tor-relays

tor-relays@lists.torproject.org

January 2017

79 participants
62 discussions

Grizzly Steppe
by Dr Gerard Bulger 02 Jan '17

02 Jan '17

I ran an exit node, but gave up after too many abuse reports that annoyed my ISP. So I turned al exit ports off, and reports stopped as a rely. After months and many terabytes of data I get an abuse complaint that my tor IP has been used for espionage. "NCSC have been made aware of a report and associated malicious indicators released by the United States Government relating to malicious cyber activity. A copy if the report and indicators can be found at the following link:- https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicio us-Cyber-Activity Details within this report indicate network assets which may have been compromised or associated with malicious activity. We have identified the following IP address from this report as x.x.x.x As a minimum, it is recommended that you check systems and any available logs concerned with the above addresses for indications of malicious activity" There are no other details as to HOW my tor relay is being used. The espionage seems to relay on the stupidity of recipients on receiving emails asking for passwords. I am not sure HOW ISP or relay service can stop that. Or is it that my relay was being used to transfer the data? I assume my IP was found by way of a DNS leak which I need to look into. There is nothing else I can do as a relay to stop this or is there? Gerry

3 2

How can we trust the guards?
by Rana 01 Jan '17

01 Jan '17

Sorry for the naïve question, but we have a total of about 7000 relays, many of them residential and thus practically unused or very lightly used. So the actual number of relays that carry most of the traffic is rather small, and many of them are middle relays, leaving an even smaller number of guard relays. This means that an adversary with a rather modest budget can easily take over half the guards. Whats the trust mechanism (if any) to ensure that the majority of guards are not hijacked by adversaries?

2 1