<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
<div class="moz-cite-prefix">On 2020-10-07 7:24 a.m., Georg Koppen
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:da8dca7c-fb59-ee25-545f-dcd7f34ef16c@torproject.org">
<pre class="moz-quote-pre" wrap="">Corl3ss:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Hello,
This summer Nusenu shared his posts about malicious relays [1][2] and it was followed by many answers.
A very important is Roger's one [3] explaining that the malicious relays have been kicked out of the network and that any new one should be reported.
I was wondering if, with some distance with this summer situation / discussion :
* new malicious relays have been reported in any way ?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Yes, there have been more malicious relays reported. Some of them doing
attacks like Roger mentioned. We kicked out all of those. There were
other reports about relays that seem to belong to the group(s) we kicked
out earlier this year.[1] Some of those relay groups have been kicked
out, too.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">* vigilance / watchfulness is still needed ? if yes :
* is there specific cases to share (e.g. nodes that block HTTPS on a site or redirect to HTTP ?)
* any concern to have on other protocols that use SSL (imaps, smtps, ssh) ?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Yes, there is still vigilance needed. While we have some scanners and
some manual work is done, that's not enough, in particular against more
sophisticated attackers.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">* is there / will there be things implemented as a conclusion of the "call for support for proposal to limit large scale attacks" ?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
We have some ideas on how to move forward which have different
trade-offs and we realized that a lot of them touch the question of what
we want the Tor network to be in the future. I had hoped that I would
have sent an email about that by now to this list asking the community
about input and possible options but alas it's still sitting unfinished
in my drafts folder. :(
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">* has it been possible to prepare / set up precautions to avoid this king of situation or it is a too long shot for such a problem ?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
We don't have good ways to fix this problem in the short term. So, until
we make progress on any of our longer term plans we somehow need to keep
up with the whack-a-mole game we have been playing for quite some time now.
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">These questions come with a lot of respect for the project, its teams and the work done. No critics, it is just made to update the knowloedge on the subject as these questions came back with other friends and relay operators.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
No worries, I am happy to take criticism of the status quo and our
future plans. :)
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">And perhaps a last one, perhaps specific for Nusenu : how do you define a malicious relay ? Sorry but I did not get that precisely, moreover in big group analysis.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
That's a good question. I am not Nusenu and will thus defer the answer
to them. But it's a good question to think about regardless as finding a
good answer to it is part of the problem of removing bad relays. Kicking
out relays that got caught while doing e.g. SSL stripping attacks is
easy but what about a group of relays with similar (and what is
"similar"?) configuration showing up like on the next day or days
thereafter? Is that the some entity just joining the network again to be
able to launch new attacks at *some* point? Or is it some new
contributor that likes to help the network growing/diversifying? And
what about all those relays without a valid ContactInfo? Are those
anonymous contributors that want to help the Tor network or sneaky
attackers? Etc.
This touches the question of what we want the Tor network to be (and how
we would manage trust relationships in it), too...
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
All answers will be read with care and gratitude !
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Thanks and thanks for your questions,
Georg
[1] <a class="moz-txt-link-freetext" href="https://blog.torproject.org/bad-exit-relays-may-june-2020">https://blog.torproject.org/bad-exit-relays-may-june-2020</a>
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
tor-relays mailing list
<a class="moz-txt-link-abbreviated" href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a>
<a class="moz-txt-link-freetext" href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a>
</pre>
</blockquote>
<p><br>
</p>
<p>Is there a way that some Tor users can help identify malicious
relays? Perhaps run a 'scanner' or other software utilizing the
users' unused bandwidth.</p>
<p>I for one would be willing to offer such help.</p>
<p>G<br>
</p>
</body>
</html>