[tor-project] Many bridges (22%) have nickname "ki"

[David Fifield]

This is a bit of a followup to my earlier post on obfs4 bridges with
formulaic nicknames:
https://lists.torproject.org/pipermail/tor-project/2016-November/000809.html


Those bridges are still there, but today I noticed a new weirdness: 756
bridges all having the nickname "ki". 756 is 21.8% of the total number,
3464. At the moment, "ki" far outnumbers every other nickname, apart from
"Unnamed":

$ wget -O bridges.json https://onionoo.torproject.org/details?type=bridge
$ ./nodeinfo < bridges.json | awk '{print $2}' | sort | uniq -c | sort -rn | head
   1519 Unnamed
    756 ki
     16 UbuntuCore133
      6 anonymous
      5 hacktheplanet
      4 ididnteditheconfig
      3 default
      3 CoolComputers
      2 UbuntuCore95
      2 masterFluellen

All the "ki" bridges have other things in common: they run no pluggable
transports and they have platform "Tor 0.2.8.10 on Linux". Their
last_restarted time ranges from 2016-12-05 17:51:45 to 2016-12-13
15:34:06.

Here is a sample of 20 of them.

$ ./nodeinfo < bridges.json | awk '$2 == "ki" {print}' | sort -k 7 | head -n 20

hashed_fingerprint                        nickname           first_seen           last_seen            last_restarted       platform              transports
F69BE147A7CB0A1EDAE8A5E9EFF70E672CF117DF  ki                 1970-01-01 00:00:00  2016-12-06 17:41:03  2016-12-05 17:51:45  Tor 0.2.8.10 on Linux
FA0F7052B6BB5572960BB08BD44C58A143F9B227  ki                 1970-01-01 00:00:00  2016-12-06 17:41:03  2016-12-05 18:07:00  Tor 0.2.8.10 on Linux
1431FFE68CFC0383456619D87431AF23FFA2E183  ki                 2016-12-05 18:41:03  2016-12-06 17:41:03  2016-12-05 18:21:30  Tor 0.2.8.10 on Linux
945B0892CADA14722EA3D28354995D5907CFB3AB  ki                 2016-12-05 18:41:03  2016-12-06 17:41:03  2016-12-05 18:34:04  Tor 0.2.8.10 on Linux
DDB025FD0BC51FE5391D8A4F80E773334D2E523C  ki                 1970-01-01 00:00:00  2016-12-06 18:41:03  2016-12-05 18:52:16  Tor 0.2.8.10 on Linux
DB4245D09CC3C705CAD292C398DDA1ABFB40DB52  ki                 1970-01-01 00:00:00  2016-12-06 18:41:03  2016-12-05 19:07:01  Tor 0.2.8.10 on Linux
772D118449E0F938657BBD5F472088270D742F39  ki                 2016-12-05 19:41:03  2016-12-06 18:41:03  2016-12-05 19:21:27  Tor 0.2.8.10 on Linux
F8DE4C2595715190D69732FBB47EAA17255FCF3A  ki                 2016-12-05 19:41:03  2016-12-06 18:41:03  2016-12-05 19:34:00  Tor 0.2.8.10 on Linux
CA7ACBB15A80381BB216939AA3D6345D4E2A6CE5  ki                 1970-01-01 00:00:00  2016-12-06 19:41:03  2016-12-05 19:51:51  Tor 0.2.8.10 on Linux
60AE31B0D81ABE763264D442E0A8A48161ADCBD6  ki                 1970-01-01 00:00:00  2016-12-06 19:41:03  2016-12-05 20:07:42  Tor 0.2.8.10 on Linux
0522394400AA8425445742828C577A560159AAC3  ki                 2016-12-05 20:41:03  2016-12-06 19:41:03  2016-12-05 20:21:31  Tor 0.2.8.10 on Linux
8A9BFB4DABD6D4F0AD692C414FB3E75DC33ED47E  ki                 2016-12-05 20:41:03  2016-12-06 19:41:03  2016-12-05 20:34:01  Tor 0.2.8.10 on Linux
F9AE2B2E26EACE32A6BA697118F73AC20DAA0A01  ki                 1970-01-01 00:00:00  2016-12-06 20:41:03  2016-12-05 20:52:33  Tor 0.2.8.10 on Linux
DAFFEED5B1268C8B7BEEA3AD411690E7C74024EB  ki                 1970-01-01 00:00:00  2016-12-06 20:41:03  2016-12-05 21:06:31  Tor 0.2.8.10 on Linux
7690F311EE18901A2C2B0353DF868C31C43746C7  ki                 2016-12-05 21:41:03  2016-12-06 20:41:03  2016-12-05 21:21:29  Tor 0.2.8.10 on Linux
C51B3FA6A60D116C84C867F2DC2AE0BE33CB117F  ki                 2016-12-05 21:41:03  2016-12-06 20:41:03  2016-12-05 21:34:00  Tor 0.2.8.10 on Linux
8F6C3F388EDD6D9400B5743AE29DE3AAB88E43E9  ki                 1970-01-01 00:00:00  2016-12-06 21:41:03  2016-12-05 21:51:56  Tor 0.2.8.10 on Linux
0547724D0F88377D5A0F01D90B8BF523B869326A  ki                 1970-01-01 00:00:00  2016-12-06 21:41:03  2016-12-05 22:07:16  Tor 0.2.8.10 on Linux
EE969338212C905E0425394B658FEDE1CF3BDE4E  ki                 2016-12-05 22:41:03  2016-12-06 21:41:03  2016-12-05 22:21:28  Tor 0.2.8.10 on Linux
EFCD5C5E5A608DC017980A4F67CCDB51BBA50FD4  ki                 2016-12-05 22:41:03  2016-12-06 21:41:03  2016-12-05 22:34:15  Tor 0.2.8.10 on Linux
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bridges.json.xz
Type: application/x-xz
Size: 169952 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20161213/c3bfde0a/attachment-0001.xz>
-------------- next part --------------
#!/usr/bin/env python

# Usage:
# wget -O bridges.json https://onionoo.torproject.org/details?type=relay
# ./nodeinfo < bridges.json

import datetime
import json
import sys

DATEFMT = "%Y-%m-%d %H:%M:%S"

def output_relay(r):
    try:
        fingerprint = r["fingerprint"]
    except KeyError:
        fingerprint = r["hashed_fingerprint"]
    print "%s  %-17s  %s  %s  %s  %-26s  %s" % (
        fingerprint,
        r["nickname"],
        r["first_seen"].format(DATEFMT),
        r["last_seen"].format(DATEFMT),
        r["last_restarted"].format(DATEFMT),
        r["platform"],
        ",".join(r.get("transports", ())),
    )

j = json.load(sys.stdin)
for r in j["relays"] + j["bridges"]:
    output_relay(r)