- tor-relays - lists.torproject.org

17 new relays at OVH (2018-10-24)
by nusenu 14 Dec '18

14 Dec '18

Hi, if you are the operator that added 17 new relays at OVH on 2018-10-24 (full list bellow), please set a ContactInfo and especially the MyFamily in your torrc to avoid putting tor clients at risk. kind regards, nusenu > added on 2018-10-24 > > | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | > |------+-------+------------+---------------+------+-------+--------+-----------+---------------------------+--------------------+---------------+------------------------------------------| > | 1 | 0 | 13:43:16 | 145.239.0.204 | de | 443 | 0 | 0.3.4.8 | None | Chief | 1 | 5EF464D06322614A3B8B6C2652C3C616F098EE8A | > | 1 | 0 | 13:43:17 | 54.37.200.155 | fr | 443 | 0 | 0.3.4.8 | None | Dash | 1 | B55F8445569407FBE6BAF205799A9EF8AC8CC256 | > | 1 | 0 | 13:43:18 | 51.68.170.247 | fr | 443 | 0 | 0.3.4.8 | None | Rebel | 1 | E7B036D933D6E0A68983E8E3F664EAA54ACDEA37 | > | 1 | 0 | 13:43:20 | 51.75.82.166 | fr | 443 | 0 | 0.3.4.8 | None | Butch | 1 | 4809E3F9A73F5373734A4D23E7E7807A4743DD8A | > | 1 | 0 | 13:43:21 | 51.75.153.17 | fr | 443 | 0 | 0.3.4.8 | None | Beauty | 1 | B66FBE3B2D9CE257AF75DEA760C69E379F7CDB80 | > | 1 | 0 | 13:43:22 | 51.68.170.74 | fr | 443 | 0 | 0.3.4.8 | None | Killer | 1 | E4CB0C293588C3E5FA7DB94485FF2686E128267F | > | 1 | 0 | 13:43:23 | 51.68.185.141 | fr | 443 | 0 | 0.3.4.8 | None | Arrow | 1 | 707F51E232E0CDAF64EC446609E7112CD3AD11F8 | > | 1 | 0 | 13:43:24 | 54.37.207.82 | fr | 443 | 0 | 0.3.4.8 | None | Dazzle | 1 | B80142DDCF8D6B72929541EFCC643ECCD99BEE36 | > | 1 | 0 | 13:50:41 | 145.239.1.97 | de | 443 | 0 | 0.3.4.8 | None | Memo | 1 | 1C514FA1A4F8A464E1853B70AA5D2F16FF087AD2 | > | 1 | 0 | 13:50:42 | 51.38.107.122 | fr | 443 | 0 | 0.3.4.8 | None | Pitch | 1 | 91B026FA459AE0DA15673AB07A9C6DFF8B41782B | > | 1 | 0 | 13:50:43 | 51.68.186.59 | fr | 443 | 0 | 0.3.4.8 | None | Smasher | 1 | 3B0EFDE689693CFDEC2305F7B99D5B2FA4A77D91 | > | 1 | 0 | 13:50:44 | 51.75.85.114 | fr | 443 | 0 | 0.3.4.8 | None | Landslide | 1 | C953A4C8DF0E233CB0D190C2A71B71F634AB4A14 | > | 1 | 0 | 13:50:45 | 51.68.182.30 | fr | 443 | 0 | 0.3.4.8 | None | Shade | 1 | EBE58DDCC51A9D23EE9DD39791695B608A1DFB29 | > | 1 | 0 | 13:50:46 | 54.37.207.37 | fr | 443 | 0 | 0.3.4.8 | None | Buster | 1 | D10C82E275A2B0121CF4075C92687F0786A72892 | > | 1 | 0 | 13:50:47 | 54.37.200.157 | fr | 443 | 0 | 0.3.4.8 | None | Digger | 1 | 6B29A78EEB42D318290DB60C6A2EDC714F1BAD42 | > | 1 | 0 | 13:50:48 | 54.37.207.84 | fr | 443 | 0 | 0.3.4.8 | None | Pipi | 1 | 150F7C9F4814C4918F4D2DEAA0C7A2255DC8C0E0 | > | 1 | 0 | 13:50:49 | 51.75.153.19 | fr | 443 | 0 | 0.3.4.8 | None | Shrimp | 1 | 51429A0F427A8DCB5B9DE64E35ECBBB76DAB0F7F | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

AS: "OVH SAS" - 17 relays (2018-10-24)
by nusenu 13 Dec '18

13 Dec '18

a relay gang joined in Oct 2018 at OVH 2018-10-24 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+---------------+------+-------+--------+-----------+---------------------------+--------------------+---------------+------------------------------------------| | 1 | 0 | 13:43:16 | 145.239.0.204 | de | 443 | 0 | 0.3.4.8 | None | Chief | 1 | 5EF464D06322614A3B8B6C2652C3C616F098EE8A | | 1 | 0 | 13:43:17 | 54.37.200.155 | fr | 443 | 0 | 0.3.4.8 | None | Dash | 1 | B55F8445569407FBE6BAF205799A9EF8AC8CC256 | | 1 | 0 | 13:43:18 | 51.68.170.247 | fr | 443 | 0 | 0.3.4.8 | None | Rebel | 1 | E7B036D933D6E0A68983E8E3F664EAA54ACDEA37 | | 1 | 0 | 13:43:20 | 51.75.82.166 | fr | 443 | 0 | 0.3.4.8 | None | Butch | 1 | 4809E3F9A73F5373734A4D23E7E7807A4743DD8A | | 1 | 0 | 13:43:21 | 51.75.153.17 | fr | 443 | 0 | 0.3.4.8 | None | Beauty | 1 | B66FBE3B2D9CE257AF75DEA760C69E379F7CDB80 | | 1 | 0 | 13:43:22 | 51.68.170.74 | fr | 443 | 0 | 0.3.4.8 | None | Killer | 1 | E4CB0C293588C3E5FA7DB94485FF2686E128267F | | 1 | 0 | 13:43:23 | 51.68.185.141 | fr | 443 | 0 | 0.3.4.8 | None | Arrow | 1 | 707F51E232E0CDAF64EC446609E7112CD3AD11F8 | | 1 | 0 | 13:43:24 | 54.37.207.82 | fr | 443 | 0 | 0.3.4.8 | None | Dazzle | 1 | B80142DDCF8D6B72929541EFCC643ECCD99BEE36 | | 1 | 0 | 13:50:41 | 145.239.1.97 | de | 443 | 0 | 0.3.4.8 | None | Memo | 1 | 1C514FA1A4F8A464E1853B70AA5D2F16FF087AD2 | | 1 | 0 | 13:50:42 | 51.38.107.122 | fr | 443 | 0 | 0.3.4.8 | None | Pitch | 1 | 91B026FA459AE0DA15673AB07A9C6DFF8B41782B | | 1 | 0 | 13:50:43 | 51.68.186.59 | fr | 443 | 0 | 0.3.4.8 | None | Smasher | 1 | 3B0EFDE689693CFDEC2305F7B99D5B2FA4A77D91 | | 1 | 0 | 13:50:44 | 51.75.85.114 | fr | 443 | 0 | 0.3.4.8 | None | Landslide | 1 | C953A4C8DF0E233CB0D190C2A71B71F634AB4A14 | | 1 | 0 | 13:50:45 | 51.68.182.30 | fr | 443 | 0 | 0.3.4.8 | None | Shade | 1 | EBE58DDCC51A9D23EE9DD39791695B608A1DFB29 | | 1 | 0 | 13:50:46 | 54.37.207.37 | fr | 443 | 0 | 0.3.4.8 | None | Buster | 1 | D10C82E275A2B0121CF4075C92687F0786A72892 | | 1 | 0 | 13:50:47 | 54.37.200.157 | fr | 443 | 0 | 0.3.4.8 | None | Digger | 1 | 6B29A78EEB42D318290DB60C6A2EDC714F1BAD42 | | 1 | 0 | 13:50:48 | 54.37.207.84 | fr | 443 | 0 | 0.3.4.8 | None | Pipi | 1 | 150F7C9F4814C4918F4D2DEAA0C7A2255DC8C0E0 | | 1 | 0 | 13:50:49 | 51.75.153.19 | fr | 443 | 0 | 0.3.4.8 | None | Shrimp | 1 | 51429A0F427A8DCB5B9DE64E35ECBBB76DAB0F7F | https://nusenu.github.io/OrNetRadar/2018/10/24/a3 -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

2 1

Current state of HSDir attacks on hidden services
by Jonathan D. Proulx 13 Dec '18

13 Dec '18

Hi All, The recent thread on ColoCrossing nodes[1] has gotten me wondering about the current state of HSDir attacks on hidden sites my web searching has only turned up some articles that are a few years old. Is it really still the case that spending a little time crafting the "right" finger prints i sall it takes for an adversary to reliably host the HSDir for a given hidden service? Well and 4-5 days uptime... Assuming the new ColoCrossing nodes are maliciously target ina particular hidden service is it just their sloppiness of putting them all up in the same place over a short period rather than in a slower and more widely distributed manner the only thing that prevented them from acheving their unmasking goals? Seems like it would be trivial for even a moderately funded attacker to put up 16-32 nodes across a similar number of hosting providers, https://www.terraform.io framework for example seems to support about 37 different "cloud providers" so finding that number of unique providers isn't really hard. If they also set them up at semirandom intervals over the course of a month or so who could ever tell? -Jon -- [1] https://lists.torproject.org/pipermail/tor-relays/2018-December/016712.html

2 2

Re: [tor-relays] Current state of HSDir attacks on hidden services
by Isaac Grover, Aileron I.T. 13 Dec '18

13 Dec '18

Good morning Jon, In addition to fingerprint correlation and AS choice, I also recall reading this paper about identifying hidden services using clock skew based on internal CPU temperature: https://murdoch.is/papers/ccs06hotornot.pdf . The paper is older, but I'm curious if such an attack method is still effective? Make your day great, Isaac Grover, Senior I.T. Consultant Aileron I.T. - " Because #ProactiveIsBetter " O: 715-377-0440<tel:715-425-0440>, F:715-690-1029<tel:715-690-1029>, W: www.aileronit.com<http://www.aileronit.com/> LinkedIn: https://www.linkedin.com/in/IsaacGrover/ YouTube: https://www.youtube.com/channel/UCqrwZNFKdR-guKtuQzFPObQ

1 0

AS: "ColoCrossing" - 28 new relays
by nusenu 12 Dec '18

12 Dec '18

these relays look rather strange and are likely operated by a single entity, watch out. 2018-12-10 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+----------------+------+-------+--------+---------------+---------------------------+--------------+---------------+------------------------------------------| | 1 | 0 | 03:18:23 | 23.95.85.216 | us | 9447 | 0 | 0.3.5.5-alpha | bddwwell6_at_gmail_com | Bottom00S | 1 | C00BF86148C5391530FAFB550BD79706BCB55EB7 | | 1 | 0 | 03:26:38 | 107.173.70.100 | us | 10401 | 0 | 0.3.5.5-alpha | _bch440w AT yeezee.io | Porksoundz | 1 | C00BCA7A0EE03FD6E8B9BBBE1D9250DC2194EFD9 | | 1 | 0 | 03:36:15 | 107.173.70.107 | us | 15888 | 0 | 0.3.5.5-alpha | look4dotme at-hotmail.com | PLZTornode | 1 | C00B7102C5E1CF4F18CB529F05830FCCC1BDC611 | | 1 | 0 | 03:58:30 | 172.245.97.224 | us | 9700 | 0 | 0.3.5.5-alpha | abaubum@ mail_com | LikeTORLike | 1 | 2D56F86ABB41462E1CAA58F55F0BA15E843B5FDB | | 1 | 0 | 04:16:08 | 198.46.182.191 | us | 10534 | 0 | 0.3.5.5-alpha | fofalafel_gmail_com | RedSBoll999 | 1 | 2D56F2422C0DC5BA859E9167321314A26B1557C6 | | 1 | 0 | 04:20:57 | 23.95.0.211 | us | 13013 | 0 | 0.3.5.5-alpha | crab33s(a)yahoo.com | ifufcrab | 1 | 2D56FB048E4838534CA3F5276591632A64FE99F5 | | 1 | 0 | 05:23:14 | 107.173.70.105 | us | 12712 | 0 | 0.3.5.5-alpha | evertme2_atmail_net | ihaZtordrunk | 1 | 2EBFF85DAEB4CB84A117F801801BE9A536AE7524 | | 1 | 0 | 05:31:33 | 23.95.85.216 | us | 9404 | 0 | 0.3.5.5-alpha | __do_wwoo_rry___at__gmail | UKNOWnoto | 1 | 48A3DD64243F50550ABEFA1EB73D8D50E701C370 | | 1 | 0 | 06:27:32 | 172.245.97.194 | us | 12059 | 0 | 0.3.5.5-alpha | distorikATgmail.COM | erRHeroes | 1 | 2EBFFE2CBC8F1AC47EF3406B8010BDBDD9A83084 | | 1 | 0 | 06:32:40 | 107.173.70.103 | us | 11930 | 0 | 0.3.5.5-alpha | strapaganzza at mail.net | nerevgiuap | 1 | 48A3F20EA43CC7B4B124D3F8894795D31A3F90E4 | | 1 | 0 | 07:20:14 | 107.173.70.100 | us | 9902 | 0 | 0.3.5.5-alpha | painkillsde __AT__gmail_c | coldBloodT | 1 | 48A3F9E9990FB122839DD301D2195E2040DFD02F | | 1 | 0 | 08:28:44 | 107.173.70.104 | us | 9581 | 0 | 0.3.5.5-alpha | grave345235(a)gm__ail.com | rEPlace3r | 1 | AA08AE727D782C71930D828C4236CB2434E559C6 | | 1 | 0 | 08:33:40 | 107.173.70.102 | us | 16870 | 0 | 0.3.5.5-alpha | nneoodww9 at mail.com | Historitian | 1 | 8788B1A28148ABD7C48ADF00791BBE795BC4A282 | | 1 | 0 | 09:17:47 | 107.173.70.105 | us | 9292 | 0 | 0.3.5.5-alpha | ultimost_gmail_at | Bailarumba | 1 | AA088A35AFC64BE27806EB4CEB8DA059F157EBD9 | | 1 | 0 | 09:21:48 | 198.46.182.211 | us | 13873 | 0 | 0.3.5.5-alpha | augllsdn4(a)gmail.com | lighTOR | 1 | 878874CD42DE8695A0C02B6A5385E18638C0F95A | | 1 | 0 | 09:55:11 | 198.46.182.191 | us | 14037 | 0 | 0.3.5.5-alpha | elistranoob AT gmail dot. | ChOue | 1 | AA08CE96617B2D3B6F4753805B6C8244E07A40E9 | | 1 | 0 | 10:01:14 | 107.173.70.107 | us | 11389 | 0 | 0.3.5.5-alpha | to_me_baby at yahoo.com | bagarabild | 1 | 8788AAB8C1E28693C30CFC4159EE0F313C25D610 | | 1 | 0 | 15:30:33 | 107.173.70.10 | us | 9075 | 0 | 0.3.5.5-alpha | besktrsop(a)gmail.com | TorpDay | 1 | A099DAA630AC76F03FBB6138E2EBA884151E8706 | | 1 | 0 | 15:34:27 | 23.95.85.215 | us | 17563 | 0 | 0.3.5.5-alpha | bebe_rexa AT nomail.com | RepeldeVay | 1 | FB346238C8FCB515A49F53049D0129BF69EAD7CA | | 1 | 0 | 15:39:48 | 198.46.182.208 | us | 15199 | 0 | 0.3.5.5-alpha | pokerspot1(a)yahoo.com | delldivision | 1 | A099ED2475CE64280119ECDE46EA414931014540 | | 1 | 0 | 15:43:46 | 192.227.155.34 | us | 14413 | 0 | 0.3.5.5-alpha | justnomail1 AT gmail com | elitor00 | 1 | FB34E30229A265047A6A136AECA4CBBAA88EA12E | | 1 | 0 | 15:48:34 | 107.173.70.102 | us | 18204 | 0 | 0.3.5.5-alpha | spint000r_AT_jepajio.io | SPintro | 1 | A099DBA1456E1A185613DE047F728BA48D8CB79B | | 1 | 0 | 16:21:19 | 172.245.97.194 | us | 17781 | 0 | 0.3.5.5-alpha | mustamus3d_at_gmail_ | mustaHesh | 1 | FB347A7601D71BA4F929C27EDCC2A9B168DF0B79 | 2018-12-09 | Up | Ext | JoinTime | IP | CC | ORp | Dirp | Version | Contact | Nickname | eFamMembers | FP | |------+-------+------------+----------------+------+-------+--------+---------------+---------------------------+-------------+---------------+------------------------------------------| | 1 | 0 | 11:48:20 | 23.95.85.215 | us | 15349 | 0 | 0.3.5.5-alpha | vejj2dw_at_gmail.com | Veloprises | 1 | A677EE072DA6F8E6E902EC4B6CE35AE78CF450B6 | | 1 | 0 | 12:11:32 | 107.173.70.106 | us | 12001 | 0 | 0.3.5.5-alpha | yeeeyahoo dog yooh.net | nightmareON | 1 | A677EA1818F2EC649B583CBDD8F30AF3B7A09A23 | | 1 | 0 | 12:21:13 | 23.95.0.211 | us | 10509 | 0 | 0.3.5.5-alpha | meyuo AT school DOT ymail | DinoSource0 | 1 | A677F3CC1019AB162174CBB58C803E4C17268CD4 | | 1 | 0 | 13:42:45 | 107.173.70.101 | us | 11766 | 0 | 0.3.5.5-alpha | LOTOLOT_at yahoo.com | L0t0siaa | 1 | D021F4D88E2A87A184D72EC0FC7558DB29D161F5 | | 1 | 0 | 14:01:04 | 192.227.155.34 | us | 13968 | 0 | 0.3.5.5-alpha | chemie333 AT_vfmail.net | Hemabab3 | 1 | D021FF49FEF26D36C27E68C1A89E6F237DCDF5AC | -- https://twitter.com/nusenu_ https://mastodon.social/@nusenu

8 11

Monitoring a Tor-Relay - Telegraf / InfluxDB / Grafana ?
by petrarca＠protonmail.ch 08 Dec '18

08 Dec '18

I was thinking about setting up a monitoring of a Tor-Relay using Telegraf, InfluxDB and Grafana. Although I did read quite some documenation about it already I thought it might be good to check for possible experiences made here before spending (wasting) too much time trying it out myself. Questions I could not answer yet myself include e.g. - What will be the performance impact of running Telegraf on a Tor-Realy (CPU, disk, I/O,...)? - What happens if the InfluxDB (running on another system) is not reachable (maintenance, outages) - is the data lost or buffered somehow? - I would like to also keep see old/historical data but not as granular as more recent data - is there any way to boild down old data, e.g. to only keep hourly data for data older that a month etc.? There are an overwhelmingly number of monitoring possibilities (munin, collecd, monit, nyx, RRDtool, Cacti, Monitorix, Nagios, Zabbix,...) out there and one could easily spend days if not weeks with reading and testing. So any kind of shared experiences, hints or tips are more than welcome. .

3 2

Re: [tor-relays] Monitoring a Tor-Relay - Telegraf / InfluxDB / Grafana ?
by Olaf Grimm 08 Dec '18

08 Dec '18

For a tor relay that is not neccessary. After I thought about this in the past I decided it so after local watching. Now I use "htop" and "bwm-ng", "nload" and "nyx" via SSH on the remote server. You can use the website "uptime monitor" if you want to get a mail after server crash or other network errors. My preference is the tor monitoring network https://metrics.torproject.org. Why you want to use a big monitoring solution? If your tor relay is a second paylod on the server this ist ok, but this is not the right discussion channel here. Olaf Am 08.12.18 um 10:01 schrieb petrarca(a)protonmail.ch: > I was thinking about setting up a monitoring of a Tor-Relay using Telegraf, InfluxDB and Grafana. Although I did read quite some documenation about it already I thought it might be good to check for possible experiences made here before spending (wasting) too much time trying it out myself. > > Questions I could not answer yet myself include e.g. > > - What will be the performance impact of running Telegraf on a Tor-Realy (CPU, disk, I/O,...)? > - What happens if the InfluxDB (running on another system) is not reachable (maintenance, outages) - is the data lost or buffered somehow? > - I would like to also keep see old/historical data but not as granular as more recent data - is there any way to boild down old data, e.g. to only keep hourly data for data older that a month etc.? > > There are an overwhelmingly number of monitoring possibilities (munin, collecd, monit, nyx, RRDtool, Cacti, Monitorix, Nagios, Zabbix,...) out there and one could easily spend days if not weeks with reading and testing. So any kind of shared experiences, hints or tips are more than welcome. > > . > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Re: [tor-relays] Who is permanently checking my bridge relay?
by teor 05 Dec '18

05 Dec '18

Hi, > On 4 Dec 2018, at 21:27, tschador(a)posteo.de wrote: > > Hi all! > > I wonder who is permanently connecting/checking(?) my Tor bridge relay. > The ip is 66.111.2.129 and the period of the connects are 21 min 21 sec, > e.g.: > > Dec 4 10:32:00 SRC=66.111.2.129 > Dec 4 10:53:21 SRC=66.111.2.129 > Dec 4 11:14:43 SRC=66.111.2.129 > Dec 4 11:36:04 SRC=66.111.2.129 > Dec 4 11:57:26 SRC=66.111.2.129 > Dec 4 12:18:52 SRC=66.111.2.129 > > https://metrics.torproject.org/rs.html#search/66.111.2.129 gives no match. > > Any more experiences with other bridges? A few years ago, I opened a ticket to randomise authority reachability testing: https://trac.torproject.org/projects/tor/ticket/13928 But we triaged it out with the comment: My rationale for redlining it during triage was that the best place to do unpredictable-order testing is probably in a successor to torflow. (sbws is a successor to torflow, and it does randomise the testing order.) Are there any good reasons to randomise the order of authority tests? One good reason is that it breaks patterns in the authority checks, so relays really do need to be up all the time to be listed as reachable. T

1 0

IP addresses on the list
by Charly Ghislain 05 Dec '18

05 Dec '18

We have seen ip addresses posted on this list recently. They were coming from the logs. I think it would be nice if the software powering this list could scramble all ips in message bodies. At least having to reformat them in order to avoid that filter would give the poster some time to realize if it is a good idea to post it in the first place. I am also questioning myself whether addresses should be printed in log files altogether. Maybe even with the unsafe flag on - at least for released versions. If one wants to know which ip is connecting to her bridge, she can use whatever network capture software already existing. Any opinion? Thanks, Charly

3 2

Re: [tor-relays] Who is permanently checking my bridge relay?
by Charly Ghislain 05 Dec '18

05 Dec '18

If it wasn't, would posting the ip address of a client connecting to a bridge in here compromise her anonymity and/or allow one to firewall/blacklist her traffic? Im assuming one could guess the ip address of the running bridge based on the poster email address. On Tue, Dec 4, 2018 at 2:57 PM <tschador(a)posteo.de> wrote: > On 2018-12-04 13:15, George wrote: > > > tschador(a)posteo.de: > > >> I wonder who is permanently connecting/checking(?) my Tor bridge relay. > > > > > > That's the bridge directory authority. > > Ok, thank you. > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >

4 5