My ISP also send me a message about abuse (virusses) ,and after I send them a reply that I'm running a tor node and that if they receive further abuse complaints they should just forward them to my mail for me to handle myself I didn't receive any abuse mail again :)<br>
I think my ISP is actually running some IDS with sinkholethinghies (I don't know anything about IDS'es yet, will research into it) and I can access a page with info on my IP wich shows some activity:<br><font><font face="helvetica"><font size="-1"><pre>
2011-04-05 21:56:55,85.223.49.156,29272,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,DE,,1,,,Windows,2000 SP2+, XP SP1+ (seldom 98)
2011-04-05 22:26:35,85.223.49.156,45924,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,US,,1,,,Windows,2000 SP4, XP SP1+
2011-04-04 21:04:06,85.223.49.156,20507,NL,GET /search?q=0 HTTP/1.1,downadup,Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .N...
2011-04-05 02:29:02,85.223.49.156,20507,NL,GET /?REMOVED HTTP/1.0,sality,KUKU v5.02c =REMOVED,,30184,Windows,2000 SP4, XP SP1+,,80,<a href="http://www.REMOVED.info">www.REMOVED.info</a>,,,,REMOVED,8560,...
2011-04-05 22:02:01,85.223.49.156,20507,NL,GET /search?q=0 HTTP/1.1,downadup,Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .N...
2011-04-06 01:13:53,85.223.49.156,20507,NL,.,downadup,,,21901,,,,80,,,,,REMOVED,US
2011-04-07 20:08:37,85.223.49.156,20507,NL,GET /<a href="http://tatoshko.biz?data=REMOVED==">tatoshko.biz?data=REMOVED==</a> HTTP/1.0,machbot,MachBot,,10988,Windows,2000 SP4, XP SP1+,,80,<a href="http://853c9e57.biz">853c9e57.biz</a>,,,,87.10...
2011-04-11 16:46:41,85.223.49.156,47015,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,US,,1,,,Linux,2.6 (newer, 2)
2011-04-11 15:31:23,85.223.49.156,20507,NL,GET /search?q=15 HTTP/1.0,downadup,Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727),,45931,Windows,2000 SP...
2011-04-12 04:08:30,85.223.49.156,44022,20507,NL,UTRECHT,AMERSFOORT,,tcp,sinkhole,,,REMOVED,DE,,1,,,Windows,XP/2000</pre></font></font></font>REMOVED= ip adresses (destination), dns names or things that look like http session specific things.<br>
I see one port number (destination) somewhat more (all cases of tcp,sinkhole except 1): <font size="-1"><font face="helvetica">8560 might be a virus/trojan/worm specific port ? Might be a good idea to remove this port from your exit if you get a lot of complaints (and it's not used for anything usefull)<br>
<br><br>The idea of setting up a local smtp out server with spam detection and clamav seems like a very good idea, maybe together with some tarpitting (if possible and easy) it would help a lot of users in need of smtp access and deter spammers (as they would spend hours and hours in tarpits at random when using tor) anyone can provide some good advice on how to set it up properly (I'm running FreeBSD)?</font></font> Would also be _really_ nice to maybe somehow add some header that says it was send using a tor relay with admin details so my ISP (as I would probably need to set it to relay to their smtp) will not start bitching and moaning about that to me, is it possible ? Yes? How ? ;)<br>
<br>What are the dangers of running an IDS myself ? Privacy wise I mean, could it be set up so that it knows about bad stuff hapening and in no way log other stuff ?<br><br><div class="gmail_quote">2011/4/13 <span dir="ltr"><<a href="mailto:tor-relays-request@lists.torproject.org">tor-relays-request@lists.torproject.org</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Send tor-relays mailing list submissions to<br>
<a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:tor-relays-request@lists.torproject.org">tor-relays-request@lists.torproject.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:tor-relays-owner@lists.torproject.org">tor-relays-owner@lists.torproject.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of tor-relays digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Tor and Viruses (Porcelain Mouse)<br>
2. Re: Tor and Viruses (grarpamp)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 12 Apr 2011 20:46:21 -0700 (PDT)<br>
From: Porcelain Mouse <<a href="mailto:porcelain_mouse@q.com">porcelain_mouse@q.com</a>><br>
Subject: [tor-relays] Tor and Viruses<br>
To: Tor-Relays <<a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a>><br>
Message-ID: <alpine.LFD.2.02.1104122018100.5770@localhost.localdomain><br>
Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII<br>
<br>
Greetings All,<br>
<br>
I've been running an exit for about 5 months, but had to stop due<br>
to virus abuses. In the last two weeks, my ISP has partially blocked my<br>
Internet access twice due to suspected virus infections. I'll spare you<br>
the long story, but I was able to get a copy of their "evidence" and I'm<br>
fairly certain it was connections made through my Tor relay.<br>
<br>
1) How common is it that Tor is abused by viruses? What is the trend?<br>
2) Is this just standard virus-kit material, these days?<br>
<br>
I guess I was a little surprised. Obviously, this is a great idea for<br>
hiding the infection site, so I'm sure it's being done. But still, I've<br>
been fighting viruses for quite a while and I don't think I've read a<br>
single virus description that mentioned Tor. I'm sure it's happening, but<br>
I've never heard a single statistic about it, so I thought I would ask.<br>
<br>
Also, this type of abuse is *not* mentioned on the Tor wiki's Abuse FAQ<br>
under "What should I expect if I run an exit relay?" I read that section<br>
carefully and was prepared for most of the things mentioned. Again, I'm<br>
not completely shocked. I'm just saying it didn't seem likely, according<br>
to the FAQ. It would be nice to know how likely is this kind of abuse,<br>
and what is the trend. (And, maybe someone can add the results to the FAQ<br>
when we have an answer.)<br>
<br>
Thanks,<br>
PMouse<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 13 Apr 2011 03:19:27 -0400<br>
From: grarpamp <<a href="mailto:grarpamp@gmail.com">grarpamp@gmail.com</a>><br>
Subject: Re: [tor-relays] Tor and Viruses<br>
To: <a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a><br>
Message-ID: <<a href="mailto:BANLkTikwPS6JDqKMvaxxWhgq2dUoGELKKA@mail.gmail.com">BANLkTikwPS6JDqKMvaxxWhgq2dUoGELKKA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset=UTF-8<br>
<br>
> my ISP has partially blocked my Internet access twice<br>
> due to suspected virus infections.<br>
<br>
Virus is likely not the right word for things. Anyways...<br>
<br>
There's really no reason an operator cannot run something<br>
like <a href="http://bro-ids.org" target="_blank">bro-ids.org</a> and sink known bad traffic in real time. Yeah,<br>
sure, everyone will bitch at me. But it is operator fiat, and<br>
they're not sinking specific users, so well within common<br>
carrier exceptions on that aspect. No different than operators<br>
who block 'torrent' ports, smtp, etc.<br>
<br>
Speaking of smtp, one could even redirect that into their<br>
system despam/clamav it and send it on its way. Better<br>
than nothing. Especially for the legit senders.<br>
<br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
tor-relays mailing list<br>
<a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br>
<br>
<br>
End of tor-relays Digest, Vol 3, Issue 11<br>
*****************************************<br>
</blockquote></div><br>