The world has recently become aware of an undergoing denial-of-service (Dos) attack against major darknet marketplaces such as the Agora Market. The attack exploits an existing loophole in Tor hidden services protocol. Drug markets and other Tor hidden sites have been targeted by the attack, which some consider the most serious attack yet to target Tor darknet sites.
The DoS attack consists of attackers creating several simultaneous connections to the same hidden service, which overwhelms the server’s CPU resources thus making it inaccessible to darknet site users. One of the sites attacked alongside Agora Market, a site called Middle Earth, had its server load increased to 100 percent, which effectively resulted in downtime and inability by users to access the site. The bug report related to the attack has been opened under the name “alberto” by Tor developers.
So far, the attack has been reproduced by a Tor developer. In fact, short-term solutions have been introduced to deal with the problem, but none have worked out. Long-term solutions have also been suggested; including proposals put forward by Tor hidden services co-founder Roger Dingledine in 2012.
Tor hidden site owners began complaining of server having accessibility issues towards the end of March. The problem was traced to large amounts of malicious traffic that slowed down or stopped user access to the sites’ servers altogether.
Agora Market, the largest darknet site at the moment after the closure of Silk Road and Evolution Marketplace, is one of the main Tor hidden sites targeted by this attack. Agora Market mainly deals in illegal drugs, although it also sells weapons and other illicit items. Since the attack, Tor hidden sites have been struggling to stay up. However, both Agora Market and Middle Earth are currently accessible.