[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] 'relay early' attack detection at the infrastructure level

To: tor-relays@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-relays] 'relay early' attack detection at the infrastructure level
From: Zenaan Harkness <zen@xxxxxxxxxxxx>
Date: Sat, 2 Aug 2014 15:38:51 +1000
Delivered-to: archiver@xxxxxxxx
Delivery-date: Sat, 02 Aug 2014 01:39:07 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:content-type; bh=DH361UGnPNDrku98+sUQsDHBqBaO4rIst0fLKatQ39o=; b=eo5W1WIgKKe67OUojOXuPXADK6sIYBJwJMBdg9FL+xwLxXqPO2wz57Zf56PMyaWHBR ahmxGS0eDM8aCnSDaYrOUSqC6dRgp2UxaOwckMX/MgY2A7DNZBELcJEjQhSf9/xh1GRh LGBK7eCmTc4DqERcYhNp9JGQGf4shE3oNiGdiwdOHmeg3MEy5Fwm3s25d+frUKlvjz/5 tTk5yTQfwPMD27r6nEQzqVsQeRM9wwfmQm25nU1jvrgIL7aumVQw+pWN4GNGXHS/eaV0 l8L8EaN5jLIvVkF8S68qF2EdnaM8dsIPkVTDYUNbPNWnYbc/3I79EkLkDkr3Vl+ZVrAz 3GPg==
In-reply-to: <20140802034850.GH8819@xxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-relays/>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
References: <53DC087E.5070104@xxxxxxxxxxxxx> <20140801214338.GG8819@xxxxxxxxxxxxxx> <53DC1B7A.7020304@xxxxxxxxxxxxx> <53DC4829.6040109@xxxxxxxxxxxxxx> <20140802034850.GH8819@xxxxxxxxxxxxxx>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

On 8/2/14, Roger Dingledine <arma@xxxxxxx> wrote:
> On Fri, Aug 01, 2014 at 10:08:41PM -0400, krishna e bera wrote:
>> According to
>>
>> https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack
>>
>> the RELAY_EARLY cell has common legitimate uses.
>> How can we distinguish an attack from those?
>
> Correctly-behaving Tor relays never send RELAY_CELL cells backwards
> (towards the client) on the circuit.
>
> So if you see one, it's somebody not following the protocol.

Might be a stupid question sorry, but why not just block such
relay-early packets coming in the wrong direction?
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Follow-Ups:
- Re: [tor-relays] 'relay early' attack detection at the infrastructure level
  - From: Roger Dingledine

References:
- [tor-relays] 'relay early' attack detection at the infrastructure level
  - From: Nusenu
- Re: [tor-relays] 'relay early' attack detection at the infrastructure level
  - From: krishna e bera
- Re: [tor-relays] 'relay early' attack detection at the infrastructure level
  - From: Roger Dingledine

Prev by Author: Re: [tor-relays] Exit Nodes under DDoS attacks
Next by Author: Re: [tor-relays] 'relay early' attack detection at the infrastructure level
Previous by thread: Re: [tor-relays] 'relay early' attack detection at the infrastructure level
Next by thread: Re: [tor-relays] 'relay early' attack detection at the infrastructure level
Index(es):
- Author
- Thread