Home » Featured » Agora Marketplace Changes Url Due to Heartbleed SSL Bug
Click Here To Hide Tor

Agora Marketplace Changes Url Due to Heartbleed SSL Bug

Update: Market is back up and running at the new url:  http://agorahooawayyfoe.onion/register/Gc2h4eoFAE

Agora Marketplace was taken down by its admins due to the Heartbleed bug – to move it servers and change the sites url, if you try to browse the old site you will now get the below message, listing the new urls – they say that the site will be back till the end of the week (but you know how it is – can easily take longer than expected) we have received some info stating that once the site will be back up – change of passwords and pins will be needed and most likely even enforced once the site goes live again.

Message from te old url:

===Start Quote===

Agora Announcement 2014-04-11

Earlier this week the details of a serious bug in the OpenSSL library were made public. This bug, which affected a large number of web servers and devices was popularly referred to as ‘Heartbleed’. The bug allows anybody connecting to a vulnerable service to reveal the contents of memory on the server – and thus reveal secret keys, user information, passwords, etc.

There is more information about the bug and the versions of OpenSSL that are affected at the website setup for the bug:

http://heartbleed.com/

Agora is a hidden service served on the Tor network, and while Agora itself does not use the vulnerable library, the Tor software that makes up the network was affected by this bug in some instances since it integrates the OpenSSL library. The Tor project wrote a blog post about how this bug affects various aspects of the Tor service:

https://blog.torproject.org/blog/openssl-bug-cve-2014-0160

For users of the Tor Browser Bundle you should upgrade to the latest release version immediately, as the bundled version of Tor is vulnerable to the attack. Get the latest Tor Browser Bundle version from http://torproject.org

For Agora as a hidden service, we have investigated the possibilities of exploitation and to our current best knowledge, the most an attacker could hope to gain in a hypothetical situation of successful exploitation, is the ability to impersonate the hidden service.

The Tor blog post on this subject states:

“Like the last big OpenSSL bug, this shouldn’t allow an attacker to identify the location of the hidden service, but an attacker who knows the hidden service identity key can impersonate the hidden service.”

At this time even an attack like that is looking unlikely and we haven’t seen any signs of it being successfully executed. However, since the underlying bug is very serious and has been in the wild for an unclear amount of time, we will be taking the necessary precautions and shall hereby recycle all our previously used hidden service keys.
Effectively this means that we need to change the address of the market.
Additionally we have decided to take the market down for some time so we can fully investigate the effects and change all servers used by it in order to fully protect ourselves from any hypothetical damage or information leaks. We estimate that this process will be complete by the end of the week. We do understand that this is a big inconvenience for many of you, but please understand that we do this for the sake of your anonymity as well.

The new address to be used from now on to access Agora when it’s available will be:
http://agorahooawayyfoe.onion

The address to access Agora Forums is:
http://lacbzxobeprssrfx.onion

We are constantly vigilant about new threats and the security of our market and users and are taking these steps as a precaution.

===End Quote===

Taking Agora, as its the #1 market today is most likely a big inconvenience for many people, so we only hope this will be sorted soon and the site will be back up, we will keep following and updating as needed.

20 comments

  1. Black Bank has also changed its URL. But I think those are the only two to do so thus far: everyone else seems to be ignoring it (Pandora, SR2), be on i2p (TMP), claim they didn’t have heartbeat on (Tor Escrow), etc.

  2. Has the Outlaw market changed its URL too? It seems to be having issues

  3. hey every one is agora actually open yet? i cannot get login access with these new links.. its been a few hours of trying..can any one tell us how long it will take untill we can reconet.. i have stuf t do on there thanks

  4. If I placed orders on Wednesday and Thursday you think they will go through or will I have to wait till its back on?

  5. ^^^ deepdot comes thru as always with some solid info.. i would say we should deftinly give them some time before jumping to conclusions.. these guys have been pretty solid over at agora so far.

  6. What’s the best marketplace to purchase autoflowering seeds?

  7. Agora is back online – I’m in!

    ~ Peace ~

    ~ Ernie ~

  8. This is so very embarrassed and unprofessional
    I will never dare try using Agora again no matter when
    A lot of scammer and poor support
    I won’t start about my frozen BTC in Agora wallet
    Will they pay us for interest as well?
    Totally suck -10/5

  9. Anyone know any *working* Tor URLs that work, all the ones i tried on google just say, “problem loading page”

    Wth man…

  10. lol, it looks like a lot of people and marketplaces are COMPELTELY ignoring the simple fact that a too big portion of the servers on the Tor network STILL have not upgraded their OpenSSL.

    Here is something to think about: Guard nodes KNOW where they connect to when users want to access a Tor hidden service.

    You run a hidden service, your Tor client happens to pick a guard node with exploitable openssl, now you could be screwed.

    Main takeaway here is that it does not matter if _you_ have fixed the issues on _your_ server at all. What really does matter is how much you can trust the rest of the network.

  11. Cant access agora when I type url into browser. It just keeps saying the connection was reset. I can only access it by going here to deepdotweb then to agora. Is anyone else having this issue?

  12. Yeah. WHats going on with Agora???

  13. I am new to this whole thing. I’m on Tor now, but can’t get to Agora Market. Do I have to pay money for a URL to get there? Can ANYBODY help me? :-/

  14. Can you please help me. I have my VPN established and have tor browser setup but am not having any luck getting to the agora market registration page. I mean its just this last simple step to register with them and I can’t seem to get there. PLEASE help me and tell me what I must me missing that you obviously have mastered. Thank you very much!

  15. whats with agora, and did my bitcoins go away

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Captcha: *