Re: another unusual connection

2008-02-11 Thread john smith
just seen Roger's post! gonna try running on Tor 0.2.0.19-alpha On 2/12/08, john smith <[EMAIL PROTECTED]> wrote: > Since my last post I have observed that, in the Tor Network Map > component of Vidalia, the list of relays is no longer being updated. > Currently, the list of relays announces that

Re: another unusual connection

2008-02-11 Thread john smith
Since my last post I have observed that, in the Tor Network Map component of Vidalia, the list of relays is no longer being updated. Currently, the list of relays announces that 400 relays are online (685 total). On another box running Tor as client, I see my relay listed & a much larger number of

another unusual connection

2008-02-11 Thread john smith
On Sun, Feb 10, 2008 at 11:16 PM [EMAIL PROTECTED] wrote: > I do have a question for "John Smith"; are you using a VPN from your > home to your server or from your server to somewhere else? I am not using a VPN Also, another of the same type of connection from earlier today. Now I also notice th

Re: another unusual connection

2008-02-11 Thread Peter Kornherr
Hi, > > However, given the obviously false information being provided by > > anon-tor-proxy.maximator.org (212.112.242.159), could it please be > > flagged as "Invalid" and "Bad Exit" by the directory authorities? oh, no need to flag. There is nothing malicious at maximator. > My guess is t

Re: another unusual connection

2008-02-10 Thread Roger Dingledine
On Fri, Feb 08, 2008 at 02:45:04AM -0600, Scott Bennett wrote: > I've been reading these reports on this list carefully and with growing > alarm. How is it that the reachability testing routine(s) fail to discover > that, upon connecting to the supposed new IP address on whichever TCP port th

Re: another unusual connection

2008-02-10 Thread Roger Dingledine
On Sun, Feb 10, 2008 at 02:10:55AM -0600, Scott Bennett wrote: > However, given the obviously false information being provided by > anon-tor-proxy.maximator.org (212.112.242.159), could it please be > flagged as "Invalid" and "Bad Exit" by the directory authorities? Is it actually being a bad

Re: another unusual connection

2008-02-10 Thread Andrew S. Lists
On Sun, 10 Feb 2008 01:47:01 -0600, Scott Bennett wrote: > But, Roger, will the 0.2.0.19-alpha release at least confirm during > the reachability tests that it is talking to itself and not to some other > server? I am not sure that is what is happening. For example, it may be that the reachab

Re: another unusual connection

2008-02-10 Thread Kyle Williams
john smith wrote: Yet another reoccurrence, yesterday, of the same sequence of events & once again with the same IP address. My server had been running for just under five days since the last time this happened. Feb 07 10:56:59.108 [Notice] Our IP Address has changed from 87.194.38.72 to 212.112

Re: another unusual connection

2008-02-10 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Dominik Schaefer <[EMAIL PROTECTED]> wrote: >> For what it's worth, we (Trend Micro) have identified several Tor >> nodes which have malicious intent -- this one among them. > >Could you give us some more information about this? ;-) I would assum

Re: another unusual connection

2008-02-10 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Scott Bennett <[EMAIL PROTECTED]> wrote: >Is there some reason we should believe that you represent Trend >Micro? Believe what you like. Just trying to be helpful. Cheers, - - ferg -BEGIN PGP SIGNATURE- Version: PGP Desktop 9.6.3 (Bu

Re: another unusual connection

2008-02-10 Thread phobos
On Sun, Feb 10, 2008 at 07:54:06AM +, [EMAIL PROTECTED] wrote 0.8K bytes in 37 lines about: : For what it's worth, we (Trend Micro) have identified several Tor : nodes which have malicious intent -- this one among them. I hear the sky is falling and my milk is going sour because of neutrinos,

Re: another unusual connection

2008-02-10 Thread Dominik Schaefer
Paul Ferguson schrieb: For what it's worth, we (Trend Micro) have identified several Tor nodes which have malicious intent -- this one among them. Could you give us some more information about this? ;-) I would assume, the reported behaviour could be very well caused by some unusually configured

Re: another unusual connection

2008-02-10 Thread Andrew
Paul Ferguson schrieb: For what it's worth, we (Trend Micro) have identified several Tor nodes which have malicious intent -- this one among them. Be very careful. Tor is being actively exploited. - ferg Thanks for the heads up. While the tor community does know, that malicious exit nodes exis

Re: another unusual connection

2008-02-10 Thread Scott Bennett
On Sun, 10 Feb 2008 07:54:06 GMT "Paul Ferguson" <[EMAIL PROTECTED]> wrote: >- -- Scott Bennett <[EMAIL PROTECTED]> wrote: Huh. Nice of you to delete the attribution to Roger Dingledine. > = > >> >> $ telnet 212.112.242.159 80 >> Trying 212.112.242.159... >> Connected to 212.112.242.

Re: another unusual connection

2008-02-09 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Scott Bennett <[EMAIL PROTECTED]> wrote: > > $ telnet 212.112.242.159 80 > Trying 212.112.242.159... > Connected to 212.112.242.159. > Escape character is '^]'. > GET /tor/ HTTP/1.0 > For what it's worth, we (Trend Micro) have identified s

Re: another unusual connection

2008-02-09 Thread Scott Bennett
On Sat, 9 Feb 2008 10:39:46 -0500 Roger Dingledine <[EMAIL PROTECTED]> wrote: >On Sun, Jan 27, 2008 at 10:33:43PM -0500, Roger Dingledine wrote: >> New theory: in rare cases, Tor servers (like maximator) lie to directory >> clients about what IP address they appear to have, due to iptables >>

Re: another unusual connection

2008-02-09 Thread Roger Dingledine
On Sun, Jan 27, 2008 at 10:33:43PM -0500, Roger Dingledine wrote: > New theory: in rare cases, Tor servers (like maximator) lie to directory > clients about what IP address they appear to have, due to iptables > confusion or something similar. More specifically, it claims that > everybody looks lik

another unusual connection

2008-02-08 Thread john smith
Yet another reoccurrence, yesterday, of the same sequence of events & once again with the same IP address. My server had been running for just under five days since the last time this happened. Feb 07 10:56:59.108 [Notice] Our IP Address has changed from 87.194.38.72 to 212.112.242.159; rebuilding

Re: another unusual connection

2008-02-08 Thread Scott Bennett
On Fri, 08 Feb 2008 09:32:29 +0100 Dominik Schaefer <[EMAIL PROTECTED]> wrote: >I just read the logs from yesterday: > >Feb 07 14:12:49.069 [Hinweis] Our IP Address has changed from 78.49.3.182 to >212.112.242.159; rebuilding descriptor. >Feb 07 14:12:59.749 [Hinweis] Self-testing indicates yo

Re: another unusual connection

2008-02-08 Thread Dominik Schaefer
I just read the logs from yesterday: Feb 07 14:12:49.069 [Hinweis] Our IP Address has changed from 78.49.3.182 to 212.112.242.159; rebuilding descriptor. Feb 07 14:12:59.749 [Hinweis] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Feb 07

Re: another unusual connection

2008-02-02 Thread john smith
greetings! same sequence of events, same IP address. my relay had been running for just under 5 days. no other activity on the connection or on the box running the relay. Feb 02 17:16:49.093 [Notice] Our IP Address has changed from 87.194.38.72 to 212.112.242.159; rebuilding descriptor. Feb 02

another unusual connection

2008-01-28 Thread john smith
on Mon, Jan 28, 2008 at 3:33 AM Roger Dingledine wrote: > Neat. So it was 212.112.242.159 in both cases? yes > Please let me know if it happens more (or if other people experience it > and can provide more details!), and maybe we'll narrow in further. will do. if there's anything i can do to pr

Re: another unusual connection

2008-01-27 Thread Roger Dingledine
On Sun, Jan 27, 2008 at 10:42:14PM +, john smith wrote: > another recurrence of the same type of unusual connection. > i include the time the server started in the log below. the connection > through 212.112.242.159 persists for a much longer period of time on > this occassion (the 'scrubbed' c

another unusual connection

2008-01-27 Thread john smith
greetings! another recurrence of the same type of unusual connection. i include the time the server started in the log below. the connection through 212.112.242.159 persists for a much longer period of time on this occassion (the 'scrubbed' connection did not occur last time). Jan 27 16:25:40.562