[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Tor relay shutted down by ISP
- To: or-talk@xxxxxxxxxxxxx
- Subject: Tor relay shutted down by ISP
- From: Tom Hek <tomtorexitnode@xxxxxxxxx>
- Date: Wed, 20 Feb 2008 17:22:20 +0100
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: or-talk-outgoing@xxxxxxxx
- Delivered-to: or-talk@xxxxxxxx
- Delivery-date: Wed, 20 Feb 2008 11:22:49 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:subject:x-enigmail-version:content-type:content-transfer-encoding; bh=SPXJ16YROZxrFJjFa+v0NP/2E8ExVhs1NZTc0IZoUqM=; b=deXnd5Othaz1Ub7Y9oYeguqzvaG9922HhSnoftoHzezuZalg8tm/YBPM1EQuFxnLiHDzqwHhcTeAy5h9ka/Iuo6s/fTnwaqTxyqBXKWFfW4ykB7VNCtKWwkNc2hGAizaiIfMX1dTwMyJjMEgnQ2NfXSIthgfNe40JeV+1nuewbo=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:x-enigmail-version:content-type:content-transfer-encoding; b=jPvooDQjS79XWaipWE1dm8vBQX8OL+WlQGz1RxzSY2K/k5FBqtsH/06qTlX+IBOue9FFak+peplw1RCq8ChNdNhS1hIaUs5/w2UP8XoTV0lVKlhKrZCKhx3LFaqakv9qtMRL3GJG8oebWUvEI1cubeEroBhTO/Y+YhSQNjKLh+k=
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
- User-agent: Thunderbird 2.0.0.9 (Macintosh/20071031)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello fellow Tor relay admins,
I run several Tor relays on residential DSL connections. This morning my
dad called me, telling me that my ISP had disconnected us from the
Internet because of a Trojan running on my systems (I wasn't at home at
that moment ;)). They had received a abuse complainant that one of my
boxes on this DSL connection was on a botnet.
I checked the timestamp of the log they sended to me with the uptime of
the computers. Only the computer that was running a Tor node was online.
It was pretty obvious that the botnet connections were coming from this
box. The box was clean, had no rootkits installed or other malicious
software, so it was Tor, relaying a connection for a bot.
My ISP didn't knew what Tor was and asked if "that Tor" logged the
connections that were running through it. I told them Tor was an
anonymity system so it doesn't keep any logs of the traffic that's going
through it. They were confused, they told me that every decent Tor relay
keeps a log of the connections running through it.
I'm living in The Netherlands, running this Tor node on the ISP XS4ALL.
XS4ALL is one of the ISP's with the most knowledge of the internet and
the things happening on the internet. I'm pretty shocked that they
didn't knew about Tor. I want to alert all the Tor relay admins that are
running Tor nodes on a connection from XS4ALL to be prepared to get
disconnected, because they think there is a trojan or rootkit running on
your system..
XS4ALL restored the DSL line but I had to promise that it wouldn't
happen again..
Tom Hek
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEARECAAYFAke8U7wACgkQStmJ9+mkUHNdigCdGxiIcOqMjD2jThp03KmlVP8x
s0YAnRRECJrxX/XiGIrg/fJpiadsYYKQ
=n7vE
-----END PGP SIGNATURE-----