2

This might feel funny or you might think I have gone crazy but I want to share this anyway.

Yesterday I have just turned on my Orbot and saw the logs to know what are all the relays I have been connecting with. Here comes a creepy thing, my logs shows the below while forming Tor circuit which I bet could trigger questions to any common man:

Circuit (4) BUILT: NationalCrimeAgency
here comes some checksum like bits then
CLOSED :NationalCrimeAgency

What Orbot have to deal with NationalCrimeAgency???? It makes me crazy (it should for everybody). I just closed that session and then reopen it then I got different logs like:

Circuit (7) BUILT: beirchangaming
Circuit (8) BUILT: beirchangaming >PirataEsse>blanqui
NOTICE:Tor has successsfully opened circuit........

You may say it was just a name of Tor rely it is not a real NationalCrimeAgency or whatever. Here the question is I have read in most article say Tor is even difficult for NSA to crack but again the question is what happen if spy agency or hackers with mischievous claw run a Tor relay and spoof all data of innocent peoples which it came across? Are we in the illusion of Tor privacy but not in actual privacy?

Improve this question

3 Answers 3

Reset to default
5

The National Crime Agency is a law enforcement agency based in the UK. Their job is to fight serious organised crime.

It's not against the law to use Tor (anywhere, and certainly not in the UK). If you are doing nothing illegal - for example, if you just want to browse the internet anonymously - then you have nothing to worry about, even if the authorities were able to see what you are doing.

If the NCA, NSA, FBI, or whoever owned the entry node (i.e. the first node in your circuit) - which could quite possibly be the case - that doesn't mean your data is at risk. It might mean that they have your IP address, and it might mean that they know you are using Tor, but they can't see what you're using Tor for; your data is safe.

what happen if spy agency or hackers with mischievous claw run as a tor relay and spoof all data of innocent peoples which it came across?

I think you're describing a Man in the Middle attack. In such an attack it's the exit node you would need to be more worried about, rather than the entry node. There's lots of information on this type of attack, and other attacks, in answers to other questions. If you use Tor regularly it might be a good idea to read about different types of attacks, be clear about what security Tor does provide, and understand your threat model.

Finally, as you say, the name of the relay doesn't necessarily indicate its true owner. You might ask whether the NCA would actually name a node they owned in such an obvious way. There's probably no way of finding out.

Improve this answer
2
  • Hi rich many thanks for your reply, i see my orbot stores the previous connections info because when i start my orbot first time it takes more time to build circuit but for the consecutive time i never faced the delay unless i clear the data externally but it shouldn't behave like this am i correct?
    – RaGa__M
    Commented Sep 25, 2015 at 13:56
  • It should be just storing the entry node (or the "entry guard"), rather than the whole circuit. In general, you'll use the same entry node for a long period of time (I think for several months, from memory), whereas a new circuit (3 nodes in total) will be created every 10 minutes. Your re-connection time might be shorter because of this. Have a look at these threads for more information: tor.stackexchange.com/questions/4880/…, tor.stackexchange.com/questions/386/…
    – Richard Horrocks
    Commented Sep 25, 2015 at 14:21
1

You may say it was just a name of tor rely

It is this one: https://atlas.torproject.org/#details/AC9803701F9EE18194D40B38E47CE4C68CF2F567

Improve this answer
5
  • Oops it seems real!!
    – RaGa__M
    Commented Sep 26, 2015 at 16:34
  • So this things make clear we can't completely anonymous,from anyone.
    – RaGa__M
    Commented Sep 26, 2015 at 16:35
  • 2
    All it makes clear is that someone decided to name one of their relays "NationalCrimeAgency". There is absolutely no indication of anything weird/fishy about this relay.
    – Jobiwan
    Commented Sep 26, 2015 at 17:00
  • How you are absolutely certain about that?
    – RaGa__M
    Commented Sep 26, 2015 at 17:05
  • Are we compromise ourselves here?
    – RaGa__M
    Commented Sep 26, 2015 at 17:07
0

Oftentimes people name their for nodes to be something scary. Naming their node after the NSA in the USA is popular.

IMHO the NSA runs many entry guard and exit nodes, but they aren't labeled as such 😉

Improve this answer
2
  • I agree Justin those three letter agency is running with different name for sure who care,so as I mentioned we are in the illusion of privacy but we aren't actually:-o
    – RaGa__M
    Commented Sep 25, 2015 at 17:35
  • Yes Richard. I'd be more worried about using for exit nodes in China and Russia. A Russian node was seen to be modifying updates downloaded through Microsoft's website. The NSA has and is actively trying to deanonymize tor users. I doubt they can be identified by name or IP address. They can just buy some IPs from any ISP or hosting company.
    – Justin Goldberg
    Commented Feb 11, 2016 at 1:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .