-1

In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes.

I'm curious how a DDoS attack would be more effective when routed over Tor. From what I understand, it would only lower your output due to needing to route over the network, and then you are constricted to however many exit nodes there are (2000-3000 last time I checked). The bots would also have to compete for traffic with the other 2 million Tor users, further reducing throughput.

To me it seems like it would be making your attack less effective, with only the benefit of not exposing the botnet IP addresses.

Is there something I'm missing here? Unless the attack relies on something other than sheer amount of traffic, I don't see how it would be more effective.

Improve this question
8
  • 3
    Who even claims that "routing DDoS attacks over Tor increase effectiveness" ? I don't see such claims in what you reference. It seems to me that only you are claiming this and then ask for an explanation of your own claim.
    – Steffen Ullrich
    Feb 11, 2022 at 17:01
  • Attackers don't do stuff just for the sake of doing it, theres a reason
    – dcom-launch
    Feb 11, 2022 at 17:10
  • 1
    Sure, but the reason might not be to "increase effectiveness" as you claim. It might just be to hide themselves. Or it might be to make StackExchange to block Tor, thus causing some public relations problem. You might have asked why the attackers use Tor, but this wasn't your question. Instead you thought you know why ("increase effectiveness") and asked for an explanation how this increased effectiveness could work.
    – Steffen Ullrich
    Feb 11, 2022 at 17:24
  • Well those are some reasons why I asked this question... Feel free to post an answer if you have some additional insight
    – dcom-launch
    Feb 11, 2022 at 17:25
  • So, your question isn't "why is it more effective over Tor?" but rather "why would an attacker execute DDoS over Tor?" the post you link shows that some of the DDoS traffic was over Tor. Your question seems to be based on 2 faulty assumptions: Tor was used to increase attack effectiveness, and only Tor was used. So, your question would appear to be improved to ask "why would an attacker send some DDoS traffic over Tor?" - and there we're into pure opinion.
    – schroeder ♦
    Feb 13, 2022 at 16:23

2 Answers 2

Reset to default
1

We don't know many details yet, but I would say that the attacker quite probably is relying on more than sheer traffic. Most likely, they are relying on performing requests that are expensive for the server to process and respond to, thereby tying up the servers processing their useless requests. If they had been relying on sheer traffic, then blocking certain IPs wouldn't be very effective, because the servers' bandwidth could be used up regardless of whether the servers processed and responded to the request or not.

At this point, the attacker does not need to generate a gigantic amount of traffic (which Tor isn't for useful for), they just need to get enough requests through. And since Tor provided a large number of free IPs that stackexchange was not blocking, they made ample use of it.

Improve this answer
-2

The other thread does not elaborate on the nature of the DDOS. A brute force attempt on the login page could qualify as DDOS.

As you said, using Tor means limited throughput. But it provides anonymity and convenience.

But it should also be pointed out that most DDOS attacks exploit UDP, for instance reflections attacks against DNS or NTP servers. Tor only carries TCP traffic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .