- tor-relays - lists.torproject.org

Fwd: [Abuse[...]] GameoverZeus-Infektionen
by Ch'Gans 20 Jul '14

20 Jul '14

Hi there, I'm here to look for advice or comments on how to handle abuse reports when you run a TOR relay exit on a "server for the mass". I'm running the TOR exit node 18B6EBAF10814335242ECA5705A04AAD29774078 on Hetzner netowrk (50E/month, this is my contribution to the TOR project) So far I had to deal with few "easy" abuse reports (ssh scan, forum insults, spams, ...), I think i performed pretty well so far (thanks to Hetzner cooperation?) But today I just received this botnet related one. I do take this report seriously, I know that malware are more and more using the TOR network as an anonymous covert, I don't like malware, I don't like malicious botnet and I don't like spammers. Still I end up being identify as one of them. I knew from day one that it was a risky business to run an exit TOR node, but I want to stand up and fight. If only I can convince people of my right doing. First of all I am quite surprised that cert-bund.de (the complainant) didn't notice that I am a TOR exit node, so my first question (for people familiar with these guys) is: - How legit are these guys? Do they run for the German government? Are their simply trying to scare the shit out of me by citing europol.europa.eu, and us-cert.gov? (see redacted forwarded message below, my own opinion is "Yes") Then - Do they simply spam hosting company each time they have a probe sensing something somewhere (I know it's vague, but I can use that as a "this complainant is a spammer" kind of argument) Any other thoughts/remarks/comment on that matter? Regards, Chris Thought of the day: Nowadays it looks like server administrator tend to send abuse report each time they receive an illegal ping request! Testimony of the day: Last time I received an "SSH scan" abuse report, I sent back my SSH honeypot logs, which contains more than 5k login attempts per day. -------- Original Message -------- [..] ----- attachment ----- Dear Sir or Madam "Gameover Zeus" is malicious software which is primarily used by cybercriminals to carry out online banking fraud and to spy out login credentials for online services on infected PCs. It can also be used to install further malicious software (including blackmailing trojans such as "CryptoLocker" ransomware) on PCs or to carry out DDoS attacks. In a joint international campaign since the end of May 2014, law enforcement agencies, with the support of private sector partners, have taken action against the "Gameover Zeus" botnet [1]. As part of this campaign, it has now been possible to identify the IP addresses of systems infected with "Gameover Zeus" [2]. We are sending you a list of infected systems in your net area. Would you please examine the situation thoroughly and take appropriate measures to cleanse the systems. Sources: [1] Europol: International action against 'Gameover Zeus' botnet and 'CryptoLocker' ransomware <https://www.europol.europa.eu/content/international-action-against- gameover-zeus-botnet-and-cryptolocker-ransomware> [2] ShadowServer: Gameover Zeus & Cryptolocker <http://blog.shadowserver.org/2014/06/08/gameover-zeus-cryptolocker/> [3] US-CERT: GameOver Zeus P2P Malware <https://www.us-cert.gov/ncas/alerts/TA14-150A> A list of infected systems in your net area: [...] Kind regards, Team CERT-Bund

6 8

Busted links on Tor Relay standard web page
by mick 15 Jul '14

15 Jul '14

My apologies if this has been discussed before and I have missed it. I have been reviewing the web page on my relay (which is based on the standard Tor explanation page) and have noticed that several links are now broken following update of the Tor site itself (e.g. https://www.torproject.org/torusers.html.en no longer exists) I also notice that https://tor-svn.freehaven.net/svn/tor/trunk/contrib/exitlist cannot be reached at all and the same page over http seems not to exist. If other operators are similarly using a page based on the old template, they may wish to update. Best Mick --------------------------------------------------------------------- Mick Morgan gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 http://baldric.net ---------------------------------------------------------------------

1 0

badexit D9B6E8F3DC60095F25252A1986E90932454C24D3
by grarpamp 15 Jul '14

15 Jul '14

Breaks TLS on check.torproject.org, etc.

4 7

Reminder: Pre-PETS event Tuesday
by Moritz Bartl 15 Jul '14

15 Jul '14

Everyone in Amsterdam should come. And bring friends! :) https://blog.torproject.org/events/researchers-practitioners-meetup-pets-am… -- Moritz Bartl https://www.torservers.net/

2 1

Oubound Ports
by Greg Moss 11 Jul '14

11 Jul '14

Newbie to Tor but have a Debian server up and running as a relay. Do I need to filter outbound traffic from the tor server on my firewall. If yes what ports would I need to open. I am also have a good look a Tails any suggestions would be helpful. Thanks - gm

10 18

Exits behind a next-gen firewall? Opinions please
by Jesse Victors 11 Jul '14

11 Jul '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hey guys, I've been running some exit nodes for some time now, and they're doing well. They've burned through many terabytes of bandwidth, and thanks to Tor's recommended reduced exit policy, complaints have been minimal. Clearly the vast majority of the Tor traffic is not malicious, but I have received some reports from other companies and from my ISP of hacking attempts: SQL Injection, XSS, botnet C&C, basic things like that. My ISP now tells me that they could reduce the reports even further by routing the exits through a "next-generation firewall" which apparently can detect an obvious clearnet attack and drop that connection a few milliseconds after the attack occurs. I don't know how the firewall works in detail, perhaps it has the ability to drop a specific connection rather than drop all access to the destination IP for a while, nor do I know how it would interact with Tor's traffic patterns out of an exit. I'm posting here for opinions. My question is, is this a good idea, and if so, any advice? Does anyone have any experience with such a setup? - -- Jesse V. /PGP 0xC20BEC80/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQF8BAEBCgBmBQJTvyBdXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yAbrcH/2IG+Z6jVNhj9j5EpvHkzl0V XXn1Fbkw7EV8P+cRfQwgmouGQZ4IhuD9QP21ql7wvAIHIkIeaKNtXDb1jELL6F3z b1r8IRm2ePOJNl3X3m/5NIbqbz2utdaRqLglo9vhmr26zx+VMJBfzE5AvVLUhq9B CzBYjJujJcASH9KWN08hhjxu81mS0xUmUnFJIfoV7sJto2y3EmJuCQXauMBsxDsf 1rNQFcoxfKS1YI1v1MdBA/xHNO+UaLUShFQR1mw7RIW8jaPNLTGE157nPXMq9xiX nTzOjkgZ3RI+qrmhcjwJEcV9BAAO86C6HXJvflbhkVPZkCBB43LFCeUKf+SGRR4= =98Se -----END PGP SIGNATURE-----

4 3

Parliamentary inquiry about legal status of running Tor in Austria
by MacLemon 10 Jul '14

10 Jul '14

Hoi! This is a cross posting tor-talk/tor-relays (Due to the current attention on the recent events in Austria. Thanks for understanding.) Niko Alm (of Austrian political party NEOS) has made an official parliamentary inquiry to the Austrian ministry of justice about the legal status of Tor. Blog posting: http://alm.at/tor/ (in german language) Inquiry: http://neos.eu/klub/20140708_AF-TOR-BMJ.pdf (in german language) In theory running a relay/exit _should_ be covered by Austrian E-Commerce law §13. It's just not legally proven that Tor also falls under the definition of a “communications network” from a legal point of view. Technically everyone would certainly agree that this is the case. From what I understand the goal is to get an official statement by the Austrian ministry of justice that Tor falls under the legal definition of a communications network. Which would mean, that Relay-Ops are not liable for the traffic passing through their relays given they do not initiate the traffic by themselves do not select the recipient of the information do not select or alter the transmitted information This includes caching. Austrian E-Commerce law, §13 legal text (german language) http://www.jusline.at/index.php?cpid=ba688068a8c8a95352ed951ddb88783e&lawid… Best regards MacLemon

2 1

Unprompted HUPs
by kingqueen 09 Jul '14

09 Jul '14

hi, Checking the log of my relay, I see that sometimes it reloads its configuration from what it says is a HUP signal. An example: "06:40:57 [NOTICE] Received reload signal (hup). Reloading config and resetting internal state." I don't understand, as I was asleep at that point and didn't interact with the relay or the server at all, I haven't set up anything to automatically issue a HUP. Does Tor automatically trigger its own HUP every so often? Thanks --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

2 1

Google captcha
by kingqueen 09 Jul '14

09 Jul '14

Hello Since running a relay, I have frequently had the notice akin to "Google has detected unusual activity from your computer or network" and had to do the captcha, when I have connected via the server that the relay is running on; both by Chromium over VNC and by Firefox over OpenVPN. The thing is, I am not, and have never been, an exit node. I was a middle node and am now a guard node. So I am somewhat confused as to why Google is getting unusual activity from my server? I guess it could be a coincidence and somebody else from the server farm has tripped it, but it seems a remarkable coincidence, as I have run the dedi for nearly a year and didn't have the Google notice until after the Tor relay was started in the last three weeks or so. But I don't understand how being a Tor relay could have tripped it, as I've never been an exit node. Thank you --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

3 3

"excessive bounces" on tor-relay list
by Kali Tor 09 Jul '14

09 Jul '14

Hi, I keep getting the warning once in a while that there are excessive bounces from my email address and that my membership to this list has been disabled until I click on a link to re-enable it. Is there any reason why something like this would happen? I use yahoo mail, as you can see but I just don't know why Yahoo Mail would bounce any message. I have not received any warnings from Yahoo about such an action. Thanks, -kali-

4 3