- tor-relays - lists.torproject.org

DDOS?
by mick 31 Dec '12

31 Dec '12

Hi guys The provider for one of my VPSs, running my tor node tor.baldric.net has shut it down (unilaterally and without telling me) a couple of times this month, most recently today. Their response to my query as to why is that they say they are seeing a large DDOS attack on the VPS server hosting my node, apparently aimed at my address. I shut tor down while I investigated and when running nethogs I noticed a shed load of attempted connections to my tor port (443) from non-tor addresses. A snapshot is at http://rlogin.net/tor/incoming.png Anyone else seeing anything similar? I can't believe I'm the only node being poked. Cheers Mick --------------------------------------------------------------------- blog: baldric.net gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 ---------------------------------------------------------------------

6 10

Complaint about spam originating from my server
by Brock Tice 14 Dec '12

14 Dec '12

Hello all, I follow the guide for avoiding abuse notices, and generally I only get 1/year of the DMCA variety. However, I recently received this complaint, which appears to show spam originating from my Tor server (209.188.113.101 / tor-proxy.anfani.com) As far as I know, port 25 is blocked on my exit policy. Port 587 is allowed. I do have a mail server running on this machine, but it does not accept outside connections. Is there something I am missing? Is there anything else I should do to prevent this in the future? Could there be some way that a Tor user could locally send mail using my server? Thanks, --Brock -------- Original Message -------- Subject: RES: Fwd: Olá Date: Thu, 13 Dec 2012 14:41:22 +0000 (UTC) From: abuse(a)terra.com.br To: Luis Barzon <barzon(a)terra.com.br> CC: network-abuse(a)cc.yahoo-inc.com, brock(a)anfani.com Prezado Usuário, O Departamento de Abuse do Terra trabalha seriamente para proteger seus assinantes contra abusos cometidos por terceiros. Nosso objetivo é proporcionar segurança aos nossos Clientes, evitando e impedindo o mau uso da Internet, através dos servidores Terra. Em relação a sua reclamação, informamos que após análise, identificamos que o responsável não pertence ao Terra.Nesses casos identificamos o administrador e encaminhamos a incidência para a devida tratativa. Salientamos que as devidas ações corretivas passam a ser de responsabilidade do administrador da rede identificada. Para o seu conhecimento, o endereço de contato que encaminhamos a incidência é: network-abuse(a)cc.yahoo-inc.com <mailto:network-abuse@cc.yahoo-inc.com>, brock(a)anfani.com <mailto:brock@anfani.com> Atenciosamente, Rafael Doyle Equipe de Segurança Terra - Depto. de Abuse abuse(a)terra.com.br <mailto:abuse@terra.com.br> SAN - Servico de Atendimento Nacional Fax: (51) 3287-9087 ------------ Mensagem Original ------------ *De:* Luis Barzon [barzon@terra.com.br];abuse@terra.com.br *Enviada em:* 11/12/2012 15:15:49 *Para:* abuse(a)terra.com.br *Assunto:* Fwd: Olá =?iso-8859-1?Q? Return-Path:_<web02689(a)att.net> received:_from_[10.235.200.103]_by_preston.tpn.terra.com_(LMTP);_Tue,_11_Dec_2012_12:26:19_+0000_(UTC) received:_from_if00-mail-sr03-mia.mta.terra.com_(if00-mail-sr03-mia.mta.terra.com_[208.84.243.10])_by_1n7.tpn.terra.com_(Postfix)_with_ESMTP_id_C790122CC_for_<barzon(a)terra.com.br>;_Tue,_11_Dec_2012_12:26:18_+0000_(UTC) received:_from_ochaua.tpn.terra.com_(unknown_[10.235.200.126])_by_mail-sr03-mia.tpn.terra.com_(Postfix)_with_ESMTP_id_190696002271_for_<barzon(a)terra.com.br>;_Tue,_11_Dec_2012_12:26:16_+0000_(UTC) received:_by_ochaua.tpn.terra.com_(Postfix,_from_userid_520)_id_17A1D229EFAAC;_Tue,_11_Dec_2012_12:26:16_+0000_(UTC) received:_from_[10.235.200.97]_by_ochaua.tpn.terra.com_(LMTP);_Tue,_11_Dec_2012_12:26:15_+0000_(UTC) received:_from_nm17-vm0.bullet.mail.gq1.yahoo.com_(nm17-vm0.bullet.mail.gq1.yahoo.com_[98.137.177.224])_by_1j4.tpn.terra.com_(Postfix)_with_ESMTP_id_5A96DC0000DFA_for_<waleria.luis(a)itelefonica.com.br>;_Tue,_11_Dec_2012_12:25:02_+0000_(UTC) received:_from_[98.137.12.55]_by_nm17.bullet.mail.gq1.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_from_[98.139.44.79]_by_tm15.bullet.mail.gq1.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_from_[127.0.0.1]_by_omp1016.access.mail.sp2.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_(qmail_60874_invoked_by_uid_60001);_11_Dec_2012_11:54:56_-0000 received:_from_[209.188.113.101]_by_web184904.mail.gq1.yahoo.com_via_HTTP;_Tue,_11_Dec_2012_03:54:56_PST X-Terra-Karma:_0% X-Terra-Hash:_5d0acc65d08e1a21e9e416133fc07644 X-Terra-Delivered-To:_6972688#perm!vivodiscbrlm X-Yahoo-Newman-Property:_ymail-3 X-Yahoo-Newman-Id:_716919.82230.bm@omp1016.access.mail.sp2.yahoo.com Dkim-Signature:_v=1;_a=rsa-sha256;_c=relaxed/relaxed;_d=att.net;_s=s1024;_t=1355226896;_bh=7Ocy5nwKIISVUmGV43vB0i1iNVN39I1mHkdz3VPVAFE=;_h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;_b=0eDgFzVzb+Is8oPpjwC7X7ykXEwP1vqK/KsMDuq6G031UGtMUoUEWjrbWvkP/tKStZS97RKSOYJIE1qQgMEGI20mvh9kdbTAlmoPjGwqaBIEYLmL9f7/Q1XCDiJm5cfPhFd/h5gn0ZUnCySIrkWtz2lBu8MGN1PMKASROPpG+40= Domainkey-Signature:_a=rsa-sha1;_q=dns;_c=nofws;__s=s1024;_d=att.net;__h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;__b=k3zX4zTRmj4a+jDcq+hmrP16lkRdtgX/yE2X3sueOVGLvbhnzLcVv/BL36y5nKhGPVCRhAqLpgCTJcxtYlcPXwqGSioqqso+tTm2D3Erses151z2aE3O0Zh6h9rVPUC4dqpOa5hObz9Xk8JqvvhsL6iUEQ845+OhFclyx3dSvSE=; X-Ymail-Osg:_bt8QfNYVM1k4GHRsx7y5pfUGNSY6POK5unpLV_C31c4vkp__wiUd09OX7vaDxaaiyySoyCgUEVGfXdTTl80vwJw6IPtOfHpuS0EG_l86Hxyx_vym.CY7gciAimFEEoWBpvWo7QWAwqsVQPv7soRtipZBxkFXCCX2PtUGsQrkI_XAOwfJggidaSr3gtWqG3UTWBq2ncBnZOKX2UrowDDWI_fxuExXmq34owVBCQ_iAnR3RdyhAULqzrDic5WJdJtZFxmDUM9x957AYKvCX7XZZU99Zo5w0w.QdCL_H.XFp1W_mqhW07Y_zSDOZovHJZoWZliXJFc3LZPbeRWhRjCPlm3UrJYKyY3m_s0LvztqJP_kN.xenaemuhGfD0tZLKwGJXKRWDTc7CkJ6MOscOeS.ByYdUxJG_LI4aoTrmi2UJfQ.bcOzn7eU5h3bzIx9qUJ5adHil_8M3SI5wE8LpDdkSZPJQ_7z7D_yRyQap1qel8fK_4sKScaeTDKEsSH31ZEBWQYwcmzZMvMOvxVETA.2RX_5fbK8QLeCADZ5cLQxBHhObi1.IYT0FMM37nUNfrZg1V2Tt0lWUn3kh8pP7jh_QCmg1y7vH0WwDGdDeKWhI07pf8z8e1NlEJ9Z1jTnISKVuHodZa5cpGOPssPG_7QePJvqaBTDLrc3uewNOvnj_e53jnQPEKCexdGBa5K.hMwmCJ79Otno5GXtp_Faro- X-Rocket-Mimeinfo:_001.001,DQoNCk9sw6ENCgpCb20gdGUgY29uaGVjZXIsIEV1IHNvdSBNaXNzIEZsb3VyZW5jZSwgZXUgZ29zdGFyaWEgZGUgdMOqLWxvIGNvbW8gbWV1IGFtaWdvLCBwb3IgZmF2b3IsIHZvY8OqIHBvZGVyaWEgdm9sdGFyIHBhcmEgbWltIHBhcmEgbWFpcyBkZXRhbGhlcyBkbyBtZXUgZXUsIGUgdG9kb3MgdGFsdmV6IG5lY2Vzc8OhcmlvIGVtIHJlbGHDp8OjbyBpbmNsdXNpdmUgYSBtaW5oYSBpbWFnZW0sIHNlIGVzdGUgaW50ZXJlc3NlIHF1ZSB2b2PDqiB2b2x0YXIgcGFyYSBtaW0gLiBzZXUgRmxvdXJlbmNlLg0KCi4BMAEBAQE- X-Mailer:_YahooMailClassic/15.1.1_YahooMailWebService/0.8.128.478 Message-Id:_<1355226896.58713.YahooMailClassic(a)web184904.mail.gq1.yahoo.com> Date:_Tue,_11_Dec_2012_03:54:56_-0800_(PST) From:_Fl_Dosi_<web02689(a)att.net> Reply-To:_flourencedosi@yahoo.co.uk Subject:_?= Olá To:_undisclosed_recipients:_; X-Clx-Rate-Response:_fh=1j4;_fi=10.235.200.250:2001;_rg=B;_GT=-934589197;_fs=45;_ns=164;_id=BFBwyXX6-BB122532k;_rv=7182/208.84.242.250:14051;_ts=H/Mq6;_gv=-25;_fp=IC46g;_gd=1;_fl=IAA;_ip=98.137.177.224;_he=NiDDbon0Jbq;_ht=1;_nt=0;_ho=Drk85SdDLJY;_hd=EmCVu0/pq3k;_hf=KuHCD1QD89G;_hF=EeGv2Nz5zhR;_hj=GOnAt8y/c4h;_hr=EiVSUfo4L9J;_ZM=KIpT9Tbxt6G;_ZB=GSe9x8zMeYG;_ZB=IKbBeAtS5zj;_ZB=Ei/hJgabWx3;_ZB=GJeEnTMQT26;_ZB=Mru7Qx7UNOT;_ZF=C5pWnNZauWE;_Zi=GVxvNHWVzGA; X-Clx-Id:_a113GLF9X16I0VH-BB122538 X-Abaca-Is-Spam:_false X-Abaca-Spam:_45 X-Terra-Client-Ip:_98.137.177.224 X-Milter-Version:_master.39-g1fd3ecd+ Content-Type:_multipart/alternative;_boundary="514226816-1910405447-1355226896=:58713" X-Terra-Spam:_No X-Terra-Rec-Key:_YmFyem9uQHRlcnJhLmNvbS5icg== Mime-Version:_1.0 * -----_Original_Message_----- From:_Fl_Dosi_web02689@att.net To:_undisclosed_recipients:_; Cc:_ Sent:_Ter_11/12/12_08:54 Subject:_Fwd:_Olá * Olá Bom_te_conhecer,_Eu_sou_Miss_Flourence,_eu_gostaria_de_tê-lo_como_meu_amigo,_por_favor,_você_poderia_voltar_para_mim_para_mais_detalhes_do_meu_eu,_e_todos_talvez_necessário_em_relação_inclusive_a_minha_imagem,_se_este_interesse_que_você_voltar_para_mim_._seu_Flourence. .................................................................................. Hello Nice_Meeting_You,_i_am_miss_Flourence,_i_wish_to_have_you_as_my_friend,_please_could_you_get_back_to_me_for_more_detail_of_my_self,_and_all_maybe_necessary_in_relationship_including_my_picture,_if_this_interest_you_get_back_to_me.yours_Flourence.

5 4

Hack attempts made to appear as exit node?
by Steve Snyder 06 Dec '12

06 Dec '12

I recent days I have gotten 3 complaints from people who report hack attempts from my exit node, at 82.221.99.229. One problem: this IP address is not in use by me and never has been. The RDNS for this address is "tor-exit.burratino.net" and there is the standard Tor explanatory page on http://82.221.99.229/. The "email the maintainer" is a mailto link to my e-mail address, thus the contacts from people reporting hack attempts. I guess that the page on port 80 was ripped from my actual exit although it is slightly different in that my page has my IP address on it, and http://82.221.99.229/ doesn't reference any particular IP address. Further, I can find no evidence ( https://metrics.torproject.org/exonerator.html ) that this IP address has ever actually run a Tor node. Am I crazy or is someone doing port-scanning and making it appear to be from a Tor exit node?

1 0

Traffic pattern on Tor relay
by tor-admin 05 Dec '12

05 Dec '12

Hi, I am monitoring the network interface of my tor server with nload. From time to time nload shows strange traffic patterns: http://i.imgur.com/0Wr9h.png The graph is updated every second so one hash mark corresponds to one second. The most recent traffic value is on the right side. The graph shows that the traffic oscillates with a period of about 14 seconds and the traffic doubles in the peaks. Does anyone has an explanation of this pattern? Regards, Torland

2 1

Prepared for [Raided for running a Tor exit node]?
by grarpamp 01 Dec '12

01 Dec '12

> Only regarding home Wireless access in the US > I was involved in a case with just this situation. > > According to my lawyer there is no consensus on who is responsible for wifi. > Every State has different laws each one is just a vague. > In NY, if your wireless is secured (pw protected) you are ok. > In NH, you are responsible for all data that passes your wifi point secured > or not. > In MA(my state) there is no specific law Putting links to such laws on the Tor wiki would be useful for operators and users to know. It would seem hard to believe that there are 'must secure' laws [1] in the US or elsewhere. Even harder that anyone would be sentenced... regardless of whether their AP is open, 12345, or dR;$8w@G... merely for traffic traversing their AP/node that was not theirs, or that cannot be proven was theirs. Not that you wouldn't be questioned, charged or held before the case was dropped. [1] There are 'must secure' civil ISP contracts. They are only meant to 'secure' more revenue (no account/line sharing) for the ISP and save revenue from dealing with whatever headaches your open AP/node creates. And criminal 'theft of service' laws for the same reasons. > you just need a good lawyer :) This (and links to the actual laws) are much easier to believe. Because if someone here took the NY example above literally and did illegal deeds via their secured wifi thinking that example was the law (and thus their immunity), they be jailed pretty quickly. And what does being forced to secure or responsible mean? If you hit a bug, exploit, or get cracked, and can show it, you're jailed? What if there is no proof either way but the existence of traffic, is the user then jailed by default? What if no evidence but crypted disk, or questions as to character/belief? In those crazy places even 100% lily white users would seem better off running an open AP/node and risking that lone lesser charge [2] than attempting to be rather secure, risking a crack, and being held responsible for some major crime. [2] If the major wasn't dropped, at least they'd be jailed with evidence the access was open, which looks a lot better than if it wasn't. The crazy is why you're supposed to visit, write, call and email your lawmakers, educate your executive, and hang your jury.

2 2

Suggestions for Tor Relay Operators after a Police interaction
by Andrew Lewman 30 Nov '12

30 Nov '12

# Suggestions for Tor Relay Operators after a Police interaction Disclaimer: We are not lawyers, and this is not legal advice. This is friendly advice from those of us at Tor who work with relay operators after a police visit or raid. This is a collection of suggestions of what we've gathered from five years of helping people like you. Exit relay operator visits are exceedingly rare. You are in the 1% of operators ever visited or even raided by a police force. If you're reading this message, then you probably have a poor photocopy of the warrant the police served to you. The warrant may mention Tor and some suspected criminal activity (such as terrorism, money laundering, child abuse materials, or copyright violations). 1. Read the EFF legal FAQ for relay operators, https://www.torproject.org/eff/tor-legal-faq.html.en. 2. Find legal representation. A list of possible legal advisers can be found here, https://blog.torproject.org/blog/start-tor-legal-support-directory. If none of these people are in your country, or close to you, ask either the EFF or Tor Project. We can likely help you find someone in your jurisdiction. 3. Get a copy of the full warrant. There is a generally a process to get a full copy of the warrant. It will have details you'll need to know to defend yourself. At a minimum, it's likely to have a timestamp and IP address of your exit relay. 4. Make sure the IP address in question is your exit relay and was a valid relay at the time in question. We make available the exonerator tool to look through the entire history of the Tor Network to find your relay, https://metrics.torproject.org/exonerator.html. 5. Get in touch with The Tor Project, preferably by email, see https://www.torproject.org/about/contact for finding ways to reach us. If you need someone official to explain Tor to either a bondsman, judge, or the police, generally phone works best, https://www.torproject.org/about/contact#phone. When you contact Tor, we need the following details in order to help you maintain your innocence: - The IP address of each relay. - The timestamp (date and time of day) for each IP address in the warrant. - How to reach you or your legal adviser. 6. Likely, your legal adviser is going to want a signed, notarized, official letter from the Tor Project stating the IP address was or was not an exit relay at the date and time in question. They are going to want this mailed via trackable method (FedEx, UPS, DHL, registered mail, etc). We need to know if you want one letter per IP/timestamp combination, or if we can put everything into one letter. Best of luck going forward. The police generally only receive an IP address and a street address. They do not know it is a tor exit relay. Some national police forces in Europe and North America are sophisticated enough to determine "tor or not" before they execute a warrant. Generally, but not always, these national police forces send detectives to interview you (known as a "knock and talk"), rather than send in a SWAT team (known as a raid). The press repeats the SWAT team stories because it generates page views for their organization. It's not the norm. Tor is available for further help, whether it be as an expert witness, further explanations of how Tor works, etc. Just ask for help, we're happy to do so. By sharing your experience with us, you also help us to help law enforcement understand Tor better in the future. Thanks for sharing and thanks for running a relay. -- Andrew http://tpo.is/contact pgp 0x6B4D6475

2 1

Prepared for [Raided for running a Tor exit node]?
by grarpamp 30 Nov '12

30 Nov '12

>> Running an exit node from home DSL or Cable is bad idea. One must look >> for a Tor friendly ISP and have balls made of steel! ... ISP[/hoster] and[/or] have ... > However, I do not believe it is that way in > the United States What 'way'? Running an exit node at home, or elsewhere, would seem to come down to... a) Are you physically ready for a query / subpoena / search warrant / exigent raid? Are things segregated by room? Are your doors and machines labeled with the same sort of exit node notice you'd put on the TCP port and in DNS? Have you inventoried, photographed and documented your setup and property? Do you have offsite backups? Are private things encrypted? Are any co-habitants aware and similarly prepared? b) Are you mentally ready? Is your life and butt otherwise clean, legal, and organized? If you were to appear in court, how would you act and be perceived? How do you feel about being in the news and in public docs? Have you networked with other operators and entities? c) Are you legally, financially, and timewise ready? Have you consulted with and preselected a couple attorneys? Have you made arrangements for making bail? How will you make court required appearances? All these sorts of meta things, and surely more, come into play whether or not you're ever raided. I'd suggest making a wiki article for them.

1 0

How to get client locale statistics without arm?
by tor-admin 30 Nov '12

30 Nov '12

Hi, I would like to know from which countries my nodes are mostly used. I tried to use arm for this but on high capacity relays arm eats the same cpu resources as the tor process it monitors, if the connection panel is activated. Switching to the connection panel lets arm often freeze. Is there another way to get country statistics from a node? Maybe something build in Tor? Thanks, Torland

2 3

Bandwidth and server leads [was: Tor raid]
by grarpamp 29 Nov '12

29 Nov '12

> From: elijah wright <elw(a)stderr.org> > Date: Thu, 29 Nov 2012 13:38:51 -0600 > Cc: nanog(a)nanog.org > Subject: Re: William was raided for running a Tor exit node. > We had a guy (aka potential customer) inquire the other day about hosting a > Tor exit on our infrastructure the other day; he disappeared fairly > quickly when he figured out that we weren't just going to give him an > endless supply of unmetered 10G bandwidth. I was looking forward to > billing him. :-) Contemporary mailing list lols aside, I believe you'll find that most operators in this space are quite serious and professional. If you're a potential friend of Tor, anonymity networks and the general thought space around it... and your price [or that of someone you know, nanog or otherwise, who might be such a friend] was highly competitive, or even special... I'd be fairly confident that consultation with those on this list would lead to a sale of said (or related) billable services. Feel free to forward and/or put any interested parties in touch with this list or torproject.org.

1 0

Deploy relays using hidden exit IP's?
by grarpamp 29 Nov '12

29 Nov '12

Shouldn't some exit relays (funded or not) be deployed to use an exit IP that is different from it's advertised exit IP in order to prevent a simplistic form of blocking based on scraping the descriptor set? I think this can happen if the default route is out another interface or secondary address. Something of that nature.

10 14