- tor-relays - lists.torproject.org

"NumCPUs 2" or 2 copies of Tor?
by Steve Snyder 08 Aug '13

08 Aug '13

Given plenty of RAM, a muti-core CPU and a single IP address, which is more efficient: a single instance of Tor configured with "NumCPUs 2" or 2 instances of Tor configured with "NumCPUs 1" and different port numbers? Thanks.

5 5

Tor Exit Node - DDOS
by Kris 08 Aug '13

08 Aug '13

I've been an end user of tor for a few years and finally as of last week purchased a virtualhost to run an exit relay. After a few days running smoothly, I received a forwarded abuse complaint from the hosting company from someone saying their are being DDOS'd by my IP. I'm prepared per the tor website regarding DMCA notifications, but haven't found much on how to deal with this situation. I have: * made it quite obvious that this is an exit node * reverse dns is tor-exit-node.nenticom.net * web server running on 8080/80 with the tor notification page * provide full real name and abuse(a)nenticom.net contact * notified the hosting company * applied the recommended exit policy per the "minimum harassment" post You can see most of this off Atlas (node: nenticom). https://atlas.torproject.org/#details/50D04704A5017C02CC63AFE4A66F05DF79ED8… Can anyone provide a recommendation of how to respond to this notice (provided below)? Given the headers the original complainer filed it looks like someone is running benchmark software over tor. Maybe after explaining that I'm a tor exit node to the provider I can offer to block exiting to the IP block belonging to the original complainer? Notice from Hosting Provider ---------------------------- Please review the following abuse complaint and provide us with a resolution: ****************************** Hello, Over the last three days we have experienced a massive amounts of incoming HTTP connections from an IP address under your control as part of a DDOS attack. Can you please investigate the server/computer associated with this IP address as it is more than likely compromised and is now part of a BotNet. For your reference, all requests to our server from the IP in question are listed in the Apache logs as: "GET / HTTP/1.0" 500 11680 "-" "ApacheBench/2.3" The attackers IP address that appears to belong to you or your network is '192.241.230.170'. Please resolve this as soon as possible. -- Kind regards, Benjamin Hodgetts Dedicated Hosting Server Administrator Namesco Ltd. Phone: +44 (0)1905 342347 Email: bhodgetts(a)names.co.uk DDI: +44 (0)1905 342384 Main Line: +44 (0)1905 342342 / 0845 363 3630 Main Fax: +44 (0)1905 342343 / 0845 363 3631 Support Email: supportmanager(a)names.co.uk Website: http://www.names.co.uk Namesco Limited (Registration No: 3913408) is incorporated in England and Wales with its registered office at Acton House, Perdiswell Park, Worcester, WR3 7GD. Information contained in this e-mail is intended for the use of the addressee only, and is confidential. If you have received this email in error please notify the sender immediately. Any dissemination, distribution, copying or use of this communication without prior permission of the addressee is strictly prohibited. The contents of an attachment to this e-mail may contain software viruses, which could damage your own computer system. While Namesco has taken every reasonable precaution to minimise this risk, we cannot accept liability for any damage, which you sustain as a result of software viruses. You should carry out your own virus checks before opening the attachment. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. ©2013 Namesco Limited. All rights reserved. ******************************

5 5

Dealing with VPS suspension
by Bernard Tyers - ei8fdb 07 Aug '13

07 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I've been running an exit node on a VPS hosting for the past few months. I've had no issues until this morning. The VPS has been suspended due to a report of "massive amounts of incoming HTTP connections from an IP address under your control as part of a DDOS attack". Once I contacted the hosting company they were a bit more forthcoming with information. It took me some time explaining Tor, what it is etc...and why I couldn't really tell them where the traffic was coming from. I'm waiting to hear back from them, but I was wondering: is there a "standard"/informational e-mail template that I can use to communicate the important points to a hoster who has pulled an account? I've read some of the posts on how to run an exit node for minimal harrasment (I checked steps 2, 3, 4, 6, 7). It may be just a matter of education (I didn't do step 1). The hoster has no (public) AUP so I can't have been in violation of it. Ultimately it's their decision, but I'd like to think karma might be on my side if I play nice. Thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJSAqZLAAoJENsz1IO7MIrrT/UH/1T6YTnowguuyFaSR743uFDp gtR7/xVEk0KWE3KuiYmhP8KvMyaYJBiIMq8rRboxr7TI0NfZA50shJ12hI1ITZ4X TSMApNU219B8bQNAfR6LH9H/sBqgYkba5ZtEkGt5O0oA43+08RhJL0s5fkHfznPR rQj1PpuHNR1LFOu2G8uJ3ljVXzHfEdAZwPfzol/f4QURj3dE9boinmzmFJOx+z9U Pz7UsAjFZbx4wPinAbUGFSn9As99pWvxYtUvI4It1RdvtfPb/bh46R5RT/s7/zve ayOgv+WvdwUYhxX242odoq+WksQlKm7eXrAtAw1GV7XcK0g1dZAQcixXc1hWbzU= =kpn9 -----END PGP SIGNATURE-----

2 2

Up and running!
by Cassey Jean Claude 07 Aug '13

07 Aug '13

Hi all - I have a semi-idle laptop that I decided to let Tor run on by 10mb down, 1.5mb up connection. Curious what is needed more: Bridge relays or non-exit relays? Not ready to be an exit-relay yet... one step at a time. Cassey

2 2

Re: [tor-relays] VPS Hardware Specification & Advice
by Tor Pids 06 Aug '13

06 Aug '13

Hi, i just saw this post on the web archive and felt I can contribute something here so I finally registered. Maybe this reply will not be correctly recognized to the thread, sorry. The VPS specs you posted should be more than enough - but the price is too expensive! I currently run about 20 Tor relays on cheap VPS all around the world: http://globe.rndm.de/#/search/query=torpids Basically I just care for the bandwidth/included traffic when choosing a VPS. 256MB RAM is enough, disk space doesn't matter at all. Tor doesn't scale that well with CPU cores so 1 core is ok. For only 1 or 2 of my VPS the CPU is the bottleneck (at about 20-30MBit/s), but most are fast enough. Most cheap VPS are based on the OpenVZ virtualization which limits you to their old kernel and sometimes they limit the number of tcp connections (see "cat /proc/user_beancounters"). KVM or Xen virtualisation is better because you have more control on the VM. Most VPS providers add up the incoming and outgoing bandwidth, meaning that you might be able to just send about 500GB with your 1TB plan. For example with a VPS from www.jiffybox.de for 15€ per month it is possible to push more than 1TB PER DAY(!) (and not per month as with the 18€ plan you mentioned). OVH just released a server for £2,99 per month with unlimited 100MBit/s as well: https://www.ovh.co.uk/dedicated_servers/kimsufi.xml Other typical offers are like 10TB for 10$ or 20MBit/s unlimited for 3€. Good places to find cheap VPS deals: http://www.lowendbox.com/ and http://lowendtalk.com/categories/offers http://www.wjunction.com/46-vps http://www.webhostingtalk.com/forumdisplay.php?f=104 Best, Torpids

3 3

VPS Hardware Specification & Advice
by torrelay＠mail.md 06 Aug '13

06 Aug '13

Greetings! My ISP British Telecom is rate limiting my Internet connection despite a big splashy advertising campaign earlier this year in which it claimed that it would no longer rate limit during so-called 'peak hours' or cap the bandwidth consumption when it reaches a ceiling that they decide is 'too much'. I've tried various bandwidth rates that are a sensible percentage of the total available bandwidth but anything above a very small amount (50-80KB/s) is being rate limited even though the total amount of bandwidth available is approximately 30.00 Mbps downstream & 6.12 Mbps upstream. Now even 50-80 KB/s is rate limited. Well, it's the school holidays started recently here & BT have just brought out a new streaming sports service which coincides with my bandwidth being rate becoming limited from about 2 weeks ago. I was able to run a consistently faster tor relay on British Telecom 7 years ago than I can today & I don't want to speak with a telephone operative in India who follows a script & will test my connection. I just take my business somewhere else -- rant finished! Consequently I've sourced a company, located in a Scandinavian country, offering a VPS with 1TB of data consumption per month for approximately 18 Euros (more than half the price of my shitty, crippled British Telecom Internet connection) so I'll try this. The cost of running the VPS is based on the hardware specification which brings me to my question. I plan to utilise the full 1TB of data each month & I'd like some idea if the specification (below) is sufficient for an entry/middleman tor relay using 1000GB bandwidth per month. The hardware specification I've chosen is: CPU Cores: 1 - exact details of CPU are not specified on the company's website, problem? RAM Memory: 1024 MiB Traffic: 1000GB Drive: 50GB Price: 18 Euros I'm completely new to VPS & am sure this will be a learning curve but no matter I will try to see if I can make it work even if performance of VPS might not be perfect. If anyone has written a guide to hosting a tor relay on a VPS, I'd welcome any links to further information or any other useful advice based on experience of others. Best regards, Edvard.

1 0

VPS
by Tom McLoughlin 04 Aug '13

04 Aug '13

I'm looking for a VPS to run a tor exit node on, any ideas? Regards, Tom McLoughlin

5 6

Running an obfuscated bridge at home still safe?
by z0rc 03 Aug '13

03 Aug '13

Hi, I've been running an obfuscated bridge on a Raspberry Pi at home (in Switzerland) for a week now. Until recently, I thought running a bridge at home was no problem at all. But yesterday Paul Staroch reported in [1] that he got notice from the German police (BKA) concerning his non-exit relay. So I'm a bit scared now. Is it still believed to be safe to run a non-exit relay or bridge at home? Or is this just one single incident? Any other experiences on this? Cheers, z0rc [1] https://lists.torproject.org/pipermail/tor-relays/2013-August/002365.html

1 0

Attacker IP database
by Bryan Carey 03 Aug '13

03 Aug '13

Is there any kind of compiled list of IPs that relay operators can refer to that are known bad IPs (sources of brute force SSH attempts, etc.)? Is there a reason to NOT block (drop) traffic from these IPs? Here are some that I have seen recently trying to brute force common user accounts and root password attempts: 198.50.197.98 220.161.148.178 223.4.217.47 199.187.125.250 175.99.95.252 62.64.83.38 125.209.110.234 37.235.53.172 Also, in general what are some good security practices to keep in mind while running a Tor relay? Thanks, Bryan

8 10

Relay or Obfuscated Bridge?
by Richard Budd 02 Aug '13

02 Aug '13

I have several Tor relays running on VPS providers around the world (the 7 bucks a month kind). Most have around 5 to 6 meg a second bandwidth available. Would it be more useful for the Tor system to change a few of them over to obfuscated bridges?

1 0

Tor bridge on Amazon not doing much
by Shawn A. Miller 02 Aug '13

02 Aug '13

I've been running a Tor bridge on the Amazon EC2 cloud computing platform (per instructions at https://cloud.torproject.org/) since July 27, and while the bridge is up and running according to the logs, there doesn't seem to be much traffic running through it, i.e., latest logs indicate Tor uptime is 2 days 12 hours with 2 circuits open; 6.6 MB sent and 45.75 MB received. Have I somehow managed to misconfigure the bridge or is this normal? Best, Shawn

6 7

Running exit-node in Germany
by Matthias Redies 02 Aug '13

02 Aug '13

Hello, I want to run an exit-node through mit home connection. Has anyone experience with running a Tor-Relay in Germany( Bavaria)? Are there known cases of police raids? Is there a list of lawyers which work with the torproject which should be called in case of a raid? Has anyone had sucsess with talking to the police prior to setting up the exit-node? If so, to which departmed did you talk to? Yours Matthias

11 18

Home broadband - worth running a relay?
by Nick 01 Aug '13

01 Aug '13

Hi there, I have a reasonable ADSL connection, and a little always-on server. The bandwidth is in the region of 2Mib/s down, something less up (maybe 256Kib/s). Is it useful for me to run a tor relay with this bandwidth? I'd like to run one which isn't an exit, at least for now. If not, am I correct in thinking that a bridge is an appropriate help? That's what I'm doing currently, but if a relay would be more useful I'd be very happy to do that. One other unrelated(ish) question: I'm in the UK, where the idea of censorship isn't resisted as strongly as it ought to be, and as a result my internet connection is subject to a smallish amount of censorship: whatever is on the secret IWF blacklist plus the pirate bay. Does this mean that running an exit node from a home connection here at some point in the future would not be helpful? Or only if all HTTP(S) was blocked (as the IWF blacklist is secret there's presumably no way to tell the tor network what is inaccessible from this node). Thanks in advance, Nick

12 23

Diagnosing "relay unresponsive" messages
by Gordon Morehouse 01 Aug '13

01 Aug '13

So, I've got my relay back up on a Raspberry Pi and I'm working on figuring out the optimizations I made to it, and continuing to tune it. Out of the box these machines have some difficulty even offering a couple Mbps, but they can be greatly improved. I will post all details when done. I see a fair amount of this, much less than after some tweaks, but it still happens: 20:27:36 [ARM_NOTICE] Relay resumed [1 duplicate hidden] 20:27:30 [ARM_NOTICE] Relay unresponsive (last heartbeat: Wed Jul 31 20:27:19 2013) 19:50:57 [ARM_NOTICE] Relay unresponsive (last heartbeat: Wed Jul 31 19:50:4 This often happens at the same time as 'arm' (the monitoring program) may stutter, fail to render a few frames, then 'catch up' or redraw the screen. I'm trying to figure out what's going on so I can prevent it. It doesn't always correlate with traffic - it happens more often when there's more traffic but can happen even with very little. Tor is taking about 10% RAM, there's plenty free, and load is under 1.0. Best, -Gordon M.

1 0

What to do about port scans?
by Steve Snyder 01 Aug '13

01 Aug '13

I wouldn't have thought that the Tor network was fast enough for port scanning, but apparently it is. I have recently seen a rash of SSH port scanning (or so my ISP reports). What can/should I do about this? I know I can limit the rate of connections using iptables. What's the consensus on this? Is this considered advisable, or a breach of expected exit node behavior? Do I have any options other than iptables to restrict the rate of port 22 connection attempts? Thanks.

3 3

Re: [tor-relays] Home broadband - worth running a relay?
by ROCKsolid69r＠gmail.com 31 Jul '13

31 Jul '13

1 0

Re: [tor-relays] Home broadband - worth running a relay?
by ROCKsolid69r＠gmail.com 31 Jul '13

31 Jul '13

1 0

VPN termination on relays
by grarpamp 31 Jul '13

31 Jul '13

> Mosh is great, but it still relies exclusively on UDP, right? > So no "over Tor"... Somewhat related to things that don't work via exits... So who wants to offer VPN termination as part of their exit service? User tunnels VPN to you, you give back a bound port, or a natted 10 address, somethings of that sort.

1 0

Fwd: Computer requirements for a modest (15-20Mbs) relay?
by Zack Weinberg 31 Jul '13

31 Jul '13

On Mon, Jul 29, 2013 at 12:35 PM, Andy Isaacson <adi(a)hexapodia.org> wrote: > Yes, there are cases of law enforcement seizing all computer gear from a > house with a exit node -- not just the exit node computer. Most > recently in Austria in a child porn investigation. [...] We did some operational planning for this risk, in conjunction with the university legal and IT departments, when we set up the CMU Tor exit. The machine is in a cube farm filled with other equipment that people need for their work; this is because we want to have immediate physical access to it in an emergency, and anywhere else we could put it would interfere with that. However, it has its own dedicated IP address, it runs absolutely no other services, it is clearly labeled both in DNS and on the physical box, and there's nothing else on the table it sits on. The hope is that this will be sufficient to persuade law enforcement to seize *only* that machine, if it comes to it. Of course, it helps as much or more to have the equipment under the aegis of an organization with lawyers already briefed and on tap, and that has trained all the staff to call legal *before doing anything else* when the police show up. Also, the greater operational threat is having the plug pulled by one's connectivity provider. I personally would not risk having an exit node in my house for that reason alone. zw

3 3

Sitevalley is no longer Tor-friendly
by Tom Ritter 30 Jul '13

30 Jul '13

Sending this out, as I suspect I am not the only person running a node on SiteValley, as they have pretty good bandwidth for pretty cheap. I had inquired in the beginning if they allowed Tor, and they said yes, but if we get too many abuse complaints we'll shut it down. So maybe 4 or 5 abuse complaints later they did indeed give me the ultimatum to shut it down or get shut down. So I made them give me a new IP address, and made it into a middle node. (The new IP was because I was thinking of making it a bridge.) Well this morning they told me TOR (their caps, not mine ;) is not allowed at all. I argued with them a little bit, and TLDR you might be able to get a partial refund. I'd much rather have had the bandwidth though. I'm not in a position to run high-maintence nodes, so this being a pretty fast, maintenance-once-every-three-months dedicated-to-Tor node - I was pretty happy with it. Our conversation: ----------------- Your VPS X.Y.Z.W has been suspended due to running tor anonymyzer which is forbidden according to our Acceptable Use Policy, paragraph 8 "Prohibited Activities" http://www.sitevalley.com/acceptable-use-policy/. In order to have your VPS unsuspended you need to agree to remove tor from it within 24 hours after the unsuspension. Failure to abide by this provision may result in termination of your account. We have to warn you that on receiving next abuse your VPS will be terminated without without prior notice. ----------------- If you refer to Contact Form ID #YXX-XXXXyou'll see that I confirmed with you before I purchased the VPS that allowing Tor was acceptable. I dealt with the 3 or 4 abuse complaints you sent me promptly, and in #FSA-XXXXI agreed to stop using the server as a Tor Exit Node, despite our previous conversation. The machine in question is running Tor in a non-Exit mode. Traffic from it does not appear to originate from the server, and it merely passes traffic within the Tor network. It cannot generate abuse complaints from third parties when running in this mode. Have you received an abuse complaint about this server? If so, can you forward it to me so I can investigate how it may have been created? ----------------- The node was found during system audit. May be you know that running tor (in any mode) is strictly forbidden by our Acceptable Use Policy because it can be used by third-parties for forwarding hidden illegal traffic. Unfortunately, we can start your VPS only in case you agree to remove tor. ----------------- I'll put aside the fact that your routers, DNS resolvers and every router of the internet also carries hidden illegal traffic, and that Tor is agnostic to that traffic as your routers are. I did NOT know that running Tor was not allowed because I ASKED you if I could, and you told me it was fine as long as it did not generate Abuse Complaints. Considering your AUP is so broad it can be made to cover anything you don't like, the only reasonable thing someone can do is ask if you'll allow something - which I did. I'd like a pro-rated refund of my remaining service, as you have misrepresented your services and your Acceptable Use Policy to me - if I had known you wouldn't allow me to use my bandwidth in a way that was not illegal in any jurisdiction, did not generate any abuse complaints or additional work for you, and that you would shut down my service after I confirmed what I was doing was okay with you - I would never have paid you in the first place. ----------------- Ticket YXX-XXXX dates from 26 Mar 2012. Our Terms of Service are subject to change and, according to our Terms of Service http://www.sitevalley.com/terms/ posting of such changed Terms and Conditions on the site constitutes notice of such changes to you (although we may choose additional types of notice). Our policy regarding TOR usage has been changed and as for now, running TOR applications on our servers is forbidden. We are very sorry that this provision prevents you from using our services in the manner you need to use it. All things considered, we can offer you two options: 1. We unsuspend your VPS, you remove TOR from it, let us know and we check it. or 2. We issue the partial refund and terminate your account with us. Please rest assured that we value you as our customer and would like to continue doing business with you. Also, please accept our apologies for any inconvenience this misunderstanding has been the reason of. ----------------- Thank you Dmitriy. Please issue the partial refund and terminate the account. ----------------- -tom

13 21

Computer requirements for a modest (15-20Mbs) relay?
by Nick 29 Jul '13

29 Jul '13

Hi, I'm probably going to move to a new ISP soon, and may well be able to get a fibre 20Mbps up connection, which is a nice thought. The question I have is whether my little ~1GHz home server box (a weird little x86 thing, I can dig out more specs if they're relevant) would be able to relay that level of traffic without issue? The TorExitGuidelines page on the wiki mentions that one "modern" CPU core should be able to push 100Mbps, but my server is probably 6/7 years old. It's a VIA board, which IIRC might have some hardware crypto acceleration or something - is that something that would be likely to help things if I can get it working? Thanks folks, Nick P.S. Are there any known cases of law enforcement seizing equipment or otherwise terrorising people for running home exit nodes? I would like to imagine that Tor is well known enough in such circles that such action would be rather unlikely nowadays. I know at least some remailer operators host stuff from their homes, but maybe that's lower risk.

2 1

Tor exit node flags explanation
by Bernard Tyers - ei8fdb 26 Jul '13

26 Jul '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I have looked thru FAQs and docs but can't find an answer (no doubt its in front of me somewhere). Is there any explanation of what Tor node flags mean? Specifically the "Named" flag. It has recently been applied to my node. thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJR8nm1AAoJENsz1IO7MIrrxjQIAIRB/Y+a0fyQvcA/b/3+PuT8 spVgrS6Ts39w0xncwO1DCcCDzA1EmEaQy2I6VZ1YYIk+qrDXSkyP8Gl2ACWJ8SZi Wjmt9OeQZYE3thUfXlEX4K0iqiu1vc26dHxR0VAwqV9a4GAFJ6vmDiwNLqhjEjVA a/uQdNwx1kPfApHMIDRRmBFRWGJ5v//3XxN1nS7Ty5q2ngR7ws9xfRJ6awpRrYFN vRpHPG/BGQGbcCsBsecGu/nSJaN+2mfqb9fRaHIeDUBtn6xV465BxmhZwCzf2sL4 jYoMnLByJodfImhT53qPBlgs/7HNuMbFldeREI21QlWEVi4eaN9BLS2/fe+rLQA= =R/y8 -----END PGP SIGNATURE-----

2 1

Yet another underpowered relay?
by Logforme 23 Jul '13

23 Jul '13

I recently upgraded from an adsl line to a 100mbit fiber connection. Naturally I want to use most of this new bandwidth for my non-exit tor relay. However, I run into messages like these: Jul 22 17:40:26.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [665 similar message(s) suppressed in last 60 seconds] Jul 22 17:40:26.000 [warn] Failed to hand off onionskin. Closing. [1509 similar message(s) suppressed in last 21600 seconds] Relay fingerprint: BE71 DC9D A443 5855 FAE1 E369 7080 1A60 0D51 3684 Relevant torrc settings: BandwidthRate 10 MB BandwidthBurst 10 MB NumCPUs 2 I did some research and came up with the following things to try: Set "MaxAdvertisedBandwidth x MB" Set "MaxOnionsPending 250" Get a faster computer / Get a computer with AES-NI I tried setting "MaxAdvertisedBandwidth 9 MB" for a few days which didn't seem to do much difference. This is only a 1MB reduction from the 10MB i use as a hard limit. Too little? Must I wait longer for the change to get spread around? Setting "MaxOnionsPending 250" seem to have reduced the number of log messages, but not eliminated them. The computer is somewhat dated but not ancient: Intel(R) Core(TM) i7 CPU 930 @ 2.80GHz, 4 cores with HT, 6GB mem. I feel it should be able to handle a 80 mbit bandwidth but have no hard data to support this. Looking at htop tor uses 2 cores. One core is constantly at around 90% (when all the 80 mbit bandwidth is used). The second core is hardly used. Since the relay can handle 80mbit (and higher) without messages I assume the problems only occur when the number of circuits get very high. Questions: What value should I set for MaxAdvertisedBandwidth? What other torrc settings could improve the situation? Am I wrong in thinking my cpu should be able to handle 80 mbit? Would upgrading to 0.2.4.15-rc-1 help? Weird sidenote: If I start iftop the first core drops to around 40-50%. Stop iftop and it jumps back to 90%. No change in traffic. What could that mean?

4 4

Re: [tor-relays] Exit relay operators: a call for packets on port 8118
by rotpoison throngnet 22 Jul '13

22 Jul '13

I believe you are exactly right, Javntea. Thank you for the insight. I opened up Privoxy for a few seconds on my node (below) and had similar results. I had no idea that pay for click advertisers would even accept referrals from Tor. It is pretty basic to filter identified exit relays and other anonymous proxies. So apparently the return of investment from this sort of clickfraud pays the leasing bills of thousands of servers? WoW, I have been schooled... - Kent 09:21:01.419951 IP 23.19.89.126.2318 > my.exit.node.8118: Flags [P.], seq 1:416, ack 1, win 65535, length 415 E.....@.u.u/..Y~B... ...^.]^M....P.......GET http://ad.media-servers.net/st?ad_type=iframe&ad_size=160x600&section=44321… Accept: */* Referer: http://giftcardsrus.net/index.php?option=com_content&view=article&id=1741:w… Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0) Host: ad.media-servers.net Connection: Keep-Alive 09:21:01.419973 IP my.exit.node.8118 > 23.19.89.126.2318: Flags [.], ack 416, win 6432, length 0 E..(..@.@...B.....Y~.. .....^.^.P.. .k.. 09:21:01.420501 IP my.exit.node.8118 > 23.19.89.126.2318: Flags [P.], seq 1:256, ack 416, win 6432, length 255 E..'..@.@...B.....Y~.. .....^.^.P.. .j..HTTP/1.0 403 Request blocked by Privoxy Content-Type: image/png Content-Length: 102 Cache-Control: no-cache Date: Mon, 22 Jul 2013 09:21:01 GMT Last-Modified: Wed, 08 Jun 1955 12:00:00 GMT Expires: Sat, 17 Jun 2000 12:00:00 GMT Pragma: no-cache 09:21:01.430712 IP 173.208.16.93.1094 > my.exit.node.8118: Flags [.], ack 1, win 65535, length 0 E..(...........]B....F...._..x..P....~........ 09:21:01.431701 IP 173.208.16.93.1094 > my.exit.node.8118: Flags [P.], seq 1:511, ack 1, win 65535, length 510 E..&...........]B....F...._..x..P.......GET http://ad.globe7.com/st?ad_type=pop&ad_size=0x0&section=3910946&banned_pop_… Accept: */* Referer: http://twicemagic.com/index.php?option=com_content&view=category&layout=blo… Accept-Language: en-us User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7) Host: ad.globe7.com Connection: Keep-Alive 09:21:01.431722 IP my.exit.node.8118 > 173.208.16.93.1094: Flags [.], ack 511, win 6432, length 0 E..(..@.@.b.B......]...F.x....a.P.. .... 09:21:01.432462 IP my.exit.node.8118 > 173.208.16.93.1094: Flags [P.], seq 1:256, ack 511, win 6432, length 255 E..'..@.@.a.B......]...F.x....a.P.. ....HTTP/1.0 403 Request blocked by Privoxy Content-Type: image/png Content-Length: 102 Cache-Control: no-cache Message: 3 Date: Mon, 22 Jul 2013 00:09:55 -0700 (PDT) From: Javantea <jvoss(a)altsci.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] Exit relay operators: a call for packets on port 8118 Message-ID: <20130722070955.1CF571380F1(a)mail.altsci.com> Content-Type: text/plain; charset="us-ascii" Hi Kent, I am getting 125 packets per second sustained incoming on port 8118 like you on my exit node. I noticed this last year but forgot about it because it was such low bandwidth. I count 2582 unique IPs in 20 minutes. I think you've found something significant. The obvious question is why since sending data in the clear is pretty worthless and it's going to come out of a tor exit node just like if they were using tor. I'm a security researcher and would be happy to help you learn more about these silly systems. You've already done most of the basic research though: who, what, and where. When I open port 8118 with netcat a few times I get this: GET http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=421110… HTTP/1.0 Accept: */* Referer: http://www.lotsoffree.com/index.php?option=com_content&view=article&id=84:f… Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3 Host: ad.yieldmanager.com Connection: Keep-Alive GET http://ib.adnxs.com/ttj?id=1284883 HTTP/1.0 Accept: */* Referer: http://www.psxobs.com/privacy-policy Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0 Host: ib.adnxs.com Connection: Keep-Alive That looks like clickfraud to me. Perhaps someone wrote a quick script that downloads the list of tor exit nodes and sends clickfraud requests to 8118 and was too lazy to add tor. That would mean that the sites in the referrer are the attackers and the url on the first line is the ad service which is being defrauded. Of course there is the possibility of a joe job occuring, but we know that at least some of them are the bad actors. Whois on both referrers returns China. I'm surprised that the script doesn't remove servers from the list that have the port closed. It's a very inefficient script. Regards, Javantea

1 0

relay uptime
by l3thal 22 Jul '13

22 Jul '13

Hi, I recently edited my torrc and accidentally did restart instead of reload so my uptime was reset. Will this negatively impact the 60 days to get a tshirt? -- l3thal - SmashTheStack <http://smashthestack.org>

2 2