0

I have not ran TOR since turning on my computer hours ago. I occasionally netstat my CPU to make sure there is no unknown connections/phoning home/root kits.

I ran the following command:

sudo netstat -natup

This was in the output

tcp 0 0 127.0.0.1:9050 0.0.0.0:* LISTEN 1324/tor
tcp 0 0 10.8.0.2:53890 91.109.29.241:443 ESTABLISHED 1324/tor
tcp 0 0 10.8.0.2:59096 185.13.38.75:9001 ESTABLISHED 1324/tor

Anyone have any idea? Am I compromised?

Pastebin whois checks: http://pastebin.com/GYfKQAdA

If there is anything else I can add to receiver a more accurate answer please let me know. Thank you all for your help.

| improve this question | | | | |
  • Pro-tip: You can't detect any good rootkit with netstat – cacahuatl Jan 1 '17 at 18:55
1

Those are both Tor relays.

91.109.29.241:443 and 185.13.38.75:9001 are both normal end-points for a Tor client to connect to.

Tor is likely running as a system service and configured as a client, which means it will start by default and it builds circuits opportunistically. It keeps a set of circuits open and ready for use. Even when you're not using it, it will be connected to the Tor network.

Running netstat will never be suitable to detect any rootkit, since netstat is executing in userspace and the rootkit is in the kernel, a rootkit can interfere with the information before it is fed back to netstat and remove itself from the listings. Infact that is standard functionality for rootkits, they won't appear in process listings, file listings or connection listings.

Your flawed attempt at security is both making you jump at shadows and not defeating attackers or detecting compromise.

| improve this answer | | | | |
0

It's OK - these ones are outbound connections, and it's totaly normal for Tor to have ones. You can post your torrc and ifconfig - so I'll be able to explain it in your particular case in much deeper details.

| improve this answer | | | | |
0

Tor opens connections to a Directory Server, telling you about Tor relays and your Entry Guards through which you use to connect to the middle and exit server.

If you are using the Tor Browser Bundle one of these IPs should match your entry guard.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.