GoBalance Flaw Can Expose Tor Onion-Service Keys and Enable Address Hijacking
Summary
A flaw in GoBalance can let attackers recover some Tor onion services’ master keys from a public descriptor and hijack their addresses. Dread and Omega moved to new addresses; affected operators must migrate because published keys cannot be recalled.
Key points
- GoBalance passed only half of a 64-byte Tor private key to its signer, making a secret value predictable and allowing recovery of the master key from one public descriptor.
- A recovered master key can be used to sign valid records and redirect visitors, but does not grant access to the service's servers, database, or stored user data.
- Exposure is limited to sites whose master keys use Tor's own key format; GoBalance's setup tool uses a safer format. Tor itself and the original Onionbalance are not affected.
- Dread's two onion addresses were taken over and redirected to a rival site; Dread says its servers were not breached. Omega also confirmed it moved from its old address because of the bug.
- No official fix or CVE was available at the time of the report. Dread planned a patched GoBalance release, and an independent researcher published a patch and proof of concept.
- Operators who used a vulnerable setup must create a new onion address and migrate; changing software alone cannot undo exposure of a key in a published descriptor.
- Users of potentially affected sites were advised to change passwords, treat old addresses as unsafe, and verify replacement addresses through signed announcements.
Article Details
- Vulnerability Types
- Cryptographic private-key recovery caused by truncating Tor private keys during signing
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Create a new .onion address and migrate to it; publishing a descriptor means the exposed key cannot be withdrawn.
People
Products
GoBalanceA bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that addressOnionbalanceGoBalance is a version of Tor's Onionbalance load balancer rewritten in Go, and it ships with EndGame, a widely used toolkit that keeps dark web sites online during denial-of-service attacks. The flaw is in the rewrite.Torthe address. To stay reachable, a site publishes a signed record, called a descriptor, that anyone on the Tor network can fetch, and GoBalance signs that record.