# Tor Hidden Services: A Systematic Literature Review
## 5 Results and Discussion
### What Are the Main Research Areas and the Main Findings Regarding HS?
#### 5.1.1 Security
Another paper documenting a fingerprint attack [67] mentions that the larger a.onion site is, i.e., the more content it offers, the more susceptible it is to being tracked. Those that are more difficult to identify tend to be small and dynamic. [PERSON] et al. [68] also analysed fingerprinting techniques and proposed their own attack. However, they concluded that neither their attack nor other existing approaches are adapted when applied in realistic environments. Other mechanisms for de-anonymisation attacks were presented in [48, 50]. The researchers exploited the fact that the frequency of clocks in a system is affected by the temperature of the CPU. The attacker via the Tor client periodically sent large amounts  
Figure 5: de-anonymisation THS attack. of data to the hidden server, which increased its CPU temperature in such a way as to generate a clock tilt pattern, while remotely measuring changes in the clock frequencies of a set of candidate systems and trying to detect the matching pattern and thus de-anonymize the HS. Furthermore, [PERSON] et al. [59] discussed how information leaks in the configuration or content hosted on HS can be used to reveal their locations. They reviewed a considerable number of.onion sites for URLs or email addresses that pointed to regular websites to determine if they could be hosted on the same server, investigated HTTP certificates to extract candidate IP addresses, searched for specific HS strings, and used search engines to identify candidates hosting similar content. The article _Trawling for Tor Services_[25] addresses several points about hidden services, including an analysis of both DoS and de-anonymisation attacks. The authors mention that if the attacker can control the access to HS descriptors, the hidden service activity can be monitored or be completely inaccessible to clients. They also highlight that attacks to discourage large-scale hidden services do not require large amounts of resources. The main vulnerabilities are described and they offer preventive measures, but these they describe as superficial. [PERSON] et al. [26] reviewed the de-anonymisation attacks on hidden services raised in the literature. They analysed three kind of methods of attacks: the manipulating Tor cells method, the cell counting-based method, and the padding cell method. The articles analysed by them have also been addressed in this article. They concluded that all attack schemes need, at least, one client and one malicious guard node to de-anonymize the hidden service. Thus, in all attacks, HS are forced to choose the compromised guard nodes as their entry nodes. If this does not happen, no attempts to discover the identity of a server will be successful. Finally, [PERSON] and [PERSON] [69] showed that is possible to perform a man-in-the middle (MITM) attack by compromising HS's private key (taking advantage of server's vulnerabilities or misconfigurations). The main feature of this attack is that the attacker can perform it without being in the path between the client and the server. Next, we analyse studies on DoS attacks. [PERSON] et al. [25] also asserted that DoS attacks can be performed by controlling access to HS descriptors, and they stressed that these attacks to discourage large-scale hidden services do not require large amounts of resources. Although in their research, they offered preventive measures against the main vulnerabilities found, they themselves described them as superficial. According to these findings, some authors [70, 72] pointed out that if an attacker manages to position itself as a false HSDir, it can cause an eclipse attack for denial of service. In general terms, an eclipse attack is a means of attacking decentralised networks, and then isolating and hiding a specific target, rather than attacking the entire network [70]. In the case of Tor, if an opponent can control a routing table, he/she can monopolise all the incoming and outgoing extensions of the victims, so the victim will be completely hidden.