3 ms·

Individuals and organizations certainly run malicious exit nodes, but there's literally not a hint of evidence in this post to backup the author's claim that th

Individuals and organizations certainly run malicious exit nodes, but there's literally not a hint of evidence in this post to backup the author's claim that these exit nodes are operated by a single group?

duskwuff 6y ago
The author hasn't laid out all of the evidence in the article, but they mention some of the factors which they probably used to identify the actors involved: 1. Explicit identification. Tor relays, including exit nodes, are identified by contact information. Many of the groups of malicious exit nodes shared contact information. 2. Benign behavioral identification. Many of the identified malicious exit nodes were deployed on the same service providers, including some obscure ones. This isn't a definitive identifier, but it helps link explicitly identified groups. 3. Malicious behavioral identification. Many of the malicious exit nodes were performing similar attacks on outbound traffic, like sslstripping traffic to cryptocurrency web sites. The exact parameters of this behavior (e.g, which sites were targeted, what modifications were made to cleartext data, etc) weren't laid out in the article, but would serve as a highly accurate fingerprint for a specific attacker.
brbsix 6y ago
He's being intentionally vague. The attacker is obviously aware of his posts. If he reveals how he is indentifying the relays, they will change according. If you read between the lines, he gives a few hints with regards to the sslstripping and traffic manipulation on only a limited set of sites. This is from another post @ https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548 https://medium.com/@nusenu/the-growing-problem-of-malicious-...: > In autumn 2019 I stumbled on something odd: Tor relays doing something that the official tor software is unable to do. This is intentionally vague to avoid giving away the detection methodology to the adversary."

duskwuff 6y ago

The author hasn't laid out all of the evidence in the article, but they mention some of the factors which they probably used to identify the actors involved: 1. Explicit identification. Tor relays, including exit nodes, are identified by contact information. Many of the groups of malicious exit nodes shared contact information. 2. Benign behavioral identification. Many of the identified malicious exit nodes were deployed on the same service providers, including some obscure ones. This isn't a definitive identifier, but it helps link explicitly identified groups. 3. Malicious behavioral identification. Many of the malicious exit nodes were performing similar attacks on outbound traffic, like sslstripping traffic to cryptocurrency web sites. The exact parameters of this behavior (e.g, which sites were targeted, what modifications were made to cleartext data, etc) weren't laid out in the article, but would serve as a highly accurate fingerprint for a specific attacker.

brbsix 6y ago

He's being intentionally vague. The attacker is obviously aware of his posts. If he reveals how he is indentifying the relays, they will change according. If you read between the lines, he gives a few hints with regards to the sslstripping and traffic manipulation on only a limited set of sites. This is from another post @ https://medium.com/@nusenu/the-growing-problem-of-malicious-relays-on-the-tor-network-2f14198af548 https://medium.com/@nusenu/the-growing-problem-of-malicious-...: > In autumn 2019 I stumbled on something odd: Tor relays doing something that the official tor software is unable to do. This is intentionally vague to avoid giving away the detection methodology to the adversary."