1

i recently came up with this message when tried to run tor while vpn was running as well.

OS- osx any clues if this has to do with man-in-the-middle attack or not? see pic for logenter image description here

1

The log you're showing can be MitM - and there's how to check it:

  • make a su to your Tor user
  • do a traceroute to the 109.105.109.147 - or also to other IP's that are mentioned in that Problem bootstrapping messages.

If the trace(s) completes OK - then it is a MitM proven. If it's not - do netstat -r and examine your routing table: many VPN's are setting itself as a default router, so it can be either a "route table switch" moment, but it should repair itself in time, or you may have a routing issue. Yes, some VPN's - especially in Russia - did the MitM attempt when using Tor through them when it was not violating their ToS. So the outcome of your test will show the truth.

15
  • hm, can you write an example of the commands with pathnames to understand what i have to do. thanks – xmen Feb 13 '17 at 19:02
  • in a terminal do traceroute 109.105.109.147 and copy and paste it's output. If you have had any other IP's which were referred in error messages like [WARN] Problem bootstrapping .... like on your screenshot - do this command run for them as well and paste the output too – Alexey Vesnin Feb 14 '17 at 4:49
  • i did the traceroute, thanks. in the output, from number / line 11 and after, shows 4 stars (****) and continues infinitely. I pressed control-break and stopped it. not sure if i have to let it go more time. in the WARN there was no other ip's listed. shall i run it again or the asterisks show it did not complete ? – xmen Feb 14 '17 at 13:31
  • yes - let it complete. It usually does 32 steps – Alexey Vesnin Feb 14 '17 at 14:02
  • ok, thanks ! I did that and goes over 45 steps 14-45 all are asterisks. I noticed that the output results at beginning were different from the last time if i remember ok. i stopped it again. it seems it does not stop. i noticed also that my firewall stats for openvpn shows incoming and outgoing connection. is that normal ? Today utorrent asked me for an incoming connection, although they were hundreds coming in and no forewall notification popups until that ip. – xmen Feb 15 '17 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.