On Mon, 13 Sep 2010 14:12:35 -0400 hikki@xxxxxxxxxxxxx wrote: > When running a hidden service, obviously hidden so no one can find the > true source and IP of the web server because lives may be depended on > that, I've heard that the best and safest way is to use a dedicated > server computer with two operating systems and the server being inside a > virtual machine. So if the web server should get cracked, the cracker > will be locked inside the virtual machine and cannot do side-channel > attacks or any other clever methods to reveal the true source. > > Then I read somewhere that theres even a more secure way, and that is by > using two dedicated computers. One computer with the web server running, > > being connected with a LAN cable to the second computer which works as a > firewalled router with Tor running on it with the hidden service keys. > Again, if a cracker cracks the server machine, he will be physically > trapped inside the server and cannot access the second computer nor the > internet directly. He *would* be able to access the Ethernet card in the Internet-connected gateway box, and I have seen reports of at least one Ethernet card with an unauthenticated remote-update backdoor which could be used to take over the entire computer through DMA. At the very least, virtual network adapters are unlikely to have intentional backdoors hidden in them. > What are your opinions on this? > What should be done and what should be avoided while setting up such > systems? * First, operate the hidden service using software with no security holes, and on a (physical) computer that does not operate any Internet-visible services (especially not a Tor relay). Putting your hidden service in a virtual machine won't protect you from the side-channel attack described in âHot or Notâ. * Second, if you must use software with security holes to operate your hidden service, keep that software in a virtual machine, and do not let it communicate with a real network adapter. (The âhost-only networkâ option in VirtualBox should be safe enough, for example.) I don't see a big reason to run Tor in a VM, unless you need to set up transparent proxying and don't want to mess up your main OS installation. Robert Ransom
Attachment:
signature.asc
Description: PGP signature