- tor-relays - lists.torproject.org

Re: [tor-relays] NSA knew about Heartbleed
by Eric Giannini 11 Apr '14

11 Apr '14

This is an excellent email. ------------------------------ On Fri, Apr 11, 2014 5:32 PM PDT Jesse Victors wrote: > >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA512 > > >Saw this article: >http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-b… > >"The U.S. National Security Agency knew for at least two years about a >flaw in the way that many websites send sensitive information, now >dubbed the Heartbleed bug, and regularly used it to gather critical >intelligence, two people familiar with the matter said. The NSA said in >response to a Bloomberg News article that it wasn?t aware of Heartbleed >until the vulnerability was made public by a private security report. >The agency?s reported decision to keep the bug secret in pursuit of >national security interests threatens to renew the rancorous debate over >the role of the government?s top computer experts." > >Thanks NSA, glad you've got our backs there. > >If you run a relay and you have been on one of the affected versions of >OpenSSL, I would urge you to STRONGLY CONSIDER your relay compromised. >Delete your keys per the recommendations and let Tor generate new ones. >It's better to cripple the network temporarily while we come back from >this, rather than preserving the uptime with possibly compromised keys. >Security matters here. Please follow the best practice recommendations. >If you run a web server, rekey your SSL certificates. Basically, if you >were affected, consider encryption to have been bypassed and passwords >and other sensitive information compromised. We cannot afford to take >chances here. If the NSA knew it, you can also bet that someone else >with a good static analyzer discovered it as well, I'll let you imagine one. > >Good luck out there everyone, we really need to revoke our keys if we >were affected. Seriously, guys. It's worth it. > >On a lighter note, https://xkcd.com/1354/ > >Stay safe. Live long and prosper. >Jesse V. > >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.4.14 (GNU/Linux) >Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > >iQF8BAEBCgBmBQJTSImHXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w >ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQxMjgyMjhENjEyODQ1OTU1NzBCMjgwRkFB >RDk3MzY0RkMyMEJFQzgwAAoJEK2XNk/CC+yA0nIIAKj1lOXRGcwMFd39CxjnymSN >FVzrPUa/JomCJHqW/A0xSFdxbVAZIvio6C1phuWHmiiDKhsBuBGwLNzXQMGFltaw >BnaTO1lLCvvSbEdmXPg12hR3YqR1d5D7Xnb0iTlSfrjZ7gGDEsXoJG3pU/V/RCFo >IOEqxfZtVcI3DdrImlwcR6gPw6ip9JlTo49w8ncy6/K4cHED2liCQ13JvWjaQzSl >uB06eWNsNo1IhPCKkZ7gFzharhN/4kAQrytC+ZcTmIrXdPrsd1lUaVICHWK9AEon >sciDu5lI77srXWwt77YVAKw6Jrls41N3USgvKBSrxZhfBVQlCPOmoXtTHdwbhks= >=pmBQ >-----END PGP SIGNATURE----- > >_______________________________________________ >tor-relays mailing list >tor-relays(a)lists.torproject.org >https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

Long-term effect of Heartbleed on Tor
by Tom van der Woerdt 10 Apr '14

10 Apr '14

What's the long-term effect of Heartbleed on Tor? * Should we consider every key that was created before Tuesday a bad key and lower their consensus weight? * Should authorities scan for bad OpenSSL versions and force their weight down to 20? A lot of relays will continue running bad OpenSSL versions which seriously hurts the security of Tor. A month from now the NSA/CGHQ/CIVD/etc may know the private keys of a large chunk of these relays and possibly be able to decode a big chunk of traffic... Tom

6 7

Re: [tor-relays] Strange Problem Browsing Blocked Websites‏
by sssheep 09 Apr '14

09 Apr '14

On Thu, 10 Apr 2014 04:26:27 +0000 (UTC) Enrique Fynn <enriquefynn(a)gmail.com> wrote: > On 10 April 2014 01:01, Tor Relays at brwyatt.net <tor(a)brwyatt.net> > wrote: > > > > If I remember correctly, Firefox has a bug where it won't do DNS > > lookups over a SOCKS proxy. It will, however do DNS lookups through > > an HTTP proxy that supports it, such as Polipo. If you configure > > Polipo to act as an HTTP proxy that forwards to the Tor SOCKS > > proxy, and add Polipo to your Firefox config as an HTTP proxy (you > > can leave Tor's SOCKS proxy entry), this may resolve the issue your > > are seeing, assuming DNS blocking/filtering in your country. > > > > Bryan > > That's not a bug, it's firefox default behavior. To change this: > 1- Go to about:config > 2- Set network.proxy.socks_remote_dns to true > This is set already in TBB which you should be using. It exists for a reason, use it instead of attempting to create your own solution.

1 0

Strange Problem Browsing Blocked Websites‏
by Ferdi GULER 09 Apr '14

09 Apr '14

Hello All, Today I have installed tor on my raspberry pi and also set it up as a relay. I can monitor tor traffic using arm so it means it is working. My SocksPort configuration is 9050, 192.168.1.187:9050 where 192.168.1.187 is internal ip of my raspberry pi.In order to anonymize my browsing traffic on my main windows PC, I configured Firefox to use my raspberry pi as proxy on port 9050. When I visit the page https://check.torproject.org/, it says my configuration is successful and I see different ip address. From that point I assume everything should work properly but if I try to browse web sites that are blocked in my country such as youtube it just does not connect. However if I use VPN I can see those blocked web sites. So could anyone please tell me what is wrong with my configuration? I'm realy confused... Thanks in advance!

4 4

Atlas Entry
by Tor Relay 09 Apr '14

09 Apr '14

My several attempts to update to TBB 3.5.4 (XP)unsuccessfully made Tor exit upon starting, so I fell back to 3.5.3. Atlas shows that my efforts hadn't gone unnoticed; OnionTorte now appears four times w/ my IP address. 0D50D43BAA728D6E0C4EB181AB79E5C1D7036D08 is the correct one but it somehow has my bandwidth as 489 KB when it should be 921.6 KB, reflecting my RelayBandwidthRate. Does anybody have a way of clearing the ghost entries and setting Atlas straight on my bandwidth? Thanks, P -- Dirt kicked to the curb goes into the gutter. Professionals kicked to the curb go into retail.

2 1

Re: [tor-relays] Relays vulnerable to OpenSSL bug: Please upgrade
by tor＠t-3.net 09 Apr '14

09 Apr '14

On 04/09/2014 04:39 AM, Roger Dingledine wrote:> On Tue, Apr 08, 2014 at 07:31:43PM -0600, Jesse Victors wrote: >> I'd recommend that every relay operator delete their keys as well, > > Not every. Those on OpenSSL 0.9.8, e.g. because they're using Debian > oldstable, were never vulnerable to this bug. I imagine there are some > FreeBSD or the like people out there in a similar boat. And Centos > people, etc. > > --Roger > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > The most up-to-date CentOS was supposedly vulnerable? Same as RedHat. But I don't know how to test for the vulnerability itself so I don't really know. Redhat's emailed warning to update OpenSSL went out yesterday as "Security Advisory - RHSA-2014:0376-1". CentOS' updated OpenSSL was available right away as well, and the CentOS 6.5 boxes pulled it right down in an update. I did have some slightly older CentOS 5 boxes which had a version of SSL that was reportedly not vulnerable. Page heartbleed.com said: How about operating systems? Some operating system distributions that have shipped with potentially vulnerable OpenSSL version: Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4 Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11 CentOS 6.5, OpenSSL 1.0.1e-15 Fedora 18, OpenSSL 1.0.1e-4 OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012) FreeBSD 10.0 - OpenSSL 1.0.1e 11 Feb 2013 NetBSD 5.0.2 (OpenSSL 1.0.1e) OpenSUSE 12.2 (OpenSSL 1.0.1c) Operating system distribution with versions that are not vulnerable: Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14 SUSE Linux Enterprise Server FreeBSD 8.4 - OpenSSL 0.9.8y 5 Feb 2013 FreeBSD 9.2 - OpenSSL 0.9.8y 5 Feb 2013 FreeBSD Ports - OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

2 1

any action required for AWS cloud relays?
by lee colleton 09 Apr '14

09 Apr '14

I have relay(s) running in AWS. Will they auto-update? Do I need to take any action?

3 3

Clarification regardind business as usual
by Sebastian Urbach 09 Apr '14

09 Apr '14

Hi, I want to clarify my mail from earlier today regarding the recovery of the network / relays. I wrote that i expect business as usual within 2-3 days for the vast majority of the relays. That does not mean that everything is the way it was before. When the content of the /keys directory is gone you have basically a new relay and therefore the process of getting flags starts from scratch. Roger posted an excellent article regarding the life cycle of relays: https://blog.torproject.org/blog/lifecycle-of-a-new-relay -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

1 0

TTTT
by Sebastian Urbach 09 Apr '14

09 Apr '14

Dear list members, There are also some good News in this in this sad OpenSSL days. The TTTT data collection server is back as well as the Scoreboard. Everybody who has some stored data (or new Volunteers), feel free to remove the parking brakes and start submitting ;-) New Scoreboard URL though: http://hatswitch.ece.illinois.edu/tor-traceroutes/relay_scoreboard.html Project: http://web.engr.illinois.edu/~das17/tor-traceroute_v1.html -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ---------------------------------------------- Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. ---------------------------------------------- Benjamin Franklin (1706 - 1790), Inventor, journalist, printer, diplomat and statesman

1 0

Re: [tor-relays] Heartbleed" Exchange of keys now or later?
by tor＠t-3.net 09 Apr '14

09 Apr '14

After updating the OpenSSL, I chopped our relay's keys at noon EST yesterday. The traffic has indeed collapsed since then. Old configuration was averaging around 55Mb/s per my Cacti. A URL here: https://atlas.torproject.org/#details/566B0F92197A9D855846E68D2AEEF8266B147… This morning my Cacti graphs say it is still sitting at near nothing, like 1.5Mb. "arm" says between 500-600Kb/s. The new URL is here and at least at this time, you can really see the dropoff in the 3-day graph. https://atlas.torproject.org/#details/30C19B81981F450C402306E2E7CFB6C3F79CB… I wonder how long it will take our relays to recover? I wonder if it is a good idea, or technically feasible, to do a one time kick-over of something in the Tor network so that the system sees what the relay flags etc. should be on these emergency-redefined relays. Certainly if everyone updated at once and the traffic died like this everywhere, Tor would be pretty messed.

3 2