Similar nodes are acting as multiple exit nodes with names such as Pwner1 and Pwner2 and other exit nodes have exactly the same name for multiple circuits but with different fingerprints such as PWNEE. The same nodes are acting as relays in multiple circuits. There is always at least one extra entry guard.
There is only supposed to be one entry guard so why do my circuits look like this? What's going on?
This first version is an inaccurate representation, but this is what it looks like if you're not paying close attention. Just glancing at it you can see the same nodes over and over.
uPwnedbruh, PwnMeOnceShameOnYou, PWNEE OneGreatPwnedTorEntryGuard4Life, Pwnies, stax, PWNEE OneGreatPwnedTorEntryGuard4Life, Pwned4Life, PWNEE OneGreatPwnedTorEntryGuard4Life, PwnMaster, PWNEE OneGreatPwnedTorEntryGuard4Life, PwnMaster, NowYouSeeItNowYouPwned, PWNEE OneGreatPwnedTorEntryGuard4Life, PwnMaster, PWNEE OneGreatPwnedTorEntryGuard4Life, PwnMaster, Pwnies, NowYouSeeItNowYouPwned, PWNEE OneGreatPwnedTorEntryGuard4Life, YesYouIs, IfYourHappyAndYourePwnedClapYourHands, Pwner19 OneGreatPwnedTorEntryGuard4Life, YesYouIs, ToBeOrNotToBeThatIsThePwnage, Shame1 uPwnedbruh, DirtyRottenPwners, ThePwning uPwnedbruh, PwnersAnonymous, Pwner22 OneGreatPwnedTorEntryGuard4Life, PwningIsYourFriend, ThePwnerator, Pwn2tor3 OneGreatPwnedTorEntryGuard4Life, NowOrPwner, pwnmeupbaby OneGreatPwnedTorEntryGuard4Life, StylishPwner, Pwner8 OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, nPwnA, Pwn2tor4 OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, whyusoPWNed, Pwn2tor5 OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, Yup, Pwn2tor6 OneGreatPwnedTorEntryGuard4Life, SaveThePwnies, Yup, Pwn2tor7 OneGreatPwnedTorEntryGuard4Life, PwnerSinclaire, Yup, Pwner21 OneGreatPwnedTorEntryGuard4Life, PwnerSinclaire, Yup, HarryPwner1 OneGreatPwnedTorEntryGuard4Life, YesYouIs, PwnerSinclaire, cPwnA, Pwner25 OneGreatPwnedTorEntryGuard4Life, YesYouIs, PwnerSinclaire, HarryPwner2 uPwnedbruh, YesYouIs, IsYouIsOrIsYouAintMyPwnie, baggage1 uPwnedbruh, YesYouIs, IsYouIsOrIsYouAintMyPwnie, Yellow uPwnedbruh, YesYouIs, Pwnxor uPwnedbruh, YesYouIs, Pwnzie uPwnedbruh, YesYouIs, easypeasy uPwnedbruh, YesYouIs, Pixel, packet uPwnedbruh, YesYouIs, bruh, getonthegravypwn uPwnedbruh, YesYouIs, HelloPwnedWorld, baggage2 uPwnedbruh, YesYouIs, IceCreamPwn, Pwn4YourLife, Shame2 uPwnedbruh, YesYouIs, PwnSupreme, PWNEE, Pwner9 uPwnedbruh, YesYouIs, YourPwnieOrYourLife, PickledPwniesAndHam uPwnedbruh, YesYouIs, ipwn, Pwner10 uPwnedbruh, PWNPWNPWN, ribpwnbit, Pwn2tor8 uPwnedbruh, grilledPWN, IfYourHappyAndYourePwnedClapYourHands, Pwn2tor1 uPwnedbruh, AndYouReallyWantToPwnIt, Dark NowYouPwnMeNowYouDont, Gaveitalltoshame, Shame3 OneGreatPwnedTorEntryGuard4Life, p, Jaws, Pwn2tor2 OneGreatPwnedTorEntryGuard4Life, ColdPwn, Pr0n OneGreatPwnedTorEntryGuard4Life, Shield, Malicious OneGreatPwnedTorEntryGuard4Life, Goody, UglyPwny OneGreatPwnedTorEntryGuard4Life, Pwner24, Picket OneGreatPwnedTorEntryGuard4Life, Badp, fpwni
simpler and this is an exact representation with names changed to a, b, c where 'a' is the undead guard and 'Unnamed' is a second guard that's always there.
a, b, c some.stackexchange.com:443 a, d, e some.stackexchange.com:443 a, f, g some.stackexchange.com:443 Unnamed, h, i, j a, h, k, l Unnamed, m, n, Unnamed Unnamed, h, o, p Unnamed, h, Unnamed, q Unnamed, m, i, r a, h, Unnamed, x Unnamed, t, u [New Tor Circuit for this Site 1] tor.stackexchange.com:443 a, Unnamed, i, v a, Unnamed, n, Unnamed [first circuit] somelongv3hiddenservice.onion Unnamed, Unnamed, i, w Unnamed, m, o, x Unnamed, Unnamed, k, y Unnamed, z, PWNEE1 [first circuit] tor.stackexchange.com:443 a, another, PWNEE2 [New Tor Circuit for this Site 2] tor.stackexchange.com:443 a, different, PWNEE3 [New Tor Circuit for this Site 4] tor.stackexchange.com:443 a, m, newrepeatedname, new [New Tor Circuit for this site 1] somelongv3hiddenservice.onion Unnamed, h, o, anothernew1 [New Tor Circuit for this site 2] somelongv3hiddenservice.onion
As you can see, 'm' and 'h' constantly gets used in the 2nd hop and 'o' in the 3rd hop. The 2nd and 3rd hop 'h' and 'o' are seen here twice. Then there's 'm' and 'o' and PWNEE is never far away from being the last hop. newrepeatedname is yet another node like the 'o' node in the 3rd hop.
This is a recent development. Nodes were more random and there were a couple of suspiciously named exits with similar names. The Unnamed guard persisted but only provided 1 or 2 circuits every now and then. Now I have 2 permanent guards and a lot less random nodes.
Update1: After successfully changing the guards, and wiping the OS, I am seeing the same behavior with completely different nodes and a handful of nodes that remain the same as with the other guards. So I have two new guards both of which are used to build circuits and a few nodes occupying the 2nd and 3rd hops, making for a lot less randomness than just a few days ago. It makes me wonder if Tor's circuit building mechanism changed either upstream or by a configuration change in my operating system which was updated a few days ago.
Update2: As dangerous as it is, I changed the guards again and wiped the OS again but this time I did not update the OS. I only have one Tor Entry Guard and the 2nd and 3rd guards are random again. I am tempted to leave things as is for a while but I'm curious about what security updates I might be missing out on and I found this: https://github.com/mikeperry-tor/vanguards/blob/master/README_TECHNICAL.md, specifically this snippet here: "These options ensure that all onion service circuits are restricted to a set of second and third layer guards, instead of sampling random ones from the whole network every time."
So it was not all in my head assuming this is what updating my OS accomplishes. I'm not knowledgeable enough to know if this is a good thing. The associated vulnerability is arguably very bad, but there must be a more secure way to fix it than creating "guards" for every point of failure. So I don't know if this will be implemented in Tor upstream, but from what I read I think it has been considered and will be. Now we have a Guard which rarely changes, I have not seen this happen automatically yet over months and now both a 2nd and 3rd guard and only 1 random middle guard just before the exit.
That's 5 hops in the circuit as explained in the article where the 4th one is randomized, but there are only 4 hops in a hidden service circuit. 5 hops seems to only be used for resolving to a 4 hop circuit and therefore results in the first 3 hops being generally non-random and the last hop with an even easier ability to do what is trying to be prevented in the article.
"The change to fixed nodes for the second and third layer guards is designed to force the adversary to have to run many more nodes, and to execute both an active sybil attack, as well as a node compromise attack. In particular, the addition of second layer guard nodes means that the adversary goes from being able to discover your guard in minutes by running just one middle node, to requiring them to sustain the attack for weeks or even months, even if they run 5% of the network."
This sounds effective in principle but I don't know how so. I suppose the attack must have relied on their controlling the middle guard(s) and by removing that ability to an extent this works like so.
Having 2 Tor Entry Guard nodes only sometimes seems to be what I was experiencing. And this message seems to indicate that both a 2 Tor Entry Guard node and 2nd and 3rd guard middle guards will be implemented in Tor upstream, if not already.