GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys
GoBalance signing flaw lets attackers recover Tor .onion master keys from public descriptors and hijack dark-web sites, as seen with Dread.
Searchlight Cyber disclosed that GoBalance, a Go rewrite of Onionbalance bundled with the EndGame anti-DDoS toolkit, passed only 32 of the 64 bytes of a Tor private key to its signer, exposing enough information in a single published descriptor to recover a site's long-term master key. Attackers hijacked both of Dread's .onion addresses between October 5-7, redirecting them to rival forum Conclave, and market Omega also abandoned its address over the bug. Only sites using Tor's own key format are affected; original Onionbalance and Tor are not. No CVE or official fix exists, though an independent researcher published a patch and a working proof-of-concept, and operators must migrate to new .onion addresses because leaked keys cannot be revoked.
- GoBalance truncated Tor private keys to 32 bytes, making master keys recoverable from public descriptors
- Dread's two .onion addresses hijacked October 5-7 and pointed at rival Conclave
- Original Onionbalance and Tor unaffected; only Tor-format master keys at risk
- No CVE or official fix; independent patch and PoC published
- Exposed keys cannot be revoked — affected sites must move to new .onion addresses
From the original article
4 min read at thehackernews.com
A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's . onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.