April 2016 - tor-relays - lists.torproject.org

Re: [tor-relays] NPR story: When A Dark Web Volunteer Gets Raided By The Police
by Tristan 09 Apr '16

09 Apr '16

In this instance, it was local authorities, and the guy bought all-new hardware, so I'd say this specific problem is solved. For future reference, how would we even find these incidents? This time it was on the news, but if it wasn't, nobody would have known. On Apr 8, 2016 12:54 PM, "Green Dream" <greendream848(a)gmail.com> wrote: Who said Tor was against the police? The fact is, in the United States, the FBI and other law enforcement agencies have been known to plant malware, modify hardware, etc., in order to maintain persistent access to machines they wish to monitor. Whether or not you think this is valid in some cases or all cases is really beside the point. The question is whether exit node hardware can be trusted after a search warrant is served and the police are given full and unmonitored access to said hardware. As a matter of due diligence, I'd argue the hardware and OS can no longer be trusted in such cases. _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

3 2

Re: [tor-relays] Relays by AS Names
by Tor-Node.net 09 Apr '16

09 Apr '16

Hi! Here is a list from ExoticVPS that you can use to search for and contact various VPS hosters: http://www.filehosting.org/file/details/558944/ExoticVPS.ods http://www.filehosting.org/file/details/558945/ExoticVPS.xlsx http://www.filehosting.org/file/details/558946/ExoticVPS.txt (Tab separated txt file) Kind regards tor-node.net

7 9

Private Tor Research Network
by Nicholas R. Parker (RIT Student) 09 Apr '16

09 Apr '16

Hi all, I've got an issue that I'm seeking help with. I'm with a small group out of RIT that's trying to construct a private TOR network for research purposes, but we've hit a bit of a snag. I've worked with both liu fengyun's ( http://liufengyun.chaos-lab.com/prog/2015/01/09/private-tor-network.html) and Ritter's write up (https://ritter.vg/blog-run_your_own_tor_network.html) but when trying to set up authority directories the whole thing really falls apart. Trying to edit the torrc file gives errors where it doesn't attempt to bind to the correct ports and trying to set --dirserver or --datadirectory results in errors that there isn't permission to access /var/lib/tor regardless of the owner of the directory (we've tried leaving it as being owned by _tor, tried changing ownership to root, etc) so we can't get the authority directories off the ground. I'd really appreciate any thoughts Nicholas R. Parker Rochester Institute of Technology 5thYear, BS/MS Computing Security

2 1

NPR story: When A Dark Web Volunteer Gets Raided By The Police
by Greg 08 Apr '16

08 Apr '16

http://www.npr.org/sections/alltechconsidered/2016/04/04/472992023/when-a-d… A Seattle exit node operator is visited by local police over a child pornography warrant... Is this out of the ordinary or is this to be expected when running an exit from your home IP address?

9 17

Guard flag?
by Clément Février 08 Apr '16

08 Apr '16

Hello, I run a relay for almost 10 days. I wonder if my configuration is correct as I don't see the expected behavior from https://blog.torproject.org/blog/lifecycle-of-a-new-relay Indeed, my consensus weight and the number of connections dropped after 8 days, from 0.0040% to 0.0012% and from 2000 to 300 connections respectively. Since then, I've such messages in arm: [NOTICE] Have tried resolving or connecting to address '[scrubbed]' at 3 different places. Giving up. [4 duplicates hidden] [NOTICE] We tried for 15 seconds to connect to '[scrubbed]' using exit <fingerprint> at <ip>. Retrying on a new circuit. I was expecting to get a guard flag with an increasing consensus weight involving a drop of the number of connections. So far, I have the following flags: Fast, HSDir, Running, Stable, V2Dir, Valid. Is that an evidence something is not running properly? Best, Clèm

9 15

No Daily Digest Anymore
by stealth＠nym.mixmin.net 07 Apr '16

07 Apr '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 About 2 weeks ago I stopped getting a daily digest of this list. Is there a reason for this? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (MingW32) iQIcBAEBAgAGBQJXBonvAAoJEH1gNwhiMDZu3iIQAJDQ8D+bZ3YG9He4rpQku+Le dHLgodjOckggKnbpfBScqGXQA+mcB9EDIgLQOMtqI3i2SHkjEL9qh5ci0MkZdA7b 0vVJ4Ccbqbn9aupXsbCkrgFA6UT2jz5rys0470FE5gnJiRpBXgAjllBSlZyP00s4 2St+ROqNUTE1chnJlDqTU2iehJWIGDONZUjb+amaUIfsC8MNiokrG0svJZfOsVE5 sRtZ0c+xu3gUnhcM2YaIIV9I+gbFGWTWJPOwZmSIbVoxUmE/Dqg1zHwXeLMSAKJv 5kALfyNZpDtCR62j+pLx1YX2iEHQdr6UaKemwW7HCsXp8ZkbKFwuC7HjP85OoON4 IjqK41KvMxoywD0nvlGbYPw6ssxR9JlMBtg5MqvjlsTPp/aUaUKP/OnjlNGxRwE3 N4fvO8hZPTa8zweykD7qa4RlmJwv0nE+dz/gO3arcz2tIAsC9D90RvD9JGJbeOxW o5yHbIo2h1aHdoelUWMgB5aVdDF30FDAoOZEoSG8DAs8vD6oKFtbWP98f1pVt2Nw dT8J2Q9d4iXe9IEZ8iTNJnyvLIykwqTl+aRJsRD50x7dd3EOzOxF9sKnf/Fq1vto ScNtBVva1fE7LB1kWV8J2LdGGwIwrtR4Af1Hy6rri//E4nvEU2HTnDfVk0dr7ReH uQP+mGr7nPCXLGbXEUp7 =LDGJ -----END PGP SIGNATURE-----

2 1

Getting drops with iptables "-m state --state INVALID" in INPUT and OUTPUT chains on relay
by fr33d0m4all 07 Apr '16

07 Apr '16

Hi… I've noticed that the iptables rule "-m state --state INVALID -j DROP" applied both to INPUT and OUTPUT chains on my raspbian Tor relay drops some connections… is it normal and should I avoid dropping "—state INVALID" connections when the destination or source is the Tor process on the relay? It's strange to have them also in the outgoing chain (i.e. produced by the relay), unless its is related to how Tor works (I'm almost sure that the connections dropped by the OUTPUT rule are related to the Tor process). It's not a matter of conntrack entries, it's using only 61 entries and has a lot of them free. Drop log in the OUTPUT direction => why is my relay sending a packet with ACK PSH FIN flags? iptables-OUT-INVALID-DENIED: IN= OUT=eth0 SRC=10.x.x.x DST=37.x.x.x LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=24372 DF PROTO=TCP SPT=33423 DPT=9001 WINDOW=321 RES=0x00 ACK PSH FIN URGP=0 Drop log in the INPUT direction => This could be a correct drop due to a new connection with RST flag, I think: iptables-IN-INVALID-DENIED: IN=eth0 OUT= SRC=91.x.x.x DST=10.x.x.x LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=15754 DPT=9090 WINDOW=0 RES=0x00 RST URGP=0 Best regards, Fr33d0m4All -- _____________________________________________________________ PGP Key: 0DA8 7293 D561 3AEE A3C0 7F63 101F 316A F30E ECB4 IRC Nick: fr33d0m4all (OFTC & Freenode) _____________________________________________________________

1 0

Re: [tor-relays] Relays by AS Names
by Tor-Node.net 06 Apr '16

06 Apr '16

ng0 wrote: > Could you upload the .txt of this list to > a network/filepublishing service which > does not require your email > address? I apologize, I was not aware that you had to provide your email to download. Here you can fetch them without providing your email: http://wikisend.com/download/498630/ExoticVPS.ods http://wikisend.com/download/894542/ExoticVPS.xlsx http://wikisend.com/download/789008/ExoticVPS.txt

1 0

Relays by AS Names
by SuperSluether 06 Apr '16

06 Apr '16

I want to host an exit relay, but at the same time I don't want to use a service that already hosts multiple Tor relays. Is there a website that lists relays by AS Names so I can find a service that isn't already populated with Tor?

10 10

Blocking Tor - A case for more accuracy
by Eran Sandler 06 Apr '16

06 Apr '16

https://blog.perimeterx.com/blocking-tor-a-case-for-more-accuracy/ There are certainly other ways of handling Tor traffic and measuring the real intention of a user. Disclaimer: The guys at PerimeterX are friends of mine. I sent them the CloudFlare post (as well as the post from the Tor blog) because I know their methods are much better in detecting intention and not just blocking Tor IPs. Eran

1 0