[tor-project] Many obfs4 bridges with similar nicknames and characteristics
David Fifield
david at bamsoftware.com
Tue Nov 29 03:23:16 UTC 2016
There are many bridges in Onionoo that seem to follow a common naming
convention: two dictionary words concatentated, then truncated to 16
characters. That, plus the fact that many of them run on the same
platform, run only the obfs4 transport, and have related last_restarted
times, makes me think they are somehow related and perhaps malicious. In
a sample of 200 Onionoo bridges, 19% followed the convention. I noticed
this by accident and I'm not planning to look into it more, so I'm
dropping notes here.
I downloaded https://onionoo.thecthulhu.com/details?type=bridge
("bridges_published":"2016-11-28 21:41:02") and manually looked at the
first 200 entries (of ~2500). I picked out the ones that followed the
naming convention: two dictionary words concatenated and truncated to 16
characters; the 40 matches are appended to this message. Of those, only
2 (mapletalon and coffledtileries) don't match the others with respect
to transports.
The words look like they are randomly chosen from a dictionary and some
of them are esoteric or proper names. For example,
cubicsrepugned = cubics + repugned
instinctivevital = instinctive + vital
stegosaurscontin = stegosaurs + contin(ue?)
famishmentbarrac = famishment + barrac(ks?)
Trobriandersbacc = Trobrianders + bacc(hannal?)
friablerecitativ = friable + recitativ(e?)
Ruidosospostcopu = Ruidosos + postcopu(latory?)
introspectpacifi = introspect + pacifi(c?)
cosponsorsangula = cosponsors + angula(r?)
Here's the list of 40 bridges I selected manually out of the 200. Notice
that 17 of them have a last_restarted time withing 10 minutes of
2016-11-11 00:00:00.
$ ./nodeinfo < suspicious-bridges.json
hashed_fingerprint nickname first_seen last_seen last_restarted platform transports
BD2B73AE5F68276BE4E01534F97A28E992B24894 mapletalon 2015-05-01 22:57:41 2016-11-28 21:41:02 2016-10-18 17:48:08 Tor 0.2.8.9 on Linux obfs3,scramblesuit,obfs4,fte
89BD7F3C63464D389B73914FAA818EBF61EE6B46 coffledtileries 2015-12-30 16:52:56 2016-11-28 21:41:02 2016-11-07 12:20:31 Tor 0.2.8.9 on Linux obfs3
D6EC04069E89F08CAE4CBA0E2BE44FFD282BAB07 Trobriandersbacc 2016-09-04 05:38:16 2016-11-28 21:41:02 2016-11-10 00:05:41 Tor 0.2.8.9 on Linux obfs4
5ECF6C485B3DD05EDB9F95073257B8C33C755EE2 ElchoCanarian 2016-11-09 03:41:02 2016-11-28 21:41:02 2016-11-10 11:07:26 Tor 0.2.8.9 on Linux obfs4
FCA481C317E434590CFA06E77A4AE7F5E2E371A3 sailboaterecthym 2016-09-22 15:38:16 2016-11-28 21:41:02 2016-11-11 00:01:10 Tor 0.2.8.9 on Linux obfs4
8A1D76B37B8BB17C35454454E19C729C1AC47E8A orbitalprogymnas 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:01:15 Tor 0.2.8.9 on Linux obfs4
4B9C80E3798BAB6B21D7256EE47EA20BF8F4576C Davossoutdroppin 2016-10-18 16:41:01 2016-11-28 21:41:02 2016-11-11 00:01:18 Tor 0.2.8.9 on Linux obfs4
EFEB18D156E1E14837E417113B3971C04F4F5FBB Ruidosospostcopu 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:01:21 Tor 0.2.8.9 on Linux obfs4
79C6F406B3D3927ABB881EB54323B29DF400F9E2 hypospadiasesdum 2016-10-03 03:38:17 2016-11-28 21:41:02 2016-11-11 00:02:30 Tor 0.2.8.9 on Linux obfs4
B3B7B975DCD1D7E59D65202DB8E6E2D75655B358 stegosaurscontin 2016-10-23 17:41:01 2016-11-28 21:41:02 2016-11-11 00:02:48 Tor 0.2.8.9 on Linux obfs4
43CBD641F40EE1563BB1AF7736175512A5B559A2 famishmentbarrac 2016-10-22 12:41:01 2016-11-28 21:41:02 2016-11-11 00:03:48 Tor 0.2.8.9 on Linux obfs4
1931388E3C53689BED98E0BEFA7052F07BCC7F70 instinctivevital 2016-10-27 20:41:01 2016-11-28 21:41:02 2016-11-11 00:04:48 Tor 0.2.8.9 on Linux obfs4
914CF5540F8B92672CA6C9AA270DA88928B6CA78 cubicsrepugned 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:02 Tor 0.2.8.9 on Linux obfs4
F791DD628CA38C402E2126DAD106EA19C67252F4 wheelsolla 2016-10-08 10:38:17 2016-11-28 21:41:02 2016-11-11 00:05:04 Tor 0.2.8.9 on Linux obfs4
E5BA71654F739B20AA807362EBA4FE91B57331EC IQsmediator 2016-11-09 18:41:02 2016-11-28 21:41:02 2016-11-11 00:05:16 Tor 0.2.8.9 on Linux obfs4
C8A129620B9ACA9708EBF40F54536A4DB644260F impulsivenesssle 2016-10-17 05:38:17 2016-11-28 21:41:02 2016-11-11 00:05:31 Tor 0.2.8.9 on Linux obfs4
500F068CBA07D0E0CEB0343D1DFF2CB32AD77080 friablerecitativ 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:37 Tor 0.2.8.9 on Linux obfs4
71A74F4F94606B455B3CCE0AE4A21D57D557B489 imaginarysoverco 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:49 Tor 0.2.8.9 on Linux obfs4
E7A4C66517035A309C6D448070B964023D150A5F aidedarticularly 2016-09-06 04:38:16 2016-11-28 21:41:02 2016-11-11 00:06:08 Tor 0.2.8.9 on Linux obfs4
66B41CF3878A37254511C5E3F76F513F74075464 blessedergrisled 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:06:31 Tor 0.2.8.9 on Linux obfs4
C724E07A07E2C820208CD22D19A3B1B1FD40B7F3 whensquincentena 2016-11-03 05:41:02 2016-11-28 21:41:02 2016-11-11 05:02:03 Tor 0.2.8.9 on Linux obfs4
6567256AC5857A83D57F6D3256FBAC5D8030803B pipagelengthwise 2016-09-24 21:38:16 2016-11-28 21:41:02 2016-11-12 05:01:58 Tor 0.2.8.9 on Linux obfs4
3168BC247CA693DF2871AD547F74DD93D9A8CB4E recessionalsFols 2016-11-13 00:41:02 2016-11-28 21:41:02 2016-11-14 00:01:12 Tor 0.2.8.9 on Linux obfs4
A9EE320C9BF3E5505C08CBB26135A9342435414B amasseracrimonio 2016-11-14 23:41:02 2016-11-28 21:41:02 2016-11-16 00:01:13 Tor 0.2.8.9 on Linux obfs4
666AAC1C83DC928E2E72F69A40B3DF31F008FCF0 harmonizeLorinda 2016-11-08 18:41:02 2016-11-28 21:41:02 2016-11-16 18:47:25 Tor 0.2.8.9 on Linux obfs4
5D0BE64E6C00322D31B9CE83E5117F9D8860D291 supernaturesPoto 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-17 00:01:03 Tor 0.2.8.9 on Linux obfs4
C319A27A6B749518F8B5ABA508676E3A0307B5CE pitchwomanPetrar 2016-11-18 16:41:02 2016-11-28 21:41:02 2016-11-18 16:23:52 Tor 0.2.8.9 on Linux obfs4
8F366D5100DC5806D03839434D20EE6508C3C6D5 xenogeniescondon 2016-11-22 01:41:02 2016-11-23 00:41:02 2016-11-22 01:21:38 Tor 0.2.8.9 on Linux obfs4
280608EF66099BC4DFE651E540B34EE2BAD53E0F Hofmannscrimply 2016-11-24 17:41:02 2016-11-25 16:41:02 2016-11-24 17:15:04 Tor 0.2.8.9 on Linux obfs4
75B88A93670C87243BEA433598B582BFA1FA38D5 otitisArchaeorni 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-24 17:59:06 Tor 0.2.8.9 on Linux obfs4
8C585AA14CA728E03892BEC51284DFE39CD52641 streetyNavaratra 2016-10-22 18:41:01 2016-11-28 21:41:02 2016-11-24 23:01:07 Tor 0.2.8.9 on Linux obfs4
8475B61417F33A345F03A8939AAB8D011510A256 biffoximes 2016-11-26 05:41:02 2016-11-28 21:41:02 2016-11-26 05:22:06 Tor 0.2.8.9 on Linux obfs4
B296B50F26467B9BF85553C53AC9C4BA8B7D54E6 ephorscranberry 2016-11-26 15:41:02 2016-11-27 14:41:02 2016-11-26 15:05:01 Tor 0.2.8.9 on Linux obfs3
8292BA88B705EB5BC73EFBC49310FC2C57722AB7 memoirgores 2016-11-26 16:41:02 2016-11-27 22:41:02 2016-11-26 16:20:04 Tor 0.2.8.9 on Linux obfs4
48B85C391D285184D25F7F9C80CD1400BC361F30 cosponsorsangula 2016-11-27 06:41:02 2016-11-28 05:41:02 2016-11-27 06:12:34 Tor 0.2.8.9 on Linux obfs4
AD2FC88D84A85069D850011533A3ACA2F77A622C forequotedferric 2016-11-27 20:41:02 2016-11-28 21:41:02 2016-11-27 20:22:42 Tor 0.2.8.9 on Linux obfs4
3191235187A95599A4831D5B1891713A30B75110 dennetsreeder 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-27 21:08:00 Tor 0.2.8.9 on Linux obfs4
3D6B08D309B3080697B74DEAE724E41FFC89B6BC introspectpacifi 2016-11-28 07:41:02 2016-11-28 21:41:02 2016-11-28 07:11:54 Tor 0.2.8.9 on Linux obfs4
1F4CAB0568389C049623E41FA8ECD546F4821C53 pamphletaryDille 2016-11-25 20:41:02 2016-11-28 21:41:02 2016-11-28 08:01:58 Tor 0.2.8.9 on Linux obfs4
1C3F2CC53203756A12A3E2AFB587CD535920767E schlierenasympto 2016-11-28 10:41:02 2016-11-28 21:41:02 2016-11-28 11:33:41 Tor 0.2.8.9 on Linux obfs4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bridges.json.xz
Type: application/x-xz
Size: 130148 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20161128/ab7e4152/attachment-0001.xz>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: suspicious-bridges.json
Type: application/json
Size: 15862 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-project/attachments/20161128/ab7e4152/attachment-0001.json>
-------------- next part --------------
#!/usr/bin/env python
# Usage:
# wget -O relays.json https://onionoo.torproject.org/details?type=relay
# ./nodeinfo < relays.json
import datetime
import json
import sys
DATEFMT = "%Y-%m-%d %H:%M:%S"
FAMILY_LABELS = {}
def family_label(r):
try:
effective_family = r["effective_family"]
except KeyError:
return None
key = [f[1:] for f in effective_family]
key.append(r["fingerprint"])
key = tuple(sorted(key))
try:
return FAMILY_LABELS[key]
except KeyError:
label = chr(ord("A") + len(FAMILY_LABELS))
FAMILY_LABELS[key] = label
return label
now = datetime.datetime.utcnow()
def output_relay(r):
try:
fingerprint = r["fingerprint"]
except KeyError:
fingerprint = r["hashed_fingerprint"]
print "%s %-17s %s %s %s %-26s %s" % (
fingerprint,
r["nickname"],
r["first_seen"].format(DATEFMT),
r["last_seen"].format(DATEFMT),
r["last_restarted"].format(DATEFMT),
r["platform"],
",".join(r.get("transports", ())),
)
j = json.load(sys.stdin)
for r in j["relays"] + j["bridges"]:
# if r["fingerprint"] in OLD_FINGERPRINTS.intersection(FINGERPRINTS):
# if r["fingerprint"] in FINGERPRINTS:
output_relay(r)
More information about the tor-project
mailing list