How the Mevade botnet paralyzed Tor

This episode explores the unprecedented crisis that struck the Tor network in August 2013, as detailed in the paper "Challenges in Protecting Tor Hidden Services from Botnet Abuse". The podcast examines how the Mevade (or Sefnit) botnet caused a sudden and drastic degradation of the network by running its command-and-control (C&C) server as a Tor hidden service. Listeners will learn how the infected machines artificially inflated daily Tor users from under one million to nearly six million in just three weeks, doubling download times for regular users. The episode breaks down the technical reasons behind the network's near-paralysis. The issue wasn't a lack of overall bandwidth, but rather an overwhelming processing load placed on Tor relays. This load was caused by the massive increase in cryptographic key exchanges (called "onion skins") required to build the anonymous circuits. Because the hidden service protocol requires at least three circuits to be built every time a bot connects, the relays' decryption queues quickly filled up. This led to widespread connection timeouts, which in turn caused the bots to send even more circuit requests, creating a vicious cycle.Finally, the podcast discusses the long-term technical strategies proposed by researchers to protect Tor from future botnet abuse. The episode explores several countermeasures, including resource-based throttling that makes connecting computationally expensive (using Proof of Work or CAPTCHAs), rate-limiting circuit requests directly at the entry guard nodes, reusing partially failed circuits to reduce overall network load, and completely isolating hidden service traffic processing from regular Tor traffic.