- tor-relays - lists.torproject.org

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, I am sharing this discussion with everyone as I have nothing to hide and I feel this is of the public interest. I am very familiar with Tor's origins, original intent and what it is used for today and where it's future hopefully will go. Thank you taking the time to email me with your abuse complaint. If you have any further issues, please feel to email me. In the future please please include more technical details such as IP addresses, the specific attack and times and dates. Sincerely, John L. Ricketts, PhD Quintex Alliance Consulting On Mar 29, 2017, at 00:41, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: I know quite a lot about Tor and how it was developed by the Navy and is used by agents for covert work. Maybe you should study more about Tor. You’re not as discrete as you think. Why are you CCing me to the entire Tor email list? Was I talking to them, or you? From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:38 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You’re still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor… From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm… Please turn it off or I’ll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You're still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor... From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm... Please turn it off or I'll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm... Please turn it off or I'll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Tor Relay On Pfsense 2.3.3-RELEASE-p1 (amd64)
by Edwin Garzón 29 Mar '17

29 Mar '17

Hi all. Need you help, I have pfsense *2.3.3-RELEASE-p1* (amd64) and > pkg install tor: pkg: No packages available to install matching 'tor' have been found in the repositories I want to install a Tor relay Thank

4 3

What kind of hardware do I need for my relay
by Farid Joubbi 28 Mar '17

28 Mar '17

Hello, I have been running low powered middle relays for a few years. Now I think it's time for a small upgrade. I haven't looked at computer hardware for a long time. What is the cheapest and most power efficient CPU/motherboard that can saturate 100 Mbit/s as a Tor relay? Thanks.

9 15

aTorRelay@gmail.com relays: please update 'MyFamily' in your torrc
by nusenu 27 Mar '17

27 Mar '17

Hi thanks for adding 3 more relays. You are currently the biggest known operator with end-to-end correlation capabilities [1] Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu [1] https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… https://github.com/nusenu/ansible-relayor The counter in the last column should match the number of rows: +------------+------+-----------------+------------+---------------+ | first_seen | exit | IP | nickname | FamilyMembers | +------------+------+-----------------+------------+---------------+ | 2015-11-15 | 0 | 82.220.89.53 | inky | 8 | | 2016-05-23 | 0 | 212.47.244.38 | Chimborazo | 8 | | 2016-05-24 | 0 | 163.172.157.213 | Cotopaxi | 8 | | 2016-05-24 | 0 | 163.172.139.104 | Pichincha | 8 | | 2016-10-02 | 0 | 212.47.240.189 | Tungurahua | 8 | | 2016-10-02 | 0 | 163.172.133.54 | Cayambe | 8 | | 2016-11-16 | 1 | 92.222.103.232 | Sangay | 8 | | 2016-11-19 | 1 | 185.100.87.186 | Antisana | 8 | | 2017-03-21 | 1 | 91.134.232.58 | Illiniza | NULL | | 2017-03-21 | 1 | 178.32.53.53 | Cuicocha | NULL | | 2017-03-21 | 1 | 92.222.134.129 | Atacazo | NULL | +------------+------+-----------------+------------+---------------+ 11 rows

1 0

Problem with arm
by Javier Benito Santoni 21 Mar '17

21 Mar '17

Hello, im having a problem with arm. Everytime i open it it apears this: [ARM_WARN] The torrc differs from what tor's using. You can issue a x sighup to reload the torrc values by pressing x. qj - torrc values differ on lines: 2, 3 Even by restarting tor service it shows the same error again and again Could it be a problem with my config? BandwidthBurst 8MBytes BandwidthRate 7MBytes ORPort 9001 DirPort 9030 ExitPolicy reject *:* ContactInfo administrator(a)anonmail.me Nickname AnonMailMe DisableDebuggerAttachment 0 A week has passed since i started my relay and i cant see it on tor globe yet: F40FEF3A1326EFC5D73E4FE6DB6EB0791E4082A1 -- My PGP Public Key: https://box.anonmail.me/javikey.txt

4 6

westonreed relays: please update 'MyFamily' in your torrc
by nusenu 20 Mar '17

20 Mar '17

Hi Weston, thanks for adding an exit relay. Please do not forget to set/update the MyFamily parameter in your torrc configuration to tell clients your relays belong to a single operator, otherwise they might use your relays in multiple positions within a circuit, which is rather bad for their anonymity. If you need help with the MyFamily option let us know. thanks, nusenu https://raw.githubusercontent.com/ornetstats/stats/master/o/potentially_dan… https://github.com/nusenu/ansible-relayor The counter in the last column should match the number of rows: +------------+----------------+-------------+---------------+ | first_seen | IP | nickname | FamilyMembers | +------------+----------------+-------------+---------------+ | 2017-01-27 | 70.122.214.59 | WestonReed | NULL | | 2017-03-01 | 104.236.233.99 | WestonReed2 | NULL | | 2017-03-10 | 40.69.160.83 | WestonReed3 | NULL | +------------+----------------+-------------+---------------+

1 0

Over 55k eth RX errors
by patacca 19 Mar '17

19 Mar '17

Hi everyone, I am running an exit node[1] with nocix (previously known as datashack) and everything worked pretty well until the beginning of March when they moved the physical location of my dedicated server: since then I am registering a lot of eth0 errors[2] and, as atlas is showing, a lot of downtime. Note also that previously I've run the server for like a year without any single eth error! I've already contacted them asking to check the cables and they replied everything it's ok but I am starting to think that *it must be* some kind of hardware issue. I'd like to debug the issue furthermore to excude any software related problem but I don't know what to do, has anybody got a hint? Thanks, patacca [1] https://atlas.torproject.org/#details/2B72D043164D5036BC1087613830E2ED5C606… [2] http://pastebin.com/7ZYXmTGE

3 4

Strange behaviour Tor 0.2.9.10
by Geoff Down 19 Mar '17

19 Mar '17

Hello list, my bridge/client has been behaving strangely the last few days. It took 36 hours to notice that my IP address had changed, and seems to be going into some sort of sleep state - automated curl fetches start failing, and keep failing until I manually curl to a well-known site, at which point everything else starts working. Anyone else having problems with 0.2.9.10? I've only been using it for a week. GD -- http://www.fastmail.com - Email service worth paying for. Try it for free

1 0