July 2016 - tor-relays - lists.torproject.org

Re: [tor-relays] interesting tor platform string or tor bug?
by Tim Wilson-Brown - teor 11 Jul '16

11 Jul '16

> On 11 Jul 2016, at 16:27, 김성민 <dallas1004(a)gmail.com> wrote: > > Hi, I'm Ph.D. Student in KAIST, South Korea. > I'm implementing a modified Tor on top of Intel SGX CPU to improve the security issues of Tor as a research. > (Here is a related paper work [1, 2].) > For this, we port the Tor source code on the VS2012 to build an SGX project. > To make Tor running on top of SGX, we modified several lines of code of Tor and I think there is some mistake while printing a platform string. Tor shouldn't produce output like the output we're seeing, unless the platform name retrieved by tor has been localised. (Which seems unlikely, as the platform name is reported correctly some times, and incorrectly other times.) What do you get if you compile a simple program that only contains the function that retrieves the Windows platform name? It looks like you might be corrupting memory or mangling string processing. But it's very hard to help you unless we know what lines of code you changed, and how you changed them. > Currently, We successfully compiled a SGX-Tor binary and we ran it as a Tor relay for testing compatibility with existing Tor network. > We tested a Tor client with our SGX-Tor and it successfully works. > Is there any issues or rules to be considered for testing our SGX-Tor? It should pass all the unit tests run using "make check". It should pass the integration tests run using chutney and "make test-network-all". https://gitweb.torproject.org/chutney.git/ If you do find that it's a programming error in tor, feel free to submit a patch, or a unit test that would catch similar errors in the platform string. https://trac.torproject.org/projects/tor Tim > > Thanks, > Seongmin > > [1] http://ina.kaist.ac.kr/~dongsuh/paper/kim-hotnets2015.pdf > [2] http://ina.kaist.ac.kr/~dongsuh/paper/opensgx.pdf > > 2016-07-08 9:07 GMT+09:00 Tim Wilson-Brown - teor <teor2345(a)gmail.com>: > > > On 8 Jul 2016, at 09:48, Tim Wilson-Brown - teor <teor2345(a)gmail.com> wrote: > > > > > >> On 8 Jul 2016, at 09:41, nusenu <nusenu(a)openmailbox.org> wrote: > >> > >> Hi Seongmin, > >> > >> out of curiosity I was wondering whether your so called tor "platform" > >> string ("??B`?\u0001") or your tor relay [1] was generated by a modified > >> tor installation on Windows 8 or if we are looking at some bug in > >> vanilla tor? > > > > We plan on authorities rejecting descriptors with non-ASCII characters in 0.2.9, if we get it implemented before the code freeze. > > https://trac.torproject.org/projects/tor/ticket/18938 > > Hmm, I can't find an actual descriptor with these characters in it. The latest descriptor I can find for this relay has a normal platform line: > https://collector.torproject.org/recent/relay-descriptors/server-descriptor… > > Could this be a bug in Atlas? > > > > >> > >> thanks! > >> > >> > >> [1] > >> https://atlas.torproject.org/#details/21E84B294794821E2898E8ED18402E45E4FC3… > >> > >> descriptor containing that platform string: > >> https://collector.torproject.org/recent/relay-descriptors/server-descriptor… > >> > >> _______________________________________________ > >> tor-relays mailing list > >> tor-relays(a)lists.torproject.org > >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > Tim Wilson-Brown (teor) > > > > teor2345 at gmail dot com > > PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B > > ricochet:ekmygaiu4rzgsk6n > > > > > > > > > > Tim Wilson-Brown (teor) > > teor2345 at gmail dot com > PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B > ricochet:ekmygaiu4rzgsk6n > > > > > Tim Wilson-Brown (teor) teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B OTR 8F39BCAC 9C9DDF9A DF5FAE48 1D7D99D4 3B406880 ricochet:ekmygaiu4rzgsk6n

1 0

BoingBoing Says Running Exits Is No Trouble re: LEA
by grarpamp 10 Jul '16

10 Jul '16

https://boingboing.net/2016/07/01/researchers-find-over-100-spyi.html "Many people fear that running an exit node will put them in police crosshairs if it gets used in the commission of a crime. For the record, Boing Boing runs a very high-capacity exit node, and though we've received multiple contacts from US law enforcement, we've just explained that this is a Tor node that runs with logging switched off, and thus we have no information that'll be relevant to any investigations, and the officers involved have thanked us and gone away without further trouble." -- BoingBoing

3 4

dns request capitalization, tor and unbound
by ajs124 09 Jul '16

09 Jul '16

Hey, I recently started running my first two exit relays. Since it was mentioned on the mailing list a while back and seem like a reasonable thing to do, I installed and configured unbound. Afterwards, I noticed that most if not all the DNS request are randomly capitalized. Does this impact unbound's caching ability? My cache hit/miss ratio is around 1/5. What is the reason for changing the capitalization? Best regards ajs124

7 6

in/out bandwidths and packet sizes
by Toralf Förster 09 Jul '16

09 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I'm just curious, why at my exit relay the bandwidth is constantly around 8 MByte/sec in both directions with a 2-3% higher value for the inbound bw whereas the amount of incoming packets is 25% and more higher more than the outgoing packet amount. And as always I do have the question in mind: Would that be helpful for an attacker ? - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAleAvUQACgkQxOrN3gB26U5ReQD+MXWkaph94+xUEw5+6oD63PtL WXMdSqg+vQvFxa68XhQBAIz9ys6ifbEGUXtOCFB4BUjfdPyaa1qvS+WKKZJur/Yx =6JG/ -----END PGP SIGNATURE-----

2 1

interesting tor platform string or tor bug?
by nusenu 08 Jul '16

08 Jul '16

Hi Seongmin, out of curiosity I was wondering whether your so called tor "platform" string ("??B`?\u0001") or your tor relay [1] was generated by a modified tor installation on Windows 8 or if we are looking at some bug in vanilla tor? thanks! [1] https://atlas.torproject.org/#details/21E84B294794821E2898E8ED18402E45E4FC3… descriptor containing that platform string: https://collector.torproject.org/recent/relay-descriptors/server-descriptor…

4 8

AS: "SIGTERM MIKAL VILLA" - Linux (15)
by nusenu 08 Jul '16

08 Jul '16

Dear sigterm support, thanks for adding relays. In case you are aiming for the exit flag, you will have to add port 80 or 443 to your current exit policy (accept *:6660-6667) because 2 out of 3 ports are required to gain the exit flag, see: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n2216 Should you ever add relays outside your current /16 netblock, please set the MyFamily setting properly. btw: your piwik installation wants to be taken care of https://sigterm.no/ ornetradar(a)riseup.net wrote: > 2016-07-06 > ----------------------------------------------------------------------------------------------------------------------- > Up|Ext|JoinTime| IP | CC | ORp | Dirp |Version | ContactInfo | Nickname | eFamlen > ----------------------------------------------------------------------------------------------------------------------- > 0 | 0 |05:19:24| 193.150.121.140 | no | 9001 | 0 |0.2.5.12 | None | sigtermsupportsrv | 1 > 0 | 0 |05:20:17| 193.150.121.139 | no | 9001 | 0 |0.2.5.12 | None | sigtermsupportsrv | 1 > 0 | 0 |05:21:08| 193.150.121.141 | no | 9001 | 0 |0.2.5.12 | None | sigtermsupportsrv | 1 > 0 | 0 |06:04:26| 193.150.121.133 | no | 9001 | 0 |0.2.5.12 | None | sigtermsupportsrv | 1 > 0 | 0 |07:05:22| 193.150.121.131 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 0 | 0 |07:33:52| 193.150.121.130 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |08:14:46| 193.150.121.131 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |08:46:35| 193.150.121.132 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |08:53:18| 193.150.121.133 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |09:12:50| 193.150.121.134 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |09:36:12| 193.150.121.135 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |10:37:52| 193.150.121.136 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |11:03:56| 193.150.121.130 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |11:13:48| 193.150.121.137 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > 1 | 0 |11:44:06| 193.150.121.138 | no | 9001 | 0 |0.2.5.12 | Sigterm AS darknet server | sigtermsupportsrv | 1 > Fingerprints: > 506088E8CC79AB70A58E47D99D048E4560236B0C,0FFBA0D381CA6E8E2CA444C0F4B86C99BC228FAB,176EC54479BE0A2D700621D897B33B4AA000EE2F,C63EF61EF3615B6B14ACD5972C5EA1DA5BC7857D,D4F93347D639D8AF7A2144C94CD2196F107F4893,E6D022954AE4CA368F67633660165DADDA95C62B,9919526DCACE9B1D117978FD698E160457C9DA56,197B3FC47FD5C8F22929C7076FF0E66815DC044A,798DFE9B219E2CE0E737447EAF388320EACCFE8A,E8F1959686700D522B931255288887F7087643BD,038C5BD680C5101AB0E2E43DFD178FD2B3AACF97,46DDFEACB49429EC6664248223FDEED712E71BBB,010D54F9C9047768E7FA8C835EFC01BCF379106D,799B19EF0F409CF237EA53FC636FA5FCBB779912,662142681939C03F3A17A1D8C6BDA8AF362A5E81 >

1 0

suspicious relays
by yandereson＠riseup.net 08 Jul '16

08 Jul '16

Hello, I check torstatus/atlas regularly and this was showing up : https://atlas.torproject.org/#search/Relay127001 i just thought i report it here. good day!

15 21

Re: [tor-relays] VPS for Exits
by tor relay 07 Jul '16

07 Jul '16

> Well, I'm still sticking with CoolHousing/Virtual Server Lite because I hardly ever get abuse > complaints. For ITL, I may leave after my term expires. > But a few other companies I found were: > https://hostmaze.com/ tested it, made really bad experience with them, network performance was almost unusable <10MBit/s lately, they had an outage of 2 days ("because voxility upstream added two new uplinks", than I canceled) > https://blazingfast.io/ made also bad experience with them, like "fatal" said, their network performance isn't the best <20MBit/s (per direction) weekly average If anyone can recommend any other hosters, please come forward.

7 9

Darknet Shenanigans [was: suspicious "Relay127001" relays]
by grarpamp 07 Jul '16

07 Jul '16

On 7/6/16, Roger Dingledine <arma(a)mit.edu> wrote: > In this > case we actually found these relays misbehaving (accessing onion https://boingboing.net/2016/07/01/researchers-find-over-100-spyi.html http://motherboard.vice.com/read/over-100-snooping-tor-nodes-have-been-spyi… https://www.defcon.org/html/defcon-24/dc-24-speakers.html#Noubir https://motherboard.vice.com/read/the-booming-and-opaque-business-of-dark-w… https://motherboard.vice.com/read/dark-web-drug-dealers-are-making-sloppy-m… All quite expected and well known ever since the dawn of overlay networks. Same with the Internet.

4 3

which DirPort should be advertised ?
by Toralf Förster 05 Jul '16

05 Jul '16

3 4