increase occurred inside 24 hours of a positive security report raised an eyebrow.

Traffic on Tor network has not seen a commensurate jump, but Woodward stated that this can be explained by users creating new accounts and waiting to operate them or by instant messaging taking up less traffic.

The professor further warned that if the upsurge was triggered by the increasing popularity of the new encrypted chat service, it will likely stir a fresh debate over encryption’s legal implications.

For those that don’t know, The Onion Router (Tor) is a browser that allows users to hide their identity.

As the sites on the Tor network are masked, they are ideal for cybercriminals who sell illegal goods and services including firearms, illegal drugs, chemicals, counterfeit goods, as well as ads for services like gambling, hacking, as well as sports betting.

Beside cybercriminals, there are people who use Tor simply because they want to surf the web anonymously.

They build websites or host servers in the Tor network to protect the identity of their users and avoid prosecution.

A good example is Sci-Hub, a “Pirate Bay for Scientists” which has been fighting publishers over information freedom and has more than 48 million academic-papers available for download.