GoBalance flaw exposes keys that control vulnerable Tor site addresses

Searchlight Cyber disclosed a GoBalance flaw on October 8 that lets attackers recover the key controlling a vulnerable site's .onion address from public information, The Hacker News reports. Attackers can redirect visitors to a site they control, but address takeover does not give them access to the original servers or stored data. GoBalance drops half of a Tor-format private key when signing a public address record, making the remaining signature sufficient to recover the long-term master key. Only sites using that key format are affected; Tor and the original Onionbalance are unaffected. There is no official fix. Operators whose keys were exposed must create new addresses because patching cannot revoke a recovered key.