Bitcoin Forum
May 11, 2024, 12:07:07 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: 1 2 3 [All]
  Print  
Author Topic: Rate my Tor Hidden Service  (Read 16253 times)
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 08, 2012, 09:00:25 PM
 #1

Internet --> Modem --> Sonicwall TZ215 --> OpenBSD firewall appliance --> OpenBSD Server with TOR Hidden Service

Notes
-OpenBSD is considered to be the most secure OS out there
-OBSD comes with military grade encryption

Now my only problem is whether I can successfully run vBulletin with OpenBSD as a server.
1715429227
Hero Member
*
Offline Offline

Posts: 1715429227

View Profile Personal Message (Offline)

Ignore
1715429227
Reply with quote  #2

1715429227
Report to moderator
1715429227
Hero Member
*
Offline Offline

Posts: 1715429227

View Profile Personal Message (Offline)

Ignore
1715429227
Reply with quote  #2

1715429227
Report to moderator
1715429227
Hero Member
*
Offline Offline

Posts: 1715429227

View Profile Personal Message (Offline)

Ignore
1715429227
Reply with quote  #2

1715429227
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715429227
Hero Member
*
Offline Offline

Posts: 1715429227

View Profile Personal Message (Offline)

Ignore
1715429227
Reply with quote  #2

1715429227
Report to moderator
1715429227
Hero Member
*
Offline Offline

Posts: 1715429227

View Profile Personal Message (Offline)

Ignore
1715429227
Reply with quote  #2

1715429227
Report to moderator
Aggro
Donator
Sr. Member
*
Offline Offline

Activity: 296
Merit: 250



View Profile
March 08, 2012, 09:33:27 PM
 #2

Internet --> Modem --> Sonicwall TZ215 --> OpenBSD firewall appliance --> OpenBSD Server with TOR Hidden Service

Notes
-OpenBSD is considered to be the most secure OS out there
-OBSD comes with military grade encryption

Now my only problem is whether I can successfully run vBulletin with OpenBSD as a server.

I think you should be able too. Might be too slow because VB is known to be an html monster Smiley I have seen phpbb and punbb being used on tor.
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 08, 2012, 10:33:14 PM
 #3

The Server PC itself will be this: https://eracks.com/products/General%20Purpose/VALUE
furrythunder
Newbie
*
Offline Offline

Activity: 4
Merit: 0


View Profile
March 09, 2012, 04:23:44 AM
 #4

The setup is nice an everything but the vBulletin track record on security is not that great. Everything else is useless if some remote exploit can reveal the servers ip address.
jake262144
Full Member
***
Offline Offline

Activity: 210
Merit: 100


View Profile
March 09, 2012, 08:22:34 AM
 #5

OBSD comes with military grade encryption
lol  Cheesy
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:14:40 AM
 #6

The setup is nice an everything but the vBulletin track record on security is not that great. Everything else is useless if some remote exploit can reveal the servers ip address.

How is that possible when used in conjunction with TOR?
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:15:17 AM
 #7

OBSD comes with military grade encryption
lol  Cheesy

What? Do you even know what military grade encryption is?
John (John K.)
Global Troll-buster and
Legendary
*
Offline Offline

Activity: 1288
Merit: 1226


Away on an extended break


View Profile
March 09, 2012, 10:20:51 AM
 #8

vBulletin is useless if you're paranoid about security. Just take a look at the exploits found for it monthly and you'll think twice about using it.
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:50:26 AM
 #9

vBulletin is useless if you're paranoid about security. Just take a look at the exploits found for it monthly and you'll think twice about using it.

Nothing is better than vBulletin in the message board world.
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:51:39 AM
 #10


-OBSD comes with military grade encryption


From you saying laughable stuff like the above, I can
already tell you the major security flaw in your system:

    - system administrator is a complete noob.


I think you're an idiot who can't even explain what he or SHE means properly.

Also if I'm not good enough to be sys adm, I'll just hire someone, that's the great thing about me, I'm rich... haha.
John (John K.)
Global Troll-buster and
Legendary
*
Offline Offline

Activity: 1288
Merit: 1226


Away on an extended break


View Profile
March 09, 2012, 01:15:44 PM
 #11

VBulletin is brilliant forum software. It really is. But it has an absolute crap load of vulnerabilities and is definitely not suited to TOR at all!

Take our advice and use something like PHPBB, or hell make your own in PHP if you really want.

Everybody knows hackers love to use TOR, and when they stumble across a vbulletin forum, they are bound to try out atleast one exploit.

Also, I would be very sure the remote IP could be discovered using certain exploits.
+1. I'm fairly sure there's still working sql injection attacks working against vBulletin as the GPC function still does not filter parenthesis as for today.
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 03:40:32 PM
 #12

znort is a gay poor faggot that just made my ignore list.

anyways until i find something better than vbulletin, that is what i'm sticking with, oddly enough it's just a small group of people who THINK that vbulletin is the most vulnerable
bitcoinsarefun
Member
**
Offline Offline

Activity: 98
Merit: 10



View Profile
March 09, 2012, 04:35:04 PM
 #13

Internet --> Modem --> Sonicwall TZ215 --> OpenBSD firewall appliance --> OpenBSD Server with TOR Hidden Service

Notes
-OpenBSD is considered to be the most secure OS out there
-OBSD comes with military grade encryption

Now my only problem is whether I can successfully run vBulletin with OpenBSD as a server.

Looks fine, but just be mindful of what others have already said regarding your forum software choice ... all those layers are useless if someone successfully exploits your board.



And to answer your question, you can run vBulletin with no issues on OpenBSD ...
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 04:45:06 PM
 #14

Okay to be honest I don't care if someone hacks the boards, that just means I have to reload an older version of the boards.

Also according to other sites, alot of vbulletin exploits are found but not many boards are seen hacked.

And furthermore, why can't people come up with a better choice than vBulletin? Probably because there are none.

IF I DO FIND A MORE SECURE VERSION, then I will switch to that.
bitcoinsarefun
Member
**
Offline Offline

Activity: 98
Merit: 10



View Profile
March 09, 2012, 04:47:58 PM
 #15



And furthermore, why can't people come up with a better choice than vBulletin? Probably because there are none.



People have made recommendations already in this thread - phpbb has popped up a few times, the software this forum runs is pretty decent as well ...

For vbulletin, just keep track and update when necessary and keep decent backups

Remember, you asked for people to rate your hidden service - they gave you their opinions on where it felt weak ... if you don't like those opinions, then why ask people to rate?
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 04:57:43 PM
 #16

Alright, I will take all things into consideration.

PHPBB vs vBulletin
John (John K.)
Global Troll-buster and
Legendary
*
Offline Offline

Activity: 1288
Merit: 1226


Away on an extended break


View Profile
March 09, 2012, 04:59:48 PM
 #17

Okay to be honest I don't care if someone hacks the boards, that just means I have to reload an older version of the boards.

Also according to other sites, alot of vbulletin exploits are found but not many boards are seen hacked.

And furthermore, why can't people come up with a better choice than vBulletin? Probably because there are none.

IF I DO FIND A MORE SECURE VERSION, then I will switch to that.

The better choice is PHPBB.

If your forum gets hacked all of your users sensitive information will be leaked. Your entire server may even get rooted and affect every other website on it and have all of your data on it leaked. Your server may also be used to send out shit loads of spam and get your IP blacklisted or even get your server disconnected by the datacenter. And once the vulnerability is found, the hackers will just keep using it until you or someone else patches it. It will also take you a few days to get all the passwords of everything changed in order to get the website back up. Also once your website is hacked the majority of your users will leave

Not true. I've seen many vbulletin forums get hacked. Have a look around onionland, you won't find any.

Also, vbulletin is very messy with its html and will be slow as hell on TOR.
Use a stripped down version of phpBB for maximum security. Also, remember to update it. vBulletin(especially outdated ones) is a piece of cake for seasoned sql ninjas.

Back to the topic, your Tor Hidden Service is only as secure as the weakest link, which is vBulletin now. We don't care about military grade encryption stuff as rooting a 'hot' server would leave the encryption keys in the memory and the stuff decrypted, ready for a leak.
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 09, 2012, 05:06:51 PM
 #18

this thread is full of lulz about a weak sysadmin(boconniff40). WIN!

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 05:21:01 PM
 #19

What do you guys think about SILC? SILC (Secure Internet Live Conferencing protocol) is a protocol that provides secure synchronous conferencing services (very much like IRC) over the Internet.[1]
John (John K.)
Global Troll-buster and
Legendary
*
Offline Offline

Activity: 1288
Merit: 1226


Away on an extended break


View Profile
March 09, 2012, 05:25:55 PM
 #20

What do you guys think about SILC? SILC (Secure Internet Live Conferencing protocol) is a protocol that provides secure synchronous conferencing services (very much like IRC) over the Internet.[1]
I remember reading something about it years ago. I've no prior experience on this so I have to say I don't know. However, this seems not really popular...
bitcoinsarefun
Member
**
Offline Offline

Activity: 98
Merit: 10



View Profile
March 09, 2012, 06:06:13 PM
 #21

What do you guys think about SILC? SILC (Secure Internet Live Conferencing protocol) is a protocol that provides secure synchronous conferencing services (very much like IRC) over the Internet.[1]

irc over ssl is an option, you could use certificate based authentication with your clients
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 09, 2012, 06:23:50 PM
 #22

What do you guys think about SILC? SILC (Secure Internet Live Conferencing protocol) is a protocol that provides secure synchronous conferencing services (very much like IRC) over the Internet.[1]
just another (useless) protocol.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
jake262144
Full Member
***
Offline Offline

Activity: 210
Merit: 100


View Profile
March 09, 2012, 06:42:44 PM
Last edit: March 10, 2012, 05:49:50 AM by jake262144
 #23

just another (useless) protocol.
'tis not so, it's a protocol of military-grade strength Grin
Much good it'll do when the vBulletin-powered server gets rooted.

Any server is only as good as the admin running it. Somehow, I've got this gut feeling this ain't gonna be the Fort Knox of forums...
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1358
Merit: 1002



View Profile
March 09, 2012, 08:40:07 PM
 #24

Also, make sure the root password of the server isn't blank, or "password". This is usually a good security practice as it stops your server from getting completely owned.
LOL The scary part is that I feel that the OP really needs to be given this ^^ advice.


I rofl'd on his statement that he doesn't care if his "hidden service" is hacked because he'll just restore the database.

Hey, you fool, if your "hidden service" is hacked you can bet it will not be a "hidden service" anymore and it will just be a "service"!! Granted.
If it happens the upside is that you won't need to use Tor anymore and can just serve your forum using the normal internet and a normal domain. Cheesy
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 09:36:32 PM
 #25

Also, make sure the root password of the server isn't blank, or "password". This is usually a good security practice as it stops your server from getting completely owned.
LOL The scary part is that I feel that the OP really needs to be given this ^^ advice.


I rofl'd on his statement that he doesn't care if his "hidden service" is hacked because he'll just restore the database.

Hey, you fool, if your "hidden service" is hacked you can bet it will not be a "hidden service" anymore and it will just be a "service"!! Granted.
If it happens the upside is that you won't need to use Tor anymore and can just serve your forum using the normal internet and a normal domain. Cheesy

I'm sure your username here is "really" pussy and not psy

Anyways can you fat losers stop worrying about MY Tor Hidden Service like a bunch of retard freaks? Cheesy THANKS
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 09:39:25 PM
 #26

I seriously doubt my real IP address will be compromised if vBulletin gets hacked... do you people even know what the fuck you're talking about?

There was this jackass idiot who said previously that a TRUECRYPT volume is useless when it is mounted because you can change the password, I MEAN WHAT THE FUCK, are you some kind of Truecrypt virginal whore or something... no the password and the keyfiles cannot be changed when it's mounted freak...

Now the next time people suggest something bad is going to happen, I suggest they explain the WHOLE POSSIBILITY OF IT and EXACTLY how it'll happen because I am paying a professional hacker to test my security and he's calling some of you bullshitters.
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:11:10 PM
 #27

I seriously doubt my real IP address will be compromised if vBulletin gets hacked

Yes it will. I guarantee you there is atleast 1 vulnerability out there that can be used to get the server to spit out the real IP.

Anyways, if they compromise vbulletin, chances are they can work their way up to rooting the server. Once they do that, your screwed because yes they can get the IP extremely easily then, and they can basically go to town on your server and website.

do you people even know what the fuck you're talking about?

Of course we do, your the one who's claiming we're wrong because you don't like what we are saying.

I am paying a professional hacker to test my security


If you do hire a hacker to audit your website, he will tell you to get rid of vbulletin and replace it with something else.

Okay genius, explain how they are going to get my or others IP address when everyone is using Tor. Also, the server will be in a far off physical location, not at my house.

My professional hacker tells me that anything is hackable, therefore it's really just choosing the lesser of two evils.
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1358
Merit: 1002



View Profile
March 09, 2012, 10:14:41 PM
 #28

I seriously doubt my real IP address will be compromised if vBulletin gets hacked... do you people even know what the fuck you're talking about?

There was this jackass idiot who said previously that a TRUECRYPT volume is useless when it is mounted because you can change the password, I MEAN WHAT THE FUCK, are you some kind of Truecrypt virginal whore or something... no the password and the keyfiles cannot be changed when it's mounted freak...

Now the next time people suggest something bad is going to happen, I suggest they explain the WHOLE POSSIBILITY OF IT and EXACTLY how it'll happen because I am paying a professional hacker to test my security and he's calling some of you bullshitters.

Well motherfucker, let me tell you something: I'm a linux sysadmin on my day job. I mean, WHAT THE FUCK, even today, after 4 years on the job I don't feel confident enough to cover all my tracks in the case I was running an hidden service, hence why I refuse to run one, and probably I'm more qualified to do it than you.
What blazr said is true: Once they pwn your web app it's only a matter of time until they root your server, hell, they don't even need to do that: just fire up some secure shell(doesn't have to be root for it, any other user with a password for ssh will do) and use wget to fetch a file from a server the hacker controls and BAM, he has your IP. Difficult, not really. Difficult to you, for sure...
To avoid what I described previously, tell me please how will you make sure that ANY connection from that server will get routed trough Tor. Please? I also need that answer. Maybe I'll feel qualified enough to run an hidden service after having that answer.

Now get lost, and remember, never ask for opinions when all you want is a patt on the back...
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:25:55 PM
 #29

I seriously doubt my real IP address will be compromised if vBulletin gets hacked... do you people even know what the fuck you're talking about?

There was this jackass idiot who said previously that a TRUECRYPT volume is useless when it is mounted because you can change the password, I MEAN WHAT THE FUCK, are you some kind of Truecrypt virginal whore or something... no the password and the keyfiles cannot be changed when it's mounted freak...

Now the next time people suggest something bad is going to happen, I suggest they explain the WHOLE POSSIBILITY OF IT and EXACTLY how it'll happen because I am paying a professional hacker to test my security and he's calling some of you bullshitters.

Well motherfucker, let me tell you something: I'm a linux sysadmin on my day job. I mean, WHAT THE FUCK, even today, after 4 years on the job I don't feel confident enough to cover all my tracks in the case I was running an hidden service, hence why I refuse to run one, and probably I'm more qualified to do it than you.
What blazr said is true: Once they pwn your web app it's only a matter of time until they root your server, hell, they don't even need to do that: just fire up some secure shell(doesn't have to be root for it, any other user with a password for ssh will do) and use wget to fetch a file from a server the hacker controls and BAM, he has your IP. Difficult, not really. Difficult to you, for sure...
To avoid what I described previously, tell me please how will you make sure that ANY connection from that server will get routed trough Tor. Please? I also need that answer. Maybe I'll feel qualified enough to run an hidden service after having that answer.

Now get lost, and remember, never ask for opinions when all you want is a patt on the back...

WOW a sysadmin that doesn't have an idea of how a Tor hidden service works lmfao... HOW ELSE CAN PEOPLE access that hidden service if not through TOR?

NOW YOU GET LOST, I DON'T LIKE YOUR OPINION AND I SURE AS HELL DON'T HAVE TO TAKE IT.
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:27:37 PM
 #30


Okay genius, explain how they are going to get my or others IP address when everyone is using Tor. Also, the server will be in a far off physical location, not at my house.


Step 1. Find vulnerability in VBulletin or server.
Step 2. Get root on server.
Step 3. Type "ping" followed by an IP address of a computer they control
Step 4. Check firewall log on controlled PC and recover IP
Step 5. ??
Step 6. Profit

or

Step 1. Find vulnerability in VBulletin
Step 2. Use vulnerability to get vbulletin to request a page from a script hosted on a webserver controlled by hacker
Step 3. Check server log on webserver and recover IP, or even have the script record the IP address
Step 4. ??
Step 5. Profit

Also, I hired a hacker who hired a hacker who says your hired hacker is talking shit.

Okay so you seem to think that for some reason, just hacking a simple message board and getting to the root will allow people to circumvent TOR....?
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1358
Merit: 1002



View Profile
March 09, 2012, 10:29:21 PM
 #31


Okay genius, explain how they are going to get my or others IP address when everyone is using Tor. Also, the server will be in a far off physical location, not at my house.


Step 1. Find vulnerability in VBulletin or server.
Step 2. Get root on server.
Step 3. Type "ping" followed by an IP address of a computer they control
Step 4. Check firewall log on controlled PC and recover IP
Step 5. ??
Step 6. Profit

or

Step 1. Find vulnerability in VBulletin
Step 2. Use vulnerability to get vbulletin to request a page from a script hosted on a webserver controlled by hacker
Step 3. Check server log on webserver and recover IP, or even have the script record the IP address
Step 4. ??
Step 5. Profit

Also, I hired a hacker who hired a hacker who says your hired hacker is talking shit.

Okay so you seem to think that for some reason, just hacking a simple message board and getting to the root will allow people to circumvent TOR....?

One more time: HOW WILL YOU MAKE SURE THAT ALL AND ANY OUTGOING CONNECTION FROM YOUR SERVER WILL GET ROUTED TROUGH TOR?

Answer that. I said I will be grateful...
You seem to forget that Tor traffic still uses the normal internet... Or your version of Tor is a completely different network that bypasses the internet?

BTW, you are also forgetting about
hostname -i
and
/etc/hosts

or whatever are the OpenBSD equivalents for them.
both will give you your IP, which is needed for the server to work.
Of course you could use a VPS inside a dedicated server, and if you did it, it would probably show the local IP, but that wasn't what you described, you moron...

FFS, such a n00b you are...
Red Emerald
Hero Member
*****
Offline Offline

Activity: 742
Merit: 500



View Profile WWW
March 09, 2012, 10:31:56 PM
 #32

There are LOTS of ways for people to figure out your IP even when protected by Tor.  "[Tor] is experimental software. Do not rely on it for strong anonymity".  There are also LOTS of things needed to make sure you are as secure as possible.

If you think just setting up a tor hidden service that points to apache is enough to hide yourself, you really should do more research.

Maybe look at TorBOX for some tips on security.

https://trac.torproject.org/projects/tor/wiki/doc/TorBOX

Red Emerald
Hero Member
*****
Offline Offline

Activity: 742
Merit: 500



View Profile WWW
March 09, 2012, 10:42:42 PM
 #33


Okay so you seem to think that for some reason, just hacking a simple message board and getting to the root will allow people to circumvent TOR....?

Finally you understand!

Yes, getting the root WILL allow anyone to circumvent tor, theres absolutely no way you can stop that, unless your Jesus or you you have some sort of magic genie.

when you root a server, you can do whatever the fuck you want.

The only way that woudln't happen is if you dug up every road in the world and layed down your own fiberoptic cable and built your own internet, as pointed out by psy above. I would suggest doing that if you wanted to use VBulletin on TOR and wanted to be 100% sure nobody could get the IP address.
Put your webserver behind a firewall that ONLY allows out Tor traffic and you will be better off.

Internet -> Firewall -> Tor Gateway -> Web Server

Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1358
Merit: 1002



View Profile
March 09, 2012, 10:55:07 PM
 #34

Internet -> Firewall -> Tor Gateway -> Web Server

That is actually true. I got a bit carried away there and didn't think it through fully, but the OP's layout would still allow the remote IP to be discovered.

What got us carried away was the fact that, like I said, the OP asked for opinions when all he wanted was a patt on the back while saying "Good job, fellow...".
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:56:07 PM
 #35


Okay so you seem to think that for some reason, just hacking a simple message board and getting to the root will allow people to circumvent TOR....?

Finally you understand!

Yes, getting the root WILL allow anyone to circumvent tor, theres absolutely no way you can stop that, unless your Jesus or you you have some sort of magic genie.

when you root a server, you can do whatever the fuck you want.

The only way that woudln't happen is if you dug up every road in the world and layed down your own fiberoptic cable and built your own internet, as pointed out by psy above. I would suggest doing that if you wanted to use VBulletin on TOR and wanted to be 100% sure nobody could get the IP address.
Put your webserver behind a firewall that ONLY allows out Tor traffic and you will be better off.

Internet -> Firewall -> Tor Gateway -> Web Server

Do you mean just any NAT router? I personally wanted to use an OpenBSD firewall. Also what's the point of an OpenBSD router/firewall, OBSD TOR GATEWAY and OBSD server?
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:56:34 PM
 #36

Internet -> Firewall -> Tor Gateway -> Web Server

That is actually true. I got a bit carried away there and didn't think it through fully, but the OP's layout would still allow the remote IP to be discovered.

What got us carried away was the fact that, like I said, the OP asked for opinions when all he wanted was a patt on the back while saying "Good job, fellow...".

LMAO yeah right, like you know me...
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 09, 2012, 10:59:53 PM
 #37

Just get lost
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1358
Merit: 1002



View Profile
March 09, 2012, 11:07:23 PM
 #38

Just get lost

You can always put us(and the rest of the forum probably) on your extensive ignore list...
Red Emerald
Hero Member
*****
Offline Offline

Activity: 742
Merit: 500



View Profile WWW
March 10, 2012, 06:39:40 AM
 #39


Okay so you seem to think that for some reason, just hacking a simple message board and getting to the root will allow people to circumvent TOR....?

Finally you understand!

Yes, getting the root WILL allow anyone to circumvent tor, theres absolutely no way you can stop that, unless your Jesus or you you have some sort of magic genie.

when you root a server, you can do whatever the fuck you want.

The only way that woudln't happen is if you dug up every road in the world and layed down your own fiberoptic cable and built your own internet, as pointed out by psy above. I would suggest doing that if you wanted to use VBulletin on TOR and wanted to be 100% sure nobody could get the IP address.
Put your webserver behind a firewall that ONLY allows out Tor traffic and you will be better off.

Internet -> Firewall -> Tor Gateway -> Web Server

Do you mean just any NAT router? I personally wanted to use an OpenBSD firewall.
Well how popular is your forum going to be? If you think a cheap NAT router is enough to handle the bandwidth, that is probably fine.

As far as firewalls go, I've been liking pfsense.

Quote
Also what's the point of an OpenBSD router/firewall, OBSD TOR GATEWAY and OBSD server?

Go read the TorBox link.

Even if someone hacks your hidden server software (thttpd, apache, etc.), he can not steal your hidden service key. The key is stored on the Tor-Gateway. Once you cleaned your Tor-Workstation, no one can impersonate your hidden service anymore.

EDIT: Here is another helpful link. https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/OptionalConfigurations#Hostinghiddenservices

btctrader22
Newbie
*
Offline Offline

Activity: 45
Merit: 0



View Profile
March 10, 2012, 10:34:44 AM
 #40

LMAO yeah right, like you know me...

You didnt explain why you want to setup a tor thing. Do u rly need all that security ?
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 10, 2012, 07:32:06 PM
 #41

LMAO yeah right, like you know me...

You didnt explain why you want to setup a tor thing. Do u rly need all that security ?

Actually I'm just a big security fanboy hehehe, it's the greatest hobby ever. Cryptography has got to be the coolest hobby ever.
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 10, 2012, 09:05:39 PM
 #42

LMAO yeah right, like you know me...

You didnt explain why you want to setup a tor thing. Do u rly need all that security ?

Actually I'm just a big security fanboy hehehe, it's the greatest hobby ever. Cryptography has got to be the coolest hobby ever.
sadly, you suck at it.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 10, 2012, 09:26:45 PM
 #43

Sadly you're a gay bitch cunt who should die in a pit alone and deprived.
speshlk
Newbie
*
Offline Offline

Activity: 5
Merit: 0


View Profile
March 10, 2012, 09:40:00 PM
 #44

Sadly you're a gay bitch cunt who should die in a pit alone and deprived.

A bit over the top, wouldn't you say?

A hidden service is something to be taken seriously... especially if there is any material there shouldn't be on there...
Regardless, I'll be frank in saying that I'd suggest you get a little more experience under your belt (not only in ... err... Cryptography...).
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 10, 2012, 09:42:08 PM
 #45

Sadly you're a gay bitch cunt who should die in a pit alone and deprived.
What is wrong with being homosexuel? You narrow minded piece of shit.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 10, 2012, 09:47:01 PM
 #46

Guys, just let this thread die. This kid asked for advice but won't listen to it.

I rate your hidden service 0/10
+1

0/10 from me too.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
marked
Full Member
***
Offline Offline

Activity: 168
Merit: 100



View Profile
March 10, 2012, 10:13:23 PM
 #47

Actually I'm just a big security fanboy hehehe, it's the greatest hobby ever. Cryptography has got to be the coolest hobby ever.

Cryptography is never, and can never be a "hobby". If you think so, you have no understanding of the issues involved in security, and certainly should not even be thinking of running a service.

Quote
Internet --> Modem --> Sonicwall TZ215 --> OpenBSD firewall appliance --> OpenBSD Server with TOR Hidden Service

Notes
-OpenBSD is considered to be the most secure OS out there
The most secure free and publically available maybe - but it is not the most secure.

Quote
-OBSD comes with military grade encryption
Military grade encryption = minimum requirements to work at specific levels due to the complexity required to crack the data through brute force- potential key compromise. (according to country - Unclassified, Restricted, Secret, Top Secret, Code-word clearance). Which category does OpenBSD fall into? Continuously evaluated with recommendations published frequently, and new competitions to produce alternatives (c.f. SHA3). Once upon a time MD4 was military strength, but is now crackable in microseconds, particularly with rainbow tables. DES similarly was military strength, again crackable through brute force with a moderately cheap GPU.

Quote
Now my only problem is whether I can successfully run vBulletin with OpenBSD as a server.

and you want to run a perfectly secure OS with three of the most buggy, incapable bits of software in PHP, vBulletin and MySQL? I don't think you can find more incapable bits of software for a secure system if you tried. (I'd be interested to know)

If you want evidence read any of the following.
Bugtraq
packetstorm
Seclist.org

If you aren't reading any of them then you certainly shouldn't be claiming that you can run a service responsibly. If you don't know what any of the above are then you should not be running anything period. For at least a year. Maybe more.

In fact you should also be reading the Tor and Onion mailing lists on a daily basis.

You should be capable of compiling and analysing the code, for any claim to be substantiated.

The setup is nice an everything but the vBulletin track record on security is not that great. Everything else is useless if some remote exploit can reveal the servers ip address.

How is that possible when used in conjunction with TOR?

because you have access to the computers network if you have compromised the application software/database, thereby being able to obtain the IP address - particularly useful if you have uPnP enabled, and other unicast/multicast protocols on the network (dhcp, bonjour/zeroconf etc.). VMs can be susceptible dependent on the virtualisation configuration. Does a chroot jail ring a bell?

Just to be clear, OpenBSD is not, and never will be the securest Operating System. Whilst it does a very good job of being secure, it has no independent formal verification.

Please look up the terms Common Criteria, NIST, NSA, EAL (particularly EAL4+ ALC.FLR.*) and

Most importantly you seem not to have read the mailing lists and website that tell you how to do exactly what you want to do without causing problems. (hint. it's a VM solution, with a firegap.)


marked
jake262144
Full Member
***
Offline Offline

Activity: 210
Merit: 100


View Profile
March 10, 2012, 11:45:49 PM
Last edit: March 11, 2012, 11:30:48 AM by jake262144
 #48

... Cryptography has got to be the coolest hobby ever.
Cryptography as a hobby, Lord save us Roll Eyes

The last time incompetent folks(1) tried to tackle cryptography WEP encryption standard for Wi-Fi networks was developed. The authors fell into disgrace and were sorry ever after.
Mind you, WEP did use very decent crypto at the time (the RC-4 stream cipher is "military-grade", it just was employed in the wrong fashion).
Cryptography is a means to an end, not a design goal by itself.

1/10 for not going with a Windows box as the server. That's gotta amount for something - at least the service won't catch a worm all by itself.

Notes:
(1) very competent hardware and radio engineers, just no security experts
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 11, 2012, 02:11:58 AM
 #49

Just found selinux
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 11, 2012, 02:30:30 AM
 #50

Why the hell do you keep talking?
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 11, 2012, 08:38:27 AM
 #51

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1358
Merit: 1002



View Profile
March 11, 2012, 12:44:59 PM
 #52

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 11, 2012, 06:40:16 PM
 #53

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...

Not that hard to understand: I went and looked at a couple of threads he started.
Root cause identified: IQ


https://bitcointalk.org/index.php?topic=67437.msg784506#msg784506

the dude, can't even do math! lulz!

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
boconniff40 (OP)
Newbie
*
Offline Offline

Activity: 28
Merit: 0


View Profile
March 12, 2012, 05:57:21 PM
 #54

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...
'

OF COURSE MORON, NO AVERAGE PERSON KNOWS WHAT THE FUCK YOU TECHNO GEEKS ARE SAYING... YOU ROOT YOU DIE BLAH BLAH BLAH... you think average people just magically know what the fuck you're talking about?
Red Emerald
Hero Member
*****
Offline Offline

Activity: 742
Merit: 500



View Profile WWW
March 12, 2012, 05:59:05 PM
 #55

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...
'

OF COURSE MORON, NO AVERAGE PERSON KNOWS WHAT THE FUCK YOU TECHNO GEEKS ARE SAYING... YOU ROOT YOU DIE BLAH BLAH BLAH... you think average people just magically know what the fuck you're talking about?
I expect someone who talks about the security benefits of OBSD to know what root means.

I also don't expect average people to be setting up Tor Hidden Services.

kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 12, 2012, 06:29:11 PM
 #56

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...
'

OF COURSE MORON, NO AVERAGE PERSON KNOWS WHAT THE FUCK YOU TECHNO GEEKS ARE SAYING... YOU ROOT YOU DIE BLAH BLAH BLAH... you think average people just magically know what the fuck you're talking about?
first you are a military grade cryptographer.
then you are avarage joe.

whats next? astronaut?

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 12, 2012, 06:45:33 PM
 #57

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...
'

OF COURSE MORON, NO AVERAGE PERSON KNOWS WHAT THE FUCK YOU TECHNO GEEKS ARE SAYING... YOU ROOT YOU DIE BLAH BLAH BLAH... you think average people just magically know what the fuck you're talking about?

Gentlemen, I rest my case.

but.. but.. its now its getting fun Cheesy

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
Gabi
Legendary
*
Offline Offline

Activity: 1148
Merit: 1008


If you want to walk on water, get out of the boat


View Profile
March 12, 2012, 07:12:21 PM
 #58

Posting in an epic thread

kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 12, 2012, 08:26:22 PM
 #59

Just found selinux
and ...?

The logic still applies: your rooted your dead. Fancy pseudo-security, does not help you.

That concept seems very difficult to grasp for him. Still don't understand why...
'

OF COURSE MORON, NO AVERAGE PERSON KNOWS WHAT THE FUCK YOU TECHNO GEEKS ARE SAYING... YOU ROOT YOU DIE BLAH BLAH BLAH... you think average people just magically know what the fuck you're talking about?

How many average people do you know that run Tor hidden services?

The only people that should run Tor services are tinfoil hat wearing paranoid schizophrenics that spend their day trying to block the governments mind control satellites.
the tinfoil hats don't work, they actually amplifies the brain waves.
Quote
The helmets amplify frequency bands that coincide with those allocated to the US government between 1.2 Ghz and 1.4 Ghz. According to the FCC, These bands are supposedly reserved for ''radio location'' (ie, GPS), and other communications with satellites (see, for example, [3]). The 2.6 Ghz band coincides with mobile phone technology. Though not affiliated by government, these bands are at the hands of multinational corporations.
-http://berkeley.intel-research.net/arahimi/helmet/

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
kokjo
Legendary
*
Offline Offline

Activity: 1050
Merit: 1000

You are WRONG!


View Profile
March 12, 2012, 08:41:32 PM
 #60

the tinfoil hats don't work, they actually amplifies the brain waves.
Quote
The helmets amplify frequency bands that coincide with those allocated to the US government between 1.2 Ghz and 1.4 Ghz. According to the FCC, These bands are supposedly reserved for ''radio location'' (ie, GPS), and other communications with satellites (see, for example, [3]). The 2.6 Ghz band coincides with mobile phone technology. Though not affiliated by government, these bands are at the hands of multinational corporations.
-http://berkeley.intel-research.net/arahimi/helmet/

WHAT?

LOL! Of all frequencies to amplify, it actually amplifies those used by GPS.

We're all screwed.
didn't you know? NOOB!

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
Pages: 1 2 3 [All]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!