1

i recently came up with this message when tried to run tor while vpn was running as well.

OS- osx any clues if this has to do with man-in-the-middle attack or not? see pic for logenter image description here

Improve this question

1 Answer 1

Reset to default
1

The log you're showing can be MitM - and there's how to check it:

  • make a su to your Tor user
  • do a traceroute to the 109.105.109.147 - or also to other IP's that are mentioned in that Problem bootstrapping messages.

If the trace(s) completes OK - then it is a MitM proven. If it's not - do netstat -r and examine your routing table: many VPN's are setting itself as a default router, so it can be either a "route table switch" moment, but it should repair itself in time, or you may have a routing issue. Yes, some VPN's - especially in Russia - did the MitM attempt when using Tor through them when it was not violating their ToS. So the outcome of your test will show the truth.

Improve this answer
15
  • hm, can you write an example of the commands with pathnames to understand what i have to do. thanks
    – user16257
    Feb 13, 2017 at 19:02
  • in a terminal do traceroute 109.105.109.147 and copy and paste it's output. If you have had any other IP's which were referred in error messages like [WARN] Problem bootstrapping .... like on your screenshot - do this command run for them as well and paste the output too
    – Alexey Vesnin ♦
    Feb 14, 2017 at 4:49
  • i did the traceroute, thanks. in the output, from number / line 11 and after, shows 4 stars (****) and continues infinitely. I pressed control-break and stopped it. not sure if i have to let it go more time. in the WARN there was no other ip's listed. shall i run it again or the asterisks show it did not complete ?
    – user16257
    Feb 14, 2017 at 13:31
  • yes - let it complete. It usually does 32 steps
    – Alexey Vesnin ♦
    Feb 14, 2017 at 14:02
  • ok, thanks ! I did that and goes over 45 steps 14-45 all are asterisks. I noticed that the output results at beginning were different from the last time if i remember ok. i stopped it again. it seems it does not stop. i noticed also that my firewall stats for openvpn shows incoming and outgoing connection. is that normal ? Today utorrent asked me for an incoming connection, although they were hundreds coming in and no forewall notification popups until that ip.
    – user16257
    Feb 15, 2017 at 18:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .