[fleitz]

In this case it appears that they have an insider, however, given the ability to analyze internet traffic, and given the ability to DDOS a hidden service which apparently happens quite frequently when new sites appear, with sufficient network analysis it should be possible to determine the end point of the hidden service.

Understanding of Tor

  1. Hidden services can only exist on one node.
  2. That node has a single IP or few IP addresses.
  

How to locate a hidden service given understanding of Tor.

  1. Send pulses of traffic to the hidden service (DDOS)
  2. Comb through internet traffic logs to identify which IPs saw traffic pulses.
  3. Reduce to a few statistically probable nodes matching the pulsed traffic pattern
  4. Pulse hidden service again to see if it matches the probable nodes.