With the recent breakout of WanaCry, how is it possible that we know on which hidden service it connects, we still don't know where the physical device is located and thus we cannot take it down.

2 Answers 2


This is because an infected device "talks" to hidden service through 6 different Tor nodes. All those machines do not track any routed traffic - and they cannot be configured to "track Wannacry traffic" because none of them know what exact traffic they route (it is encrypted end to end, so only the sender machine and Wannacry server can see the content). Also only the first machine in this chain knows which is the real IP of the sender, but it does not know that the sender is a hidden service.

So to trace a connection, theoretically you'd need to:

  • Build a circuit (establish a connection through rendezvous server) to a hidden service. This is easy.
  • Find out who is the first Tor node in your circuit, and talk to them to trace the next node in the chain. This is way more difficult - not only the node operator may be unreachable or skeptical (how could they know you're really tracing WannaCry, and not some underground resource), but will also require modifying the Tor client and inspect traffic - latter might also be illegal in some countries.
  • Repeat the same with the next five circuits. Which will likely be in different countries - different timezones, different languages and different ideas of what is acceptable and what is not.

Add to that that you need to do this within the circuit lifetime - which, as far as I remember is rather short, less than 30 minutes - and you see the problem.

  • But we know the IP of the hidden service, right ? Because the infected machine must know where it wants to connect. And when we have the IP, how it comes we don't have the location ? May 24, 2017 at 15:10
  • No, we do not know the IP of the hidden service. We know some hash, which can be used to find Rendezvous Points for a specific hidden node (of which you don't know the IP either). The hidden server communicates with the same node (but again not directly, so neither party knows each other IP).
    – George Y.
    May 24, 2017 at 15:53

Simple. If you control an infected machine (via honeypot or other means) you can observe the traffic coming and going. This will tell you what protocols are in use and which IPs are using them.

However, you do not normally have the same visibility to the traffic that those other IPs are sending and receiving. Therefore, you can't really definitively say if those machines are the source of the attack or simply being used as a relay.

Now add in all the issues of finding the actual physical location of an IP, coordinating with local resources, gaining legal access, etc. and you should quickly recognize how big the problem really is. Also with a worm the number of sources grow with every new infection. At some point, the "bad" IP list is expanding so fast a human probably could not keep up with identifying, checking, validating, and blocking the IPs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .