[tor-relays] Malicious Tor relays - post-analysis after two months

[Georg Koppen]

Corl3ss:
> Hello,
> 
> 
> 
> This summer Nusenu shared his posts about malicious relays [1][2] and it was followed by many answers.
> 
> A very important is Roger's one [3] explaining that the malicious relays have been kicked out of the network and that any new one should be reported.
> 
> 
> I was wondering if, with some distance with this summer situation / discussion :
> * new malicious relays have been reported in any way ?

Yes, there have been more malicious relays reported. Some of them doing
attacks like Roger mentioned. We kicked out all of those. There were
other reports about relays that seem to belong to the group(s) we kicked
out earlier this year.[1] Some of those relay groups have been kicked
out, too.

> * vigilance / watchfulness is still needed ? if yes :
> 	* is there specific cases to share (e.g. nodes that block HTTPS on a site or redirect to HTTP ?)
> 	* any concern to have on other protocols that use SSL (imaps, smtps, ssh) ?

Yes, there is still vigilance needed. While we have some scanners and
some manual work is done, that's not enough, in particular against more
sophisticated attackers.

> * is there / will there be things implemented as a conclusion of the "call for support for proposal to limit large scale attacks" ?

We have some ideas on how to move forward which have different
trade-offs and we realized that a lot of them touch the question of what
we want the Tor network to be in the future. I had hoped  that I would
have sent an email about that by now to this list asking the community
about input and possible options but alas it's still sitting unfinished
in my drafts folder. :(

> * has it been possible to prepare / set up precautions to avoid this king of situation or it is a too long shot for such a problem ?

We don't have good ways to fix this problem in the short term. So, until
we make progress on any of our longer term plans we somehow need to keep
up with the whack-a-mole game we have been playing for quite some time now.

> These questions come with a lot of respect for the project, its teams and the work done. No critics, it is just made to update the knowloedge on the subject as these questions came back with other friends and relay operators.

No worries, I am happy to take criticism of the status quo and our
future plans. :)

> And perhaps a last one, perhaps specific for Nusenu : how do you define a malicious relay ? Sorry but I did not get that precisely, moreover in big group analysis.

That's a good question. I am not Nusenu and will thus defer the answer
to them. But it's a good question to think about regardless as finding a
good answer to it is part of the problem of removing bad relays. Kicking
out relays that got caught while doing e.g. SSL stripping attacks is
easy but what about a group of relays with similar (and what is
"similar"?) configuration showing up like on the next day or days
thereafter? Is that the some entity just joining the network again to be
able to launch new attacks at *some* point? Or is it some new
contributor that likes to help the network growing/diversifying? And
what about all those relays without a valid ContactInfo? Are those
anonymous contributors that want to help the Tor network or sneaky
attackers? Etc.

This touches the question of what we want the Tor network to be (and how
we would manage trust relationships in it), too...

> 
> All answers will be read with care and gratitude !

Thanks and thanks for your questions,
Georg

[1] https://blog.torproject.org/bad-exit-relays-may-june-2020

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20201007/4be24ba4/attachment.sig>