[tor-relays] Blog: How Malicious Tor Relays are Exploiting Users in 2020 (Part I)

William Kane ttallink at googlemail.com
Thu Aug 20 00:17:03 UTC 2020


Most of the relays from the first group got added at the exact same
time, the second group got added within a few days - tells me someone
looking at the OrNetRadar logs isn't doing his job correctly.

2020-08-19 16:27 GMT, nusenu <nusenu-lists at riseup.net>:
> niftybunny:
>> https://medium.com/@nusenu/how-malicious-tor-relays-are-exploiting-users-in-2020-part-i-1097575c0cac
>>
>>  There are multiple indicators that suggest that the attacker still
>> runs >10% of the Tor network exit capacity (as of 2020–08–08)
>>
>> And on this one: I trust nusenu who told me we still have massiv
>> malicious relays.
>
> as some of you have probably seen already
> now a fraction of them got confirmed to run the same attack tools:
> https://twitter.com/notdan/status/1295813432843829251
>
> Unfortunately this is not the end of it.
>
> Some of them where directly linked in the blog post above.
>
> What I'm still wondering about is: What made Tor directory authorities
> change their policies and stop removing undeclared relay groups?
>
> +---------------------+----------+------------------------------------+-------------------------+------------------------------------------+
> | first_seen          | nickname | contact                            |
> as_name                 | fingerprint                              |
> +---------------------+----------+------------------------------------+-------------------------+------------------------------------------+
> | 2020-06-20 01:00:00 | relay23  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 01C05513D12F63AE9E72588E8EAB459028C44689 |
> | 2020-06-20 01:00:00 | relay05  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 01DAC406BD545B6EB41D3E12476E70EAE4872407 |
> | 2020-06-20 01:00:00 | relay02  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 078A661362B4959F64F8E01DF4646101542E1AD2 |
> | 2020-06-20 01:00:00 | relay17  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 11F76D073C30EE2C8849602B90950659E79EB0B0 |
> | 2020-06-20 01:00:00 | relay21  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 17B63505746D57A2C3F240C63EA0DDE7B7EB73C8 |
> | 2020-06-20 01:00:00 | relay09  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 1970C3CE0F945DA0D16DF5191DC8B0483A421A75 |
> | 2020-06-20 01:00:00 | relay30  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 3D20E55FFEB48BB224A510A3740C3FE56036404B |
> | 2020-06-20 01:00:00 | relay24  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 40D792754B7B891672288E3705B98C612B002531 |
> | 2020-06-20 01:00:00 | relay27  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 4A14A18B4813930E04F49011D56CDA86D0D33E59 |
> | 2020-06-20 01:00:00 | relay32  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 4FF250A3701CD24523D1B0A9C1FA760FFE9BF5E6 |
> | 2020-06-20 01:00:00 | relay13  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 5C34E92C2F19FA99DB9A680D75C0382E2C91DDE9 |
> | 2020-06-20 01:00:00 | relay25  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 5F1381FA3963CAAF712235CA34D6B15FDDF14966 |
> | 2020-06-20 01:00:00 | relay22  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 7A6014B07509E75172FCF036CC4E9870260470FF |
> | 2020-06-20 01:00:00 | relay07  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 8C28E2857B25C9A92309699416D74AE7AA1A2CCC |
> | 2020-06-20 01:00:00 | relay28  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 8DFCD8E4F626AC933A93AC66847F7C5915824171 |
> | 2020-06-20 01:00:00 | relay06  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 97F3FDE85A765E009F8F94F03970234C05F82F3B |
> | 2020-06-20 01:00:00 | relay29  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | 9D63D167286F731895A2DE06C8BF6D2F549033AD |
> | 2020-06-20 01:00:00 | relay08  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | A9EE8826DF8A4E7BDE76CA9740970415516A307E |
> | 2020-06-20 01:00:00 | relay03  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | AC7FFC636CD734A0FDC22BF811841AE89743FC4F |
> | 2020-06-20 01:00:00 | relay31  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | BEFBEB3E477C77DAA8FB8FA03B6C6ABE71097786 |
> | 2020-06-20 01:00:00 | relay11  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | C00CBEE82D153439F4D1D3CDF8406646BCA2DB7E |
> | 2020-06-20 01:00:00 | relay26  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | C13BF3056344BDD6F486E1A96C89B76671A17C33 |
> | 2020-06-20 01:00:00 | relay10  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | CB78B3066AFFCC9C0DDC9CBBA5642BE162D2CEB9 |
> | 2020-06-20 01:00:00 | relay01  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | D7188148CF8CBACDF884C5E6615E82AA46DDB320 |
> | 2020-06-20 01:00:00 | relay14  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | EF5C9DD6B529FC82D812AC54EA976E14B201652A |
> | 2020-06-20 01:00:00 | relay15  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | F1B3A0B6F45727B9BB0C9E87A7AF4D62A3616F78 |
> | 2020-06-20 01:00:00 | relay04  | kleinendorstwiebe AT gmail DOT com |
> Liteserver Holding B.V. | F4F1EBAC8A75880F126DDE0DDDE5A652820F2F69 |
>
>
> https://metrics.torproject.org/rs.html#search/family:01C05513D12F63AE9E72588E8EAB459028C44689
>
>
> | 2020-07-17 23:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | E1571684FB37D13DE9BB18DAAF06BCB65BD187AA |
> | 2020-08-03 00:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 4F06398BD45754A46EE79B49421E0211ADB5B139 |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 00AC74D5FDF3F23679EB454593FBD5DF41C2DD72 |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 108D2042E505B85ECC0FB229EEA2327B8EC79E07 |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 3581CC850544CEA2A2032485E158831C7082027F |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 71EBB31BA9F37CB7BE3E33028DC95F4B0D8192A3 |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | C1107C7280924D76A0A59FFAC7EAF624BB84CE17 |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | D4AED2536B5725B46A39F38EDAC127A98204DD0E |
> | 2020-08-03 01:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | E5D55485AC2E5734BE42CFF8A1BF938AF6AFE08C |
> | 2020-08-03 02:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 212B9FEB92C049931521FA73E2EA86CB96C38F02 |
> | 2020-08-03 02:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 3294F2FBA76B7CFBA2F2DA6F71440862448C8487 |
> | 2020-08-03 02:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 4482F3DF4CEB2EB3BB8B60404C6283A2B70A3FDC |
> | 2020-08-03 02:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | A722963E4F776037DE972AE5F6F99E40A6FB2445 |
> | 2020-08-03 02:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | BA79B1B8CE8F253C5CD6601A5005C268A7D7F561 |
> | 2020-08-03 02:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | F8E8146710DB20F440DB481A68168B831DFEC8EA |
> | 2020-08-03 03:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 78256B1B6AB1D9E277BC5356F6D146BE3BF01A79 |
> | 2020-08-03 03:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | A779E0C961715B0C33B35DD39803464B581FBF73 |
> | 2020-08-03 13:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 3419CC27CE8BB4070F2C6DF4E34770614C38A199 |
> | 2020-08-03 13:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 466D5100A7BFB152A7630447010BDC1B971FB034 |
> | 2020-08-03 13:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 4C9C83E72EAAB5AE889FFBF726658AA996D6B013 |
> | 2020-08-03 13:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | F83FC21E244E2ECD28CFEB60D20A23DE7A51543C |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 11F2C7D7C84566F4AF6CDC8272A1B9406CFCA10B |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 2651DB80B287DF49965E180A148185EF8DE9E173 |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 45639F6B88747598422507717E5FA066B184406C |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 5F397DA94086F2481FD91441B16D29F858372FFE |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 8AA364F432A7CA2A0F74B57BCA2593293E450F97 |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 954899771A172E85E478026DCFF908B0CF5410B2 |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | AA2E1A3F6A31F9815758BF7F25A6C0EA4688BE59 |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | B9F7415B3BC8F5B84DCCA4E6BB48169D3129E2D5 |
> | 2020-08-03 14:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | EC4D5621785D34EA1AD61BF1810C20F38C3B9C23 |
> | 2020-08-03 15:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 12BBD122A385CD0D8FE0FF3456C788185965F9AC |
> | 2020-08-03 15:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 57B5D14ABCF8D7D7F3FCB2C5192C239A86071375 |
> | 2020-08-03 15:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | B610BE4A8410A29B785864EDFC8E667513EF59C6 |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 1D86E75980B107536C7802592360577619BA8BFC |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 79AEF5CEA5EC01C0B4D6B9DE21B86EE7D2DA4CDC |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 825213FB6551BA81EBA6594E31121370E3DB8488 |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 8F6AA58DD86C810EE169124BB245F0C5D96F734A |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 97560BEB6EEE630A41604FA1D16D6A42856D818C |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | 9DC0E701163C95E6AEAAEB21EB473FEF880BB153 |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | C94110E9170E1C9FDC53BA9919D5CD8685550078 |
> | 2020-08-04 21:00:00 | Unnamed  | NULL                               |
> Liteserver Holding B.V. | F26B1F81CB15201A955326D23B35243AA18A7D52 |
> +---------------------+----------+------------------------------------+-------------------------+------------------------------------------+
>
>
> --
> https://mastodon.social/@nusenu
>
>


More information about the tor-relays mailing list