1

When using a tor browser to connect to asstr.org an unexpected message shows in the browser:

Come visit us at https://www.asstr.org/ to read this story and hundreds of thousands of other works! Are you a tor user seeing this message by mistake? Take a look at http://awe-kyle.ru/ to see why. They ahve found a way touse tor to their commercial advantage.

How does this work, how can a regular website be hijacked through TOR ?

Improve this question
3
  • 1
    Sounds like a bad relay, if you use the green onion on Tor Browser it should tell you what exit relay you're using. Report it by email bad-relay[email protected] along with steps to reproduce the result.
    – cacahuatl
    Sep 22, 2017 at 3:08
  • I note that if you repeatedly change tor circuits you will eventually get one that comes up with the normal landing page. I am too unsophisticated to know what that means in a larger sense, since that seems to mean that multiple exit nodes are affected.
    – user19267
    Sep 24, 2017 at 21:16
  • it's another FSB badass pathetic attempt: they not just trying to force an end-user encryption(https->http) to vanish, they also not evenmasking a domain name change. Use proper endpoint tools and you'll be just fine. The "proper tools" list is: * Perspectives project add-on * Calomel SSL Validation * Certificate Patrol * HTTPS everywhere YES, they produce a lot of informational windows popping up, NO - you can't omit them if you have such a problems.
    – Alexey Vesnin ♦
    Sep 24, 2017 at 21:57

2 Answers 2

Reset to default
1

I can reproduce the problem. I first assumed that it was a bad exit node. Tor doesn't add an additional encryption layer to the last leg between exit node and a regular (non-.onion) website. So exit nodes can eavesdrop or perform a man-in-the-middle attack if they want to and that connection isn't encrypted in some other way. However, that page appears in the HTTPS version, and the certificate checks out. It's the same I get when I access the website normally. It's a certificate by Let's Encrypt with the following SHA-256 fingerprint:

12:C2:BE:3A:92:F6:BC:9E:11:11:FE:D4:AB:CA:99:34:92:EE:EF:4C:A2:67:AD:93:89:F1:5C:C9:CE:8F:3C:3A

That can only mean one of two things:

  1. It's legit. This is actually the page the asstr.org webmaster wants you to see when you access their website with TOR.
  2. The admin of the exit node somehow obtained the private key from asstr.org, allowing them to impersonate them.
Improve this answer
0

I have seen that web site and others hijack all of asstr.org. They pretend that they are asstr and supply that content with porn and ads even without TOR. IE, awe-kyle(dot)ru/anything will look like asstr(dot)org/anything.

These sites come and go. Two others active now are pegast-irk(dot)ru/ and pegast-irk(dot)ru/

Y

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .