GoBalance Flaw Enables .onion Address Hijacking via Secret Key Recovery

A critical flaw discovered in the GoBalance tool, widely used by dark web sites to maintain reachability during attacks, presents a significant risk to the integrity of .onion addresses. The vulnerability, disclosed by Searchlight Cyber on October 8, allows threat actors to recover the secret private key associated with a .onion address by leveraging publicly available information. This recovery enables attackers to hijack the address, redirecting unsuspecting visitors to malicious replicas of the targeted site.

The mechanism of the attack exploits how .onion addresses are generated and managed. An .onion address is fundamentally derived from a public key, meaning the holder of the corresponding private key controls the address. To ensure continuous accessibility, sites publish signed records known as descriptors. The vulnerability lies within GoBalance's signing process, where it incorrectly passes only the first 32 bytes of a 64-byte Tor private key to the signer, omitting the crucial second half that safeguards the signature's secret value. Without this half, the secret value becomes predictable, allowing a single published descriptor to be sufficient for recovering the site's master private key.

This exposed key is a long-term master key, not a temporary one, meaning a compromised key can be used to sign valid records for the .onion address indefinitely into the future. This poses a persistent threat to any site that has been affected. Searchlight Cyber has clarified that the original Onionbalance tool and the Tor network itself are not affected by this specific flaw. The vulnerability is confined to the GoBalance rewrite and specifically impacts sites whose master keys are stored in Tor's native key format. Fortunately, GoBalance's setup tool typically writes keys in a more secure format, meaning not all sites utilizing GoBalance are necessarily at risk.

The real-world implications of this vulnerability were starkly demonstrated by the hijacking of Dread, one of the dark web's largest forums. Between October 5 and 7, both of Dread's .onion addresses were compromised and redirected to a competing site, Conclave. Initially, Dread's administrators suspected an internal error, with one administrator admitting to inadvertently uploading the main onion private key into a GoBalance update. However, the subsequent takeover of a second, backup address suggested a more sophisticated attack, leading administrators to believe a GoBalance flaw was exploited against multiple dark web services.

Following the incident, Dread migrated to a new .onion address and advised its users to reset their passwords on the forum and other sites, citing the exposure of their onion private key due to a third-party software vulnerability. They assured users that their servers were not breached. The extent of the impact on other dark web services remains unclear, though Dread's operators indicated that several other markets, including some that had already ceased operations, had their addresses similarly hijacked. Omega, another dark web market, publicly confirmed it took its old address offline due to the GoBalance bug and moved to a new one.

As of October 9, there is no official patch or CVE identifier for this vulnerability. The Tor Project and GoBalance's maintainer have not yet issued public advisories. However, an independent researcher has developed a patch and a proof-of-concept demonstrating the key recovery process from a single public descriptor, though this was reportedly done without targeting any live services. Dread has stated its intention to release a patched version of GoBalance and assist affected sites with migration.

For site operators, the exposure of a private key means that simply patching the software is insufficient. Because a leaked key cannot be revoked once its associated descriptor has been published, affected sites must create entirely new .onion addresses and migrate their operations, as Dread and Omega have done. Users of potentially compromised sites are strongly advised to change their passwords and treat the old addresses as untrustworthy. Verifying any new addresses through official, signed announcements is crucial before resuming activity.