These nodes are popping up everywhere - is this some sort of malware being deployed on systems around the globe?
Paul
These nodes are popping up everywhere - is this some sort of malware being deployed on systems around the globe?
Interesting. It does look like malware to me.
- all running Tor 0.3.1.7 on Linux - diverse AS / IP allocation, mostly looks like ISP end-subscriber - same exit policy (reject *:*)
On Mon, Oct 30, 2017 at 03:23:07AM +0000, Paul Templeton wrote:
These nodes are popping up everywhere - is this some sort of malware being deployed on systems around the globe?
It is an Ubuntu snap package. See this thread: https://lists.torproject.org/pipermail/tor-relays/2016-August/010046.html
--Roger
Paul Templeton:
These nodes are popping up everywhere - is this some sort of malware being deployed on systems around the globe?
I wrote about them in April 2017: https://medium.com/@nusenu/is-this-a-ubuntu-based-botnet-deploying-tor-relay...
I assume they are not setup by humans.
Since back then the overall CW fraction of these relays increased about x4 (currently 92 concurrently running relays).
That is about position #69 on the list of biggest operators by CW fraction https://nusenu.github.io/OrNetStats/maincwfamilies
I am probably responsible for the existence of these UbuntuCore relays. I package something with this name, but I do not have a lot of insight into its users, who are anonymous.
I do have package download statistics, so I can tell you that on a new release, there are about 1700 downloads of those packages, with about 50 downloads each day normally. (They should start automatically and be updated automatically.)
I'll push out v 0.3.1.8-1 today or tomorrow, so you should see the nickname increment a bit (+4 or so).
-chad
On Mon, Oct 30, 2017 at 1:09 AM, nusenu nusenu-lists@riseup.net wrote:
Paul Templeton:
These nodes are popping up everywhere - is this some sort of malware
being deployed on systems around the globe?
I wrote about them in April 2017: https://medium.com/@nusenu/is-this-a-ubuntu-based-botnet- deploying-tor-relays-and-bridges-b4ce1a612039
I assume they are not setup by humans.
Since back then the overall CW fraction of these relays increased about x4 (currently 92 concurrently running relays).
That is about position #69 on the list of biggest operators by CW fraction https://nusenu.github.io/OrNetStats/maincwfamilies
-- https://mastodon.social/@nusenu twitter: @nusenu_
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
tor-relays@lists.torproject.org
-
Chad MILLER -
nusenu -
Paul Templeton -
Roger Dingledine -
tor