Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)

For those who do not know what Tor is and who do not want to waste their time installing and checking what is there - you can read this and this comprehensive paper regarding The Silkroad.

In the paper, researchers stated that as much as USD 1.9 million/month is circulated on The Silkroad and most of this money are generated by drug products.

My question is - how it is possible that this site (aside from being completely illegal) was not closed? At one point in time it was quite notorious and there was even a hearing in the senate, but nothing came of it.

What makes onion domains so special that even knowing it carries large amounts of narcotics-related transactions it is still impossible to close it.

share|improve this question
Probably, because it is FBI's fake. It is hard to close what FBI does. – trankvilezator Sep 22 '13 at 15:48
Do you have anything to support this strong argument? Conspiracy theory is nice, but it is much nicer with at least some support – Salvador Dali Sep 22 '13 at 17:27… it is the similar. Just try to browse Tor hidden services, you do find nothing. There are no yet hidden-services, this is pre-Alpha technology under hard control of special services. probably – trankvilezator Sep 22 '13 at 17:51

Have you seen the Tor document on how a Tor Hidden Service works?

Essentially, in the same way that it's hard to find the source of traffic from a Tor exit node, it's hard to find the server operating a Tor Hidden Service. Authorities can't shut down the server, because they can't find out where it is.

The .onion TLD is not really a TLD (so there is no domain registrar to shut down), but it's recognized by Tor.

There are other methods for tracking it down - checking cash flows, poorly anonymised Bitcoin transactions, even good "old-fashioned" anonymous tips to the police. So far it seems none have been sufficient.

Edit: Ah, I think I understand the confusion. You're expecting that by flooding the Tor network with malicious exit nodes, you'll eventually create one that's used for the "exit" to a .onion. You'll know it's the target (e.g. Silkroad) because you'll be able to see the traffic contents. This does not work against .onion hosts, because unlike an exit node connection to a "normal" host on the public internet, traffic to .onion hosts is end-to-end encrypted.

So even a malicious exit node does not know that it's connected to the Silkroad host, because it can't see the traffic content.

share|improve this answer
I think that I pretty much understand how TOR works. The thing that right now it is up to 3000 or TOR relays. If the question stands to narcotraffic in USA on such a scale (you have to admit that 1.9 mln/month is rather a big number). And in my opinion it is possible to create like 6000 additional TOR relay operating by FBI or whatever to be able to find out the address. – Salvador Dali Dec 4 '12 at 22:56
I'm not sure your understanding is complete. Even if a "malicious" Tor relay happens to be an introduction point that the hidden service of interest connects to, it still does not know the IP address of the service. Should a large number of "malicious" Tor nodes be introduced, it does degrade the privacy protection to some degree, but this would affect all privacy, and not just Tor hidden services. – scuzzy-delta Dec 4 '12 at 23:08
For sure it is not complete. But for me that sounds rather bizarre that the last relay does not know to whom exactly it connects. I would really appreciate if you will elaborate on this. One more time, in my response I didn't want to be rude, I just stated that I think I know how it works and I thought that just TOR should not be enough if the issue is drug-traffic. – Salvador Dali Dec 4 '12 at 23:31
The last relay does know. But the Introduction Points and the Relay Points are not necessarily the last relays. Does that help? – scuzzy-delta Dec 5 '12 at 1:21
If you controlled a significant number of exit nodes, couldn't you also connect a significant number of clients and have them issue a ton of requests to a particular .onion address? Best case, you could look for identical requests exiting. Worst case, you could conduct traffic analysis. – Stephen Touset Jan 21 '13 at 23:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.