Similar nodes are acting as multiple exit nodes with names such as Pwner1 and Pwner2 and other exit nodes have exactly the same name for multiple circuits but with different fingerprints such as PWNEE. The same nodes are acting as relays in multiple circuits. There is always at least one extra entry guard.

There is only supposed to be one entry guard so why do my circuits look like this? What's going on?

This first version is an inaccurate representation, but this is what it looks like if you're not paying close attention. Just glancing at it you can see the same nodes over and over.

uPwnedbruh, PwnMeOnceShameOnYou, PWNEE
OneGreatPwnedTorEntryGuard4Life, Pwnies, stax, PWNEE
OneGreatPwnedTorEntryGuard4Life, Pwned4Life, PWNEE
OneGreatPwnedTorEntryGuard4Life, PwnMaster, PWNEE
OneGreatPwnedTorEntryGuard4Life, PwnMaster, NowYouSeeItNowYouPwned, PWNEE
OneGreatPwnedTorEntryGuard4Life, PwnMaster, PWNEE
OneGreatPwnedTorEntryGuard4Life, PwnMaster, Pwnies, NowYouSeeItNowYouPwned, PWNEE
OneGreatPwnedTorEntryGuard4Life, YesYouIs, IfYourHappyAndYourePwnedClapYourHands, Pwner19
OneGreatPwnedTorEntryGuard4Life, YesYouIs, ToBeOrNotToBeThatIsThePwnage, Shame1
uPwnedbruh, DirtyRottenPwners, ThePwning
uPwnedbruh, PwnersAnonymous, Pwner22
OneGreatPwnedTorEntryGuard4Life, PwningIsYourFriend, ThePwnerator, Pwn2tor3
OneGreatPwnedTorEntryGuard4Life, NowOrPwner, pwnmeupbaby
OneGreatPwnedTorEntryGuard4Life, StylishPwner, Pwner8
OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, nPwnA, Pwn2tor4
OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, whyusoPWNed, Pwn2tor5
OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, Yup, Pwn2tor6
OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, Yup, Pwn2tor7
OneGreatPwnedTorEntryGuard4Life, PwnerSinclaire, Yup, Pwner21
OneGreatPwnedTorEntryGuard4Life, PwnerSinclaire, Yup, HarryPwner1
OneGreatPwnedTorEntryGuard4Life, YesYouIs, PwnerSinclaire, cPwnA, Pwner25
OneGreatPwnedTorEntryGuard4Life, YesYouIs, PwnerSinclaire, HarryPwner2
uPwnedbruh, YesYouIs, IsYouIsOrIsYouAintMyPwnie, baggage1
uPwnedbruh, YesYouIs, IsYouIsOrIsYouAintMyPwnie, Yellow
uPwnedbruh, YesYouIs, Pwnxor
uPwnedbruh, YesYouIs, Pwnzie
uPwnedbruh, YesYouIs, easypeasy
uPwnedbruh, YesYouIs, Pixel, packet
uPwnedbruh, YesYouIs, bruh, getonthegravypwn
uPwnedbruh, YesYouIs, HelloPwnedWorld, baggage2
uPwnedbruh, YesYouIs, IceCreamPwn, Pwn4YourLife, Shame2
uPwnedbruh, YesYouIs, PwnSupreme, PWNEE, Pwner9
uPwnedbruh, YesYouIs, YourPwnieOrYourLife, PickledPwniesAndHam
uPwnedbruh, YesYouIs, ipwn, Pwner10
uPwnedbruh, PWNPWNPWN, ribpwnbit, Pwn2tor8
uPwnedbruh, grilledPWN, IfYourHappyAndYourePwnedClapYourHands, Pwn2tor1
uPwnedbruh, AndYouReallyWantToPwnIt, Dark
NowYouPwnMeNowYouDont, Gaveitalltoshame, Shame3
OneGreatPwnedTorEntryGuard4Life, p, Jaws, Pwn2tor2
OneGreatPwnedTorEntryGuard4Life, ColdPwn, Pr0n
OneGreatPwnedTorEntryGuard4Life, Shield, Malicious
OneGreatPwnedTorEntryGuard4Life, Goody, UglyPwny
OneGreatPwnedTorEntryGuard4Life, Pwner24, Picket
OneGreatPwnedTorEntryGuard4Life, Badp, fpwni

simpler and this is an exact representation with names changed to a, b, c where 'a' is the undead guard and 'Unnamed' is a second guard that's always there.

a, b, c
a, d, e
a, f, g
Unnamed, h, i, j
a, h, k, l
Unnamed, m, n, Unnamed
Unnamed, h, o, p
Unnamed, h, Unnamed, q
Unnamed, m, i, r
a, h, Unnamed, x
Unnamed, t, u [New Tor Circuit for this Site 1]
a, Unnamed, i, v
a, Unnamed, n, Unnamed [first circuit]
Unnamed, Unnamed, i, w
Unnamed, m, o, x
Unnamed, Unnamed, k, y
Unnamed, z, PWNEE1 [first circuit]
a, another, PWNEE2 [New Tor Circuit for this Site 2]
a, different, PWNEE3 [New Tor Circuit for this Site 4]
a, m, newrepeatedname, new [New Tor Circuit for this site 1]
Unnamed, h, o, anothernew1 [New Tor Circuit for this site 2]

As you can see, 'm' and 'h' constantly gets used in the 2nd hop and 'o' in the 3rd hop. The 2nd and 3rd hop 'h' and 'o' are seen here twice. Then there's 'm' and 'o' and PWNEE is never far away from being the last hop. newrepeatedname is yet another node like the 'o' node in the 3rd hop.

This is a recent development. Nodes were more random and there were a couple of suspiciously named exits with similar names. The Unnamed guard persisted but only provided 1 or 2 circuits every now and then. Now I have 2 permanent guards and a lot less random nodes.

Update1: After successfully changing the guards, and wiping the OS, I am seeing the same behavior with completely different nodes and a handful of nodes that remain the same as with the other guards. So I have two new guards both of which are used to build circuits and a few nodes occupying the 2nd and 3rd hops, making for a lot less randomness than just a few days ago. It makes me wonder if Tor's circuit building mechanism changed either upstream or by a configuration change in my operating system which was updated a few days ago.

Update2: As dangerous as it is, I changed the guards again and wiped the OS again but this time I did not update the OS. I only have one Tor Entry Guard and the 2nd and 3rd guards are random again. I am tempted to leave things as is for a while but I'm curious about what security updates I might be missing out on and I found this: https://github.com/mikeperry-tor/vanguards/blob/master/README_TECHNICAL.md, specifically this snippet here: "These options ensure that all onion service circuits are restricted to a set of second and third layer guards, instead of sampling random ones from the whole network every time."

So it was not all in my head assuming this is what updating my OS accomplishes. I'm not knowledgeable enough to know if this is a good thing. The associated vulnerability is arguably very bad, but there must be a more secure way to fix it than creating "guards" for every point of failure. So I don't know if this will be implemented in Tor upstream, but from what I read I think it has been considered and will be. Now we have a Guard which rarely changes, I have not seen this happen automatically yet over months and now both a 2nd and 3rd guard and only 1 random middle guard just before the exit.

That's 5 hops in the circuit as explained in the article where the 4th one is randomized, but there are only 4 hops in a hidden service circuit. 5 hops seems to only be used for resolving to a 4 hop circuit and therefore results in the first 3 hops being generally non-random and the last hop with an even easier ability to do what is trying to be prevented in the article.

"The change to fixed nodes for the second and third layer guards is designed to force the adversary to have to run many more nodes, and to execute both an active sybil attack, as well as a node compromise attack. In particular, the addition of second layer guard nodes means that the adversary goes from being able to discover your guard in minutes by running just one middle node, to requiring them to sustain the attack for weeks or even months, even if they run 5% of the network."

This sounds effective in principle but I don't know how so. I suppose the attack must have relied on their controlling the middle guard(s) and by removing that ability to an extent this works like so.

Having 2 Tor Entry Guard nodes only sometimes seems to be what I was experiencing. And this message seems to indicate that both a 2 Tor Entry Guard node and 2nd and 3rd guard middle guards will be implemented in Tor upstream, if not already.

  • Can you describe your setup? Are you using Tor Browser or just tor? Why do you have paths with 4 hops? Did you make up these names, or do all of the relays in all of your paths have something to do with the word "pwn"?
    – Steve
    Mar 3 '20 at 17:12
  • I do not know why there are 3, 4, and 5 hops. The names are made up out of frustration and looking at it now, it's gotten worse than I described. The two tor entry guards are competing to be the guard. The second hop is filled with 3 or more of the same nodes, which to me are acting like guards. The third hop is doing the same thing. A lot of the 2nd and 3rd nodes are exactly the same pairs. I even tried changing the guard which you're not supposed to do and had a new guard for a while until the original guard woke up from the dead and is back! Mar 3 '20 at 23:19
  • tor.stackexchange.com/questions/9333/… When they say One Fast Guard for Life the really mean it. Mar 3 '20 at 23:27
  • It looks like clearnet sites are using 3 hops, hidden sites are using 4 hops, and the 5 hop circuits seem to be used for resolving hidden sites. When clicking on a hidden site, a 5 hop circuit is established and the destination site is an ip with a long string like$ABCDEF12345ABCDEF12345 which then establishes a 4 hop circuit to the hidden site. Mar 4 '20 at 0:48
  • I still don't know where you're getting any of this information from. Can you update your post with screenshots showing where you're getting this information from and what the actual values are? And Tor will re-use circuits for multiple streams in certain circumstances, so it's expected that multiple streams sometimes use the same path.
    – Steve
    Mar 4 '20 at 1:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.