1

I think I've encountered a malicious node. (I used TBB to connect normally, no obfs3, no bridges, no pluggable transports.)

Below is a fragment of the log:

Aug 29 16:23:07.000 [notice] Bootstrapped 90%: Establishing a Tor circuit.
Aug 29 16:23:09.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Aug 29 16:23:09.000 [notice] Bootstrapped 100%: Done.
Aug 29 16:23:10.000 [notice] New control connection opened.
Aug 29 16:23:30.000 [warn] Proxy Client: unable to connect to 209.141.36.236:45496 ("TTL expired")
Aug 29 16:23:37.000 [notice] new bridge descriptor 'PacificSunset' (fresh): $BA61757846841D64A83EA2514C766CB92F1FB41F~PacificSunset at 208.79.90.242
Aug 29 16:26:06.000 [notice] New control connection opened.
Aug 29 16:26:43.000 [notice] New control connection opened.
Aug 29 16:27:10.000 [warn] Rejecting SOCKS request for anonymous connection to private address [scrubbed].
Aug 29 16:28:17.000 [notice] We stalled too much while trying to write 2410 bytes to address [scrubbed].  If this happens a lot, either something is wrong with your network connection, or something is wrong with theirs. (fd 38, type Socks, state 11, marked at src/or/connection_edge.c:144).
Aug 29 16:30:02.000 [notice] New control connection opened.

Could Tor developers who are responsible for nodes and relays remove 209.141.36.236:45496 please?

Do you guys suspect a MiTM attack? or the NSA, GCHQ is hacking in to some parts of the Tor network?

7
  • Hi, could you explain why you think that this is a malicious node?
    – Jens Kubieziel
    Aug 30 '14 at 22:08
  • 1
    @JensKubieziel: About two years ago a similar situation arose and one of Tor staff opined that it could be a malicious node set up by someone or some people with bad intent.
    – user281403
    Aug 31 '14 at 4:21
  • 1
    @user281403 Mind sharing a reference? I don't see why this should indicate a problem either.
    – knaperek
    Aug 31 '14 at 13:12
  • 2
    @user281203, Dear, I think it maybe premature to remove that particular relay. It maybe prudent to request an investigation into the situation. The proper way to report a suspicious relay is to report that to Tor at the following email address. bad-relays@lists.torproject.org is for reporting exit relays observed to be misconfigured or malicious. You do not need to subscribe before posting. Thank you for pointing this out.
    – Roya
    Aug 31 '14 at 14:55
  • @knapo: The reference was deleted when Tor's website underwent a makeover.
    – user281403
    Aug 31 '14 at 22:29
1

The proper way to report a suspicious relay is to report that to Tor at the following email address.

This is a quote from About Tor, Tor: contact, Email

bad-relays@lists.torproject.org is for reporting exit relays observed to be misconfigured or malicious. You do not need to subscribe before posting.

Appreciated for you concern and it is recommended to report this to proper Email address.

1

Firstly I'm not answering my own question.

Rather, it's a response to Roya's suggestion that I send an email to bad-relays@lists.torproject.org, which I had done prior to making the original post.

Below is exchange of emails between Philipp and me:

> > On Thu, Aug 28, 2014 at 11:19:49AM -0000, xxxx (name redacted) wrote:
> >> I wish to report a malicious relay. The following is a snippet of my Tor
> >> connection log:
> >>
> >> Aug 28 18:26:06.000 [warn] Proxy Client: unable to connect to
> >> 209.141.36.236:45496 ("TTL expired")
> >> Aug 28 18:26:08.000 [notice] Tor has successfully opened a circuit.
> >> Looks
> >> like client functionality is working.
> >> Aug 28 18:26:08.000 [notice] Bootstrapped 100%: Done.
> >> 0 migrated.
> >> Aug 28 18:26:09.000 [notice] New control connection opened.
> >
> > That does not seem to be malicious.  It means that the TTL value of IP
> > packets to 209.141.36.236 expired.  That's a networking error and not a
> > security problem.
> >
> > Cheers,
> > Philipp
> >
> 
> Hi Philip
> 
> Thanks for your clarification.
> 
> The networking error occurs at whose end: my PC and/or router, my ISP, Tor
> network or the destination site?
> 
> Could someone or some people have introduced some hacks to induce a
> networking error?
> 
> Were the data packets sent by me to the destination website decrypted as a
> result of the expiration of TTL value?

I am sorry but this mailing list is only for reporting malicious relays.
If you need support, please write to <help@rt.torproject.org>.

Cheers,
Philipp
4
  • 1
    Dear, Please release the complete emails minus redacted information, including your name, dates, email address, plus any other piece of information you feel need to be redacted. At first glance, it seems that Tor folks were not very helpful as far as you were concerned.
    – Roya
    Aug 31 '14 at 16:58
  • 1
    @Roya: Dearie, per your request, I've released the correspondence between Philipp Winter and myself. Details that can be traced to me have been redacted.
    – user281403
    Aug 31 '14 at 22:34
  • Dear, It looks like overly bureaucratic. However, it may help to resolve the issue if you copy this correspondence to help@rt.torproject.org I hope you get a resolution to this issue. And thanks for following the issue through and through. Do not give up.
    – Roya
    Aug 31 '14 at 23:21
  • This kind of network error can happen anywhere on the path. Internet is a guarantee-free network and these things happen quite frequently. Of course, it's possible for an adversary to cause this, but it would be of a little benefit. There's no way it could cause your packets to go unencrypted, you can feel safe in this regard.
    – knaperek
    Sep 1 '14 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.