Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-28 Thread Drak
Related to Russia's Tor bounty? http://www.theguardian.com/world/2014/jul/25/russia-research-identify-users-tor On 28 Jul 2014 04:45, Gregory Maxwell gmaxw...@gmail.com wrote: On Sun, Jul 27, 2014 at 7:54 PM, m...@bitwatch.co m...@bitwatch.co wrote: These website list Tor nodes by bandwidth:

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-28 Thread Mike Hearn
As I pointed out above, — it isn't really. Without the exit flag, I believe no tor node will select it to exit 8333 unless manually configured. (someone following tor more closely than I could correct if I'm wrong here) The exit flag doesn't mean what you would expect it to mean. The reason

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-28 Thread s7r
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 7/28/2014 6:44 AM, Gregory Maxwell wrote: On Sun, Jul 27, 2014 at 7:54 PM, m...@bitwatch.co m...@bitwatch.co wrote: These website list Tor nodes by bandwidth: http://torstatus.blutmagie.de/index.php

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-28 Thread Robert McKay
On Mon, 28 Jul 2014 07:28:15 -0400, Peter Todd wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 I've got a bitcoin-only exit running myself and right now there is absolutely no traffic leaving it. If the traffic coming from that node was legit I'd expect some to be exiting my node

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-28 Thread Gregory Maxwell
On Mon, Jul 28, 2014 at 5:31 AM, Robert McKay rob...@mckay.com wrote: I don't think Sybil attack is the right term for this.. there is only one IP address.. one identity. The bitcoin protocol is more or less identityless. It's using up lots of network capacity, number of sockets is as pretty

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-28 Thread s7r
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 7/28/2014 5:08 PM, Gregory Maxwell wrote: On Mon, Jul 28, 2014 at 5:31 AM, Robert McKay rob...@mckay.com wrote: I don't think Sybil attack is the right term for this.. there is only one IP address.. one identity. The bitcoin protocol is more

[Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Jeremy
Hey, There is a potential network exploit going on. In the last three days, a node (unnamed) came online and is now processing the most traffic out of any tor node -- and it is mostly plaintext Bitcoin traffic.

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Jeremy
Credit to Anatole Shaw for discovering. On Sun, Jul 27, 2014 at 10:12 PM, Jeremy jlru...@mit.edu wrote: Hey, There is a potential network exploit going on. In the last three days, a node (unnamed) came online and is now processing the most traffic out of any tor node -- and it is mostly

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Gregory Maxwell
On Sun, Jul 27, 2014 at 7:12 PM, Jeremy jlru...@mit.edu wrote: Hey, There is a potential network exploit going on. In the last three days, a node (unnamed) came online and is now processing the most traffic out of any tor node -- and it is mostly plaintext Bitcoin traffic.

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Peter Todd
On Sun, Jul 27, 2014 at 10:12:11PM -0400, Jeremy wrote: Hey, There is a potential network exploit going on. In the last three days, a node (unnamed) came online and is now processing the most traffic out of any tor node -- and it is mostly plaintext Bitcoin traffic.

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Michael Wozniak
It’s in my logs: 2014-07-28 02:00:24 receive version message: /Satoshi:0.9.2/: version 70002, blocks=302684, us=**:8333, them=0.0.0.0:0, peer=5.9.93.101:33928 On Jul 27, 2014, at 10:45 PM, Gregory Maxwell gmaxw...@gmail.com wrote: On Sun, Jul 27, 2014 at 7:40 PM, Peter Todd

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Gregory Maxwell
On Sun, Jul 27, 2014 at 7:40 PM, Peter Todd p...@petertodd.org wrote: Anyway, just goes to show that we need to implement better incoming connection limiting. gmaxwell has a good scheme with interactive proof-of-memory - where's your latest writeup? Or its a complete snipe hunt, I'm unable to

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Gregory Maxwell
On Sun, Jul 27, 2014 at 7:45 PM, Gregory Maxwell gmaxw...@gmail.com wrote: Or its a complete snipe hunt, I'm unable to find any nodes with it connected to them. Does anyone here have any? [unimportant update] Turns out that my IPv4 nodes already have iptables blocking of that subnet, presumably

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Anatole Shaw
It's not quite accurate that the Tor node's throughput is 'mostly' plaintext Bitcoin traffic. The node will only exit bitcoin traffic (or anything else on port 8333) but most of the bandwidth is probably used in being a Tor relay where there can be no port number discrimination. However by

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread m...@bitwatch.co
blockchain.info has some records about the related IP going back to the end of this May: https://blockchain.info/ip-address/5.9.93.101?offset=300 Original Message Subject: Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic From: Michael Wozniak m

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Robert McKay
Here's a packet dump of a connected client: http://wari.mckay.com/~rm/unknown.tcpdump Doesn't seem particularly abusive.. only one connection, not doing much traffic. I don't have any easy way to deserialize this and see if it's doing anything unusual but it's there if someone wants to have a

Re: [Bitcoin-development] Abnormally Large Tor node accepting only Bitcoin traffic

2014-07-27 Thread Gregory Maxwell
On Sun, Jul 27, 2014 at 7:54 PM, m...@bitwatch.co m...@bitwatch.co wrote: These website list Tor nodes by bandwidth: http://torstatus.blutmagie.de/index.php https://torstatus.rueckgr.at/index.php?SR=BandwidthSO=Desc And the details reveal it's a port 8333 only exit node: