Breach of Daniel Winzen’s Hosting Service Takes Thousands of Tor and I2P Sites Offline
Summary
A breach of Daniel Winzen’s hosting service led to database deletions and an estimated 6,500 Tor and I2P hidden services going offline. The attacker and motive remain unknown.
Key points
- The article says intruders accessed the hosting server’s phpMyAdmin and Adminer panels using the correct management password, then deleted databases and accounts, including the root account.
- Winzen characterized the incident as a “database only” breach, saying there was no indication of further system access.
- DarkOwl estimated that about 6,500 hidden services hosted by Winzen went offline; its measurements recorded 4,887 fewer active domains between November 15 and 16, 2018.
- The article reports that a PHP imap_open() zero-day exploit had been released shortly before the attack; Winzen said he had patched it, but the article does not establish that it was used.
- DarkOwl describes the hosting service and its link list as widely used in the darknet community, with the list referenced by nearly 500 other hidden services.
- Possible motives discussed include an anti-pedophilia agenda, law-enforcement action, and an inside job; the article presents these as theories, not established explanations.
- Winzen was investigating potential server vulnerabilities before restoring services; a chat later reappeared with a clean install and an older backup.
Article Details
- Victim Organization
- Daniel Winzen’s Hosting Services
- Incident Type
- Unauthorized access to server management panels followed by deletion of SQL databases and accounts
- Incident Date
- 2018-11-15
- Affected Records
- Approximately 6,500 hosted hidden-service domains went offline; the source does not report a number of exposed records.
- Operational Impact
- The hosting services became unusable after the root account and SQL databases for chat, the onion-link list, and the hit counter were deleted. DarkOwl measured 4,887 domains going offline between November 15 and 16, and estimated that Daniel’s server hosted about 6,500 domains. The source reports no indication of further system access and describes the breach as database-only.
- Claim Status
- confirmed
People
AleksandrName the article says is also used by Twost.Big BearAntiChat forum staff member who posted a MEGA.nz link to a PDF detailing the imap_open exploit on the day of the attack.crlfNickname identified in the AntiChat post as an author of the imap_open exploit details.Daniel WinzenOperator of the breached hosting services; his updates described the event as a “database only” breach.
Products
LE-ChatDaniel’s darknet notoriety increased in 2016 when he ported Lucky Eddy’s perl-CGI LE-Chat script into PHP with mySQL or PostgreSQL backend, optimizing the environment for Tor and decreasing the darknet community’sPHPHe has also listed concern over a 0-day exploit, released exactly one day before the attack, in the imap_open() function of PHP that he has since patched.