Dear Roger,

Thanks for quick reply. This possibility did occur to me. When I asked my VPS provider about getting more information for further diagnosis told me they didn’t have more, but that the party that sent them the notification had been reliable in the past. My provider has been relatively friendly during this process, and I didn’t want to push them further.

Overall, let’s just hope that I’ve been an atypical case in getting two complaints in my first week of operating an exit node.

Thanks, Kees

On 19 Oct 2014, at 13:31, Roger Dingledine arma@mit.edu wrote:

On Sun, Oct 19, 2014 at 01:24:31PM +0200, Kees Goossens wrote:

...

However, the only thing I do with my VPS is run tor. I don???t run a web site, and don???t have apache or whatever installed. I didn???t investigate much further, but my hypothesis is that when publishing the tor-exit notice on port 80 either tor internally uses a web server or enables a web server that???s present in the system. Either way, that webserver was hacked through a PHP hack.

It is much more likely that this was a false positive. That is, whoever sent you the mail was using a wrong-in-your-case mechanism for detecting whether you're infected with "stealrat". They probably just make a list of all the computers that connect to them and send certain traffic. And if your computer connected to them and sent that traffic, onto their list you go.

The Internet is full of people telling other people that they're infected and ought to clean up their computer. Sometimes they're right, sometimes they're wrong. Usually, when it comes to Tor relays they're wrong, because it never occurred to them that you might be proxying the traffic from somebody else.

Hope that helps, --Roger

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

++ 19/10/14 13:53 +0200 - Tom van der Woerdt:

Sounds familiar. This same company (valuehost.ru?) sends me about 20 abuse reports a day. At first I replied with explanations of what Tor is, explaining why it's hard to do anything against this kind of abuse. Later I

[...]

IANAL but you can probably just ignore those.

I have had exactly the same experience with valuehost.ru. At this moment I'm ignoring any automated notification I receive from them.

Manuel Gebauer schreef op 19/10/14 15:29:

Hi, Tom and Rejo. Same with me. Half of the abuse complaints I get are from Valuehost Ru. Because I run on a cheap VPS I don't get a reassigned IP. Therefore I always fear that my provider might lose patience and shut down my server. That's why I decided to block Valuehost's range 217.112.34.0/24 completely.

I also wrote to Valuehost Ru and asked them politely to consider that their own customers might like to use tor and to reconsider their policy for abuse complaints. No answer yet. I think they have an automated abuse complaint system and don't care much for replies.

Cheers,

M.

So I tried getting in contact with them again in an attempt to reduce the amount of abuse mails they send us. This time they replied :

-------------------------

Hello,

We make abuse notices not only for TOR exit node operators, we make it to their uplinks too. If we will stop to do it, it will lead for:

- TOR exit node operators will cease to think to solve this serious problem (with all due respect to noble purposes of TOR, like censorship resistance for Chinese dissidents etc., we see that a large part of of TOR traffic is malicious)

- TOR exit node uplinks will not notified about malicious activity in their networks

Also, if we'll except over 1000 IP's of Tor exit nodes from the security system, it will be spent too many resources. So we suggest to ignore abuse messages if you don't care about the safety of Internet.

-------------------------

Tom

On Freitag, 24. Oktober 2014, 09:16:49 Tom van der Woerdt wrote:

Manuel Gebauer schreef op 19/10/14 15:29:

...

Hi, Tom and Rejo. Same with me. Half of the abuse complaints I get are from Valuehost Ru. Because I run on a cheap VPS I don't get a reassigned IP. Therefore I always fear that my provider might lose patience and shut down my server. That's why I decided to block Valuehost's range 217.112.34.0/24 completely.

I also wrote to Valuehost Ru and asked them politely to consider that their own customers might like to use tor and to reconsider their policy for abuse complaints. No answer yet. I think they have an automated abuse complaint system and don't care much for replies.

Cheers,

M.

So I tried getting in contact with them again in an attempt to reduce the amount of abuse mails they send us. This time they replied :

---

Hello,

We make abuse notices not only for TOR exit node operators, we make it to their uplinks too. If we will stop to do it, it will lead for:

• TOR exit node operators will cease to think to solve this serious

problem (with all due respect to noble purposes of TOR, like censorship resistance for Chinese dissidents etc., we see that a large part of of TOR traffic is malicious)

• TOR exit node uplinks will not notified about malicious activity in

their networks

Also, if we'll except over 1000 IP's of Tor exit nodes from the security system, it will be spent too many resources. So we suggest to ignore abuse messages if you don't care about the safety of Internet.

---

Tom

Sounds quite "nice" to me :)

++ 19/10/14 13:48 +0000 - obx:

Same here, I've blacklisted their /24 in my torrc. The complaints stopped.

That is not a sound approach: i) Tor clients will see unexpected connection errors as some destinations are unreachable where they should and ii) in some legal systems this may mean you can be held responsible for the traffic that is routed via your node.

++ 19/10/14 08:56 -0500 - Drake Wilson:

In torrc? Really? Surely not, given that the policy is published in the exit descriptor. (I can't speak to the legalities of (ii).)

Ah, yes. I was confused with denying access to IP-space using a firewall. That is not published in the exit descriptor.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

...

That is not a sound approach:

I think it is.

...

ii) in some legal systems this may mean you can be held responsible for the traffic that is routed via your node.

Example? In Germany you might (or might not) be responsible for traffic you relay. But not relaying part of the traffic doesn't change a thing, legally.

i remember reading somewhere [1] that if you run a server that carries mail and you don't choose where it goes or who it comes from, the server is protected from some DMCA complaints by the DMCA "safe harbor" terms (us code title 17 Chapter 5 § 512).

this might only apply in the US and it may not be entirely correct, but it does lay out that if you censor where the traffic goes to or comes from, you surrender some rights.

mikael ball

Thomas,

That sounded so reasonable and persuasive that would it be a good idea to have a formal opinion written to give to server companies early on?

They might still be looking at the time it takes to deal with notices or police queries but they must accept that the risks of allowing Tor are miniscule. Perhaps the way around the remaining deterrence is a Tor response 'centre' for them to painlessly redirect irritations to.

Robert

Yes there are safe harbour provisions.

Thomas,

Excellent fellow!

I agree that a little more appearance of coherence would do well for us but one great strength of such ideas as Tor is the absence of formal structure and that should be retained. The idea is available to be put into practice by anyone by themselves without permission. I was thinking of a point of contact for help and information only. The qualified statement of Tor operators's legal position should stand on its own.

Robert

-----Original Message----- From: thomaswhite@riseup.net Sent: Mon, 20 Oct 2014 00:19:40 +0100 To: tor-relays@lists.torproject.org Subject: Re: [tor-relays] exit node experience: abuse over HTTP, stealrat infection

Already working on it (see https://trac.torproject.org/projects/tor/ticket/13421)

Will involve a lot of outreach and will need to consider lots of jurisdictions but it can be done with a few volunteers over the next few weeks I feel. I may also be proposing on trac a @torproject.org email for such things so if ISPs did want to do a little fact checking they can have an easy point of contact and also allows a central place to reach out to the ISPs.

I feel a central email for such things would garner more respect than the fracture groups assigned using their own personal emails.

-T

On 19/10/2014 23:21, I wrote:

...

Thomas,

That sounded so reasonable and persuasive that would it be a good idea to have a formal opinion written to give to server companies early on?

They might still be looking at the time it takes to deal with notices or police queries but they must accept that the risks of allowing Tor are miniscule. Perhaps the way around the remaining deterrence is a Tor response 'centre' for them to painlessly redirect irritations to.

Robert

...

Yes there are safe harbour provisions.

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

++ 19/10/14 16:13 +0200 - Manuel Gebauer:

...

ii) in some legal systems this may mean you can be held responsible for the traffic that is routed via your node.

Example? In Germany you might (or might not) be responsible for traffic you relay. But not relaying part of the traffic doesn't change a thing, legally.

First: I was discussing a situation where the policy doesn't get published in the descriptor. For example, one is iptables to deny access to some IP-space. This is of course different from configuring this rejection policy in the Tor configuration file.

As for the responsinilty: I was referring to the e-Commerce directive in the EU. Article 12 says:

"Where an [...] service is provided that consists of the transmission in a communication network of information [...], Member States shall ensure that the service provider is not liable for the information transmitted, on condition that the provider [...] does not select or modify the information contained in the transmission."

I would says that if an operator rejects traffic using iptables, he does do selection of information contained in the transmission. Of course, this is different when configuring the rejection in the Tor configuration that gets published.

As far as I know, there is no case law, so results may differ.

++ 21/10/14 01:58 +0200 - Manuel Gebauer:

I learned that the qualification "not select or modify" acually IS present in German law. § 8 TMG says, that the service provider is not responsible in so far as he did not "chose or modify" the transmitted information.

As the e-Commerce directive is a directive (duh!) and not a regulation, this European rules need to be transposed to national laws in each every member state. The Dutch also have their own version.

Although, the greater risk in my opinion, comes from the question if tor operators can be seen as service providers who would be exempt from responsibility for transmitted information under the term of this law. There's no precedence to my knowledge, but

[...]

That's right. Like I said: there is no case law, but it would be a most interesting case.

...

I learned that the qualification "not select or modify" acually IS present in German law. § 8 TMG says, that the service provider is not responsible in so far as he did not "chose or modify" the transmitted information.

[..]

As far as precedence is concerned, I believe that all the Tor-related raids in Germany (that I became aware of) ended with the state attorney closing the investigation (against the Tor operator) after finally realising that the offending traffic came through Tor.

[..]

Is the TMG law even used/relevant in Tor cases here in Germany? I don't have quotes or sources but if I remember correctly this specific law was never part of the closure.

Renke

On 10/21/2014 10:29 PM, Manuel Gebauer wrote:

...

...

Although, the greater risk in my opinion, comes from the question if tor operators can be seen as service providers who would be exempt from responsibility for transmitted information under the term of this law. There's no precedence to my knowledge, but private wireless APs are in fact not exempt from responsibility.

Citation needed.

"Für ein schlecht gesichertes WLAN besteht Störerhaftung." BGH, Urteil v. 12.05.2010, Az. I ZR 121/08, Link: http://tlmd.in/u/1057

Don't confuse Internet ACCESS Providers and Internet Service Providers. Legally, they're looked at quite different. And a "wifi with bad security" does not even mean you can't offer a completely open wifi. Any layman with a bit of sense could have known that to argue that the wifi was misconfigured "by mistake" is a bad excuse.

To come back to the topic, I believe it is perfectly fine to announce _in advance_ that your relay does not want to see/relay particular traffic. Then, it is not a question of interfering with traffic, since you don't see that kind of traffic at all. It's different if you stop dropping packets on purpose.

On 10/19/2014 03:48 PM, obx wrote:

Same here, I've blacklisted their /24 in my torrc. The complaints stopped.

Did the same after I got those complaints.

B/c my provider do open for every complaint a ticket I do not have another chance than doing this: reject 217.112.0.0/16:*