Default conf on Apache Web servers can de-anonymize your hidden service

A default setting in Apache Web servers can de-anonymize the hidden service allowing an attacker to obtain details on the hosting.

An unknown student has discovered a serious issue in Apache Web Server that could potentially de-anonymize .onion-domains and servers hidden behind the Tor-network. The student already reported the issue to the Tor Project development team for some months

“Tor makes it possible for users to hide their locations while offering various kinds of services, such as web publishing or an instant messaging server. Using Tor “rendezvous points,” other Tor users can connect to these hidden services, each without knowing the other’s network identity. ” is the description provided by the official Tor Project for the hidden service protocol.

Web sites hosted on the Tor Network could run on different web services, including an Apache Web Server, in this case anonymity of users is at risk.

The issue affects the configuration of Apache Web servers that come with the mod_status module enabled by default. The student discovered that the mod_status module could disclose the real IP address of .onion domains, allowing attackers to de-anonymize Onion Servers.

The Apache Status module allows monitoring activities of an Apache Web Server, it displays a sort of cockpit including current server statistics. The current server state includes the following information:

The number of worker serving requests
The number of idle worker
The status of each worker, the number of requests that worker has performed and the total number of bytes served by the worker (*)
A total number of accesses and byte count served (*)
The time the server was started/restarted and the time it has been running for
Averages giving the number of requests per second, the number of bytes served per second and the average number of bytes per request (*)
The current percentage CPU used by each worker and in total by Apache (*)
The current hosts and requests being processed (*)

By enabling the mod_status module, the output produced by the module would be available when accessing the URL:http://website.com/server-status/, this means that in case your .onion domain may result in exposing ‘server-status’ page.

This page would spit the sensitive backend data like server’s settings, uptime, resource usage, total traffic, virtual hosts, and active HTTP requests if enabled by default which is enough to figure out the Server location.

“On most distributions, Apache ships with a handy feature called mod_status enabled. It’s a page located at /server-status that displays some statistics, like uptime, resource usage, total traffic, enabled virtual hosts, and active HTTP requests. For security reasons, it’s only accessible from localhost by default.

This seems fairly reasonable, until you realize the Tor daemon runs on localhost. Consequently, any hidden service using Apache’s default config has /server-status exposed to the world. What could a malicious actor do in that case? They could spy on potentially sensitive requests. They could deduce the server’s approximate longitude if the timezone is set. They could even determine its IP address if a clearnet Virtual Host is present.” reads the blog post about the issue.

Operators behind hidden services running on the Apache Server need to disable the mod_status to avoid the disclosure of their identity.

To disable to mod_status run the following code:

sudo ap2dismod status

Once disabled the mod_status, users will be displayed a 403 or 404 Error message.

Pierluigi Paganini

(Security Affairs – Apache server, Tor network)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.