x.comthreadDark Web Informer (@DarkWebInformer) on X
Post announcing a PoC and security patch for two critical GoBalance (Tor onion service load balancer) takeover flaws, reportedly used in attacks on the Dread and Omega darknet markets. The first flaw reuses or mishandles the nonce in blinded signing, so a single public descriptor lets an attacker recover the onion service's master identity key. The second accepts forged instance descriptors without signature and identity-binding checks, which allows full frontend traffic hijacking. The linked package includes a PoC for both paths, a patched source tree, regression tests and a unified patch. It affects master at commit bb1b0f3.
TL;DR PoC and patch for two critical GoBalance flaws (master key recovery from a descriptor via a blinded-signing nonce bug, and forged instance descriptors), reportedly exploited against Dread and Omega.
Organisations named here
- blinded signing
- descriptor forgery
- Dread
- Omega Darknet Market
- onion service master identity key
Technologies named here
- GoBalance
- GoBalance master branch at commit bb1b0f3
- GoBalance onion services
- PoC from GitHub
- Tor
- Go
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup