Latest to join this default party is Tor. It so happens that default setting left unmodified in Apache Web servers can reveal details about Tor traffic handled through that particular server. As you know, the dark web which hosts .onion websites can be accessed using Tor anonymity browser. There are various methods of doing this, and one of the simplest is to use an Apache Web server along with a Tor daemon to handle the “anonymous” part of the server’s traffic. Unfortunately, a default setting in Apache Web servers, if left unmodified could leak information on the traffic that’s going on via the server, and the server itself. This was reported to the Tor Project admin and also covered on Reddit but to no avail. The issue has once again been brought to forefront by Alec Muffet, Facebook software engineer who tweeted the blog post of an unknown computer science student that explained this problem and its ramifications. The Apache server setting causing this issue is the Server Status module which comes activated by default. The output of this module is available on every server when accessing the URL: https://website.com/server-status/ This page will show data on a server’s settings, uptime, resource usage, total traffic, virtual hosts, and active HTTP requests. Details like these can help someone detect the server’s timezone, relative geographical position, language settings, and even its IP address via improperly configured virtual hosts. If you run a Tor website on top of an Apache server, you may want to check your server’s config. To quickly disable the module just run the following shell command: If you disabled the Server-Status page, when accessing its URL, you should see a 404 or 403 error message.
