GoBalance Flaw Lets Attackers Hijack .onion Addresses

On October 8, Searchlight Cyber disclosed a flaw in GoBalance, a tool many dark-web sites rely on to stay reachable during attacks. The bug lets anyone work out the secret key that controls a site's .onion address using only public information, and then take the address over. Hijacking the address does not grant access to the site's servers, database, or stored user data.

How the flaw works

An .onion address is essentially a public key, and whoever holds the matching private key controls it. To stay reachable, a site publishes a signed record — a descriptor — that any Tor node can fetch, and GoBalance signs it.

The trouble lies in the signing step. A Tor private key is 64 bytes long, but GoBalance passed only the first 32 bytes to the signer and dropped the rest. The discarded half is precisely what keeps each signature's secret value hidden. Without it, that value becomes a fixed number anyone can compute. A single published descriptor is then enough to recover the site's private key, with no access to its servers. Because the exposed key is the long-term master key, a recovered key can sign valid records for the address far into the future.

Who is at risk

GoBalance is a Go rewrite of Tor's Onionbalance load balancer, shipped with EndGame, a widely used toolkit that keeps dark-web sites online during denial-of-service attacks. The flaw is in the rewrite: the original Onionbalance and Tor itself are unaffected. It also hits only sites whose master key is stored in Tor's own key format; GoBalance's setup tool writes keys in a safer format, so not every site running it is exposed.

The Dread takeover

The flaw surfaced through Dread, one of the dark web's biggest forums, run by administrators known as HugBunter and Paris. Between October 5 and 7, both of Dread's .onion addresses were seized and redirected to a rival site, Conclave. The operators first blamed their own mistake: Paris said he had "stupidly uploaded dread's main onion private key into a gobalance update." But two days later the backup address was taken over too — harder to pass off as a slip — and HugBunter said an attacker had used a GoBalance flaw against several services. Searchlight agrees.

Dread has moved to a new address and told users to change their passwords. The market Omega also confirmed the issue, moving to a new address on October 8 "due to an issue caused by the GoBalance bug."

No fix yet

There is no official patch: as of October 9 there was no CVE identifier and no advisory from the Tor Project or GoBalance's maintainer. An independent researcher published a patch and a working proof-of-concept that recovers a master key from a single descriptor (using test keys only, by his account). Dread says it plans to release a patched version.

A patch does not undo the exposure: once a descriptor is public, the leaked key cannot be pulled back, and a site must create a new .onion address. Users are advised to change passwords and to trust a new address only after a signed announcement.

Source: The Hacker News