[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: possible DoS attack?
- To: or-talk@xxxxxxxxxxxxx
- Subject: Re: possible DoS attack?
- From: "F. Fox" <kitsune.or@xxxxxxxxx>
- Date: Tue, 11 Dec 2007 16:59:20 -0800
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: or-talk-outgoing@xxxxxxxx
- Delivered-to: or-talk@xxxxxxxx
- Delivery-date: Tue, 11 Dec 2007 19:59:33 -0500
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:x-enigmail-version:content-type:content-transfer-encoding; bh=e6rc6sTG4qietlnQ8l3qIyvEi41S7V4k0TLV0SV80/4=; b=aLUNvvaA2+FWRP08bzGu56+dzm7taxicuwhydlCeV+WTxSBSNdRzLD/z23trtfRMyTcNc8QnZzwjg56yHGEZXA8aV3cp2qf02O6Xluunv2Zgr+ERIBWZALS6fj0nqPWwNTg9s8mcoeV6pF4pQG3MLlTi9oWmbLd4UJ8xML4faOg=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:x-enigmail-version:content-type:content-transfer-encoding; b=CO9UccxIl5mO2lLBf4RrxF6mNOBUuBacDIbcvjfxCljtfvuaXBILIGqGitzFY6lVqz7LEihjjrZDyVh+TQxyGpnrwc5Patm49JocK4w14RxDXT8IJtcBfI41xSEmmVzek9GNCUMVxR4bTjSp2TeSSJWK4/Ekf/LKhR3SGaeVOB0=
- In-reply-to: <200712112339.lBBNds2O010410@xxxxxxxxxxxxx>
- References: <200712112339.lBBNds2O010410@xxxxxxxxxxxxx>
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
- User-agent: Thunderbird 2.0.0.9 (Windows/20071031)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Scott Bennett wrote:
(snip)
> What I
> found that seemed out of the ordinary was many dozens of connections to my
> directory mirror port from 83.103.38.65 (fastweb65.ietnet.net)
(snip)
> 83.103.38.65 does not appear in my cached-consensus or cached-descriptors*
> files, so these are not simply tunneled directory connections from random
> sites getting funneled through one tor server in Italy.
> Can anyone tell me whether this is legitimate activity or whether I should
> begin blocking it at my router to encourage it to go away?
(snip)
It sounds mighty suspicious, in my opinion.
If I recall correctly, directory mirroring is based on HTTP (hence, why
it's encouraged to host it on port 80 for "fascist firewalled" folks, if
at all possible). Therefore, it would be vulnerable to any "fundamental"
attack (i.e., based on the nature of TCP or HTTP) that any Web server
would be.
Given that the system you mention doesn't seem to be a Tor node, I say
that if it's not an attack, then something's pretty weird.
I'm no expert, but I say block the offending system. Does anyone else
concur?
- --
F. Fox
Owner of Tor node "kitsune"
CompTIA A+, Net+, Security+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFHXzJobgkxCAzYBCMRArCRAJ0Xv7oRjoXcnHuETZ7vn6k4IpsaGwCfcJ9t
sfTLWKVAzbOMtURdnEswPW0=
=F8zz
-----END PGP SIGNATURE-----