1

While browsing on Tor this evening. I received a message from either windows security center or mcafee stating that they had blocked a "risky connection" coming from an "anonymous proxy" I didnt get a chance to write the message down in its entirety because I was browsing some fairly sensitive information and got scared and closed all my windows. The most disturbing part was that it referenced somewhere in my tor folders for the location of this threat and rated it at "Very High"

I reinstalled Tor today and had been browsing a lot of questionable onion sites with javascript off since my reinstall (really wish this was disabled automatically). I was under the impression that Mcafee/Windows security had nothing to do with my Tor connection. ANY input would be GREATLY appreciated as I am (obviously) not very tech savvy. Thanks in advance.

closed as unclear what you're asking by Jens Kubieziel Dec 6 '14 at 21:53

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • If it was Mcafee you'll almost certainly have logs of the event that you can review. Poke around the software for a bit to see if you can find any relevant info – user194 Dec 16 '13 at 4:33
  • It was in fact the Mcafee firewall, however I cannot get any details on this specific threat. When I view the logs it will show me (100+) blocked connections from today alone likely (in my opinion which could mean little) due to the fact I'm using windows 8 and I havent allowed my computer to connect to my microsoft account. The threat however is logged under the firewall, which I cannot get any details about. I'm getting frustrated. – user740 Dec 16 '13 at 5:18
  • There were many blocked connections form different IPs with different explainations, this one caught my interest "The PC XXX.XXX.X.X tried to access your system UDP port 1900. If you want to allow this traffic, either trust the IP address or open the port in the System Services in Firewall. UDP port 1900 is commonly used by the "SSDP" service or program. SSDP is used to install remote installation services. The protocol was designed to simplify administration by allowing yo to install a device on your LAN and in turn have it install itself onto all computers on the LAN.... – user740 Dec 16 '13 at 5:36
  • The original implimentation was flawed and exposed a security risk.--skip a bunch of text---However opening port 1900 to the internet is generally not wise even on a patched system. If you are on a school lan or share several systems you may see three events per system every few minutes. This can be ignored. If you do not see three items from the same system (on average) then you may wish to report this as an attack. If you need to open this port is can be opened via 'system services'...The source IP address is your own gateway. The source IP address is on your own DHCP server& lcl network – user740 Dec 16 '13 at 5:42
  • Doubting this is related because when i looked at the threat initially the threat was shown on the map as an "anonymous proxy" that showed coming from somewhere in africa on the threat map. – user740 Dec 16 '13 at 5:43

Browse other questions tagged or ask your own question.