Corl3ss:
Hello,
This summer Nusenu shared his posts about malicious relays [1][2] and it was followed by many answers.
A very important is Roger's one [3] explaining that the malicious relays have been kicked out of the network and that any new one should be reported.
I was wondering if, with some distance with this summer situation / discussion :
- new malicious relays have been reported in any way ?
Yes, there have been more malicious relays reported. Some of them doing attacks like Roger mentioned. We kicked out all of those. There were other reports about relays that seem to belong to the group(s) we kicked out earlier this year.[1] Some of those relay groups have been kicked out, too.
- vigilance / watchfulness is still needed ? if yes :
- is there specific cases to share (e.g. nodes that block HTTPS on a site or redirect to HTTP ?)
- any concern to have on other protocols that use SSL (imaps, smtps, ssh) ?
Yes, there is still vigilance needed. While we have some scanners and some manual work is done, that's not enough, in particular against more sophisticated attackers.
- is there / will there be things implemented as a conclusion of the "call for support for proposal to limit large scale attacks" ?
We have some ideas on how to move forward which have different trade-offs and we realized that a lot of them touch the question of what we want the Tor network to be in the future. I had hoped that I would have sent an email about that by now to this list asking the community about input and possible options but alas it's still sitting unfinished in my drafts folder. :(
- has it been possible to prepare / set up precautions to avoid this king of situation or it is a too long shot for such a problem ?
We don't have good ways to fix this problem in the short term. So, until we make progress on any of our longer term plans we somehow need to keep up with the whack-a-mole game we have been playing for quite some time now.
These questions come with a lot of respect for the project, its teams and the work done. No critics, it is just made to update the knowloedge on the subject as these questions came back with other friends and relay operators.
No worries, I am happy to take criticism of the status quo and our future plans. :)
And perhaps a last one, perhaps specific for Nusenu : how do you define a malicious relay ? Sorry but I did not get that precisely, moreover in big group analysis.
That's a good question. I am not Nusenu and will thus defer the answer to them. But it's a good question to think about regardless as finding a good answer to it is part of the problem of removing bad relays. Kicking out relays that got caught while doing e.g. SSL stripping attacks is easy but what about a group of relays with similar (and what is "similar"?) configuration showing up like on the next day or days thereafter? Is that the some entity just joining the network again to be able to launch new attacks at *some* point? Or is it some new contributor that likes to help the network growing/diversifying? And what about all those relays without a valid ContactInfo? Are those anonymous contributors that want to help the Tor network or sneaky attackers? Etc.
This touches the question of what we want the Tor network to be (and how we would manage trust relationships in it), too...
All answers will be read with care and gratitude !
Thanks and thanks for your questions, Georg
[1] https://blog.torproject.org/bad-exit-relays-may-june-2020