Re: Active Attacks - Already in Progress?

Thus spake Theodore Bagwell (torus...@imap.cc): On Sun, 28 Nov 2010 17:54 -0800, Mike Perry mikepe...@fscked.org wrote: Rather than cripple the network by forcing more clients to use slower nodes more often, we have opted to try to document the process of running a high capacity Tor exit

Re: Active Attacks - Already in Progress?

On Sun, 28 Nov 2010 17:54 -0800, Mike Perry mikepe...@fscked.org wrote: Rather than cripple the network by forcing more clients to use slower nodes more often, we have opted to try to document the process of running a high capacity Tor exit node:

Re: Active Attacks - Already in Progress?

I don't take issue with these particular nodes, nor the method in which they are multiplied. What concerns me is that any single entity (person/organization) is capable of convincing my Tor client to use it in the majority of circuits I build. The clusters I pointed out before have been vouched

Re: Active Attacks - Already in Progress?

Thus spake Theodore Bagwell (torus...@imap.cc): I don't take issue with these particular nodes, nor the method in which they are multiplied. What concerns me is that any single entity (person/organization) is capable of convincing my Tor client to use it in the majority of circuits I

Re: Active Attacks - Already in Progress?

On 25.11.2010 08:17, Damian Johnson wrote: The reason the operators of the largest tor relays (Blutmagie, TorServers, and Amunet) operate multiple instance is because this is the best way in practice for utilizing large connections. yep, all four blutmagie nodes are running on a single quad

Re: Active Attacks - Already in Progress?

Am 25.11.2010 03:38, schrieb Theodore Bagwell: ** I speak primarily of torserversNet_ numbers 1-5, and PPrivCom___ numbers 004-052. hi there, would you mind to broaden your research covering blutmagie1-4? Its last 24h sustained bandwidth is higher than the cumulated bandwidth of all

Re: Active Attacks - Already in Progress?

Hi, would it be noticed if an adversary modifies Tor's source code in order to report a fake observed bandwidth (a few KB), fake uptime data, and Windows as OS to the directories? Probably nobody will notice even if those relays carry a significant amount of traffic. Olaf

Re: Active Attacks - Already in Progress?

A quick look at my cache-descriptors show the following for PPrivComXXX. family PPrivCom001 PPrivCom002 PPrivCom003 PPrivCom004 PPrivCom005 PPrivCom006 PPrivCom007 PPrivCom008 PPrivCom009 PPrivCom010 PPrivCom012 PPrivCom013 PPrivCom014 PPrivCom015 PPrivCom016 PPrivCom017 PPrivCom018 PPrivCom019

Re: Active Attacks - Already in Progress?

On Wed, 24 Nov 2010 18:38:23 -0800 Theodore Bagwell torus...@imap.cc wrote: We recently discussed an attack on onion-routing anonymity, wherein a well-funded adversary overwhelms the network with compromised relays, thereby increasing his chances of monitoring anonymity-compromising data.

Re: Active Attacks - Already in Progress?

Hi Theodore. The reason the operators of the largest tor relays (Blutmagie, TorServers, and Amunet) operate multiple instance is because this is the best way in practice for utilizing large connections. Robert and others are right and you should call people out if they operate multiple relays