GoBalance Flaw Lets Attackers Hijack .onion Addresses via Public Data

Searchlight Cyber disclosed on October 8 a flaw in GoBalance, a tool dark-web sites use to stay reachable during attacks. The bug lets anyone recover the secret key behind a site's .onion address from public information and redirect visitors to an attacker-controlled copy.

• Flaw disclosed on October 8 by Searchlight Cyber
• Secret key for a .onion address recoverable from public data alone
• Attacker can redirect visitors to a copy of the site they control