6 ms·

The almost willful lack of tradecraft, scale of deployments, small time-frames, and "loudness" of action the highlighted entity displays, combined with the tech

by ajcp 5y ago

The almost willful lack of tradecraft, scale of deployments, small time-frames, and "loudness" of action the highlighted entity displays, combined with the technical knowledge required to take part in this narrow space, suggests that someone is tolerance-checking the system rather than actually seeking to inhabit it. Or they really are just shitty and impatient Russians, I could go either way.

notriddle 5y ago
You're suffering from the Toupée Fallacy. You assume that these people must be intentionally making themselves noticeable, because there's no way the average malicious Tor node operator could be this dumb. But there's no rule saying that these are average malicious exit node operators. They could just be particularly stupid ones. We don't know about the competent ones.
- ajcp 5y ago
  I'm not assuming this actor must be doing this intentionally *because* these are a lot of stupid things, nor that it is indictive of the average, malicious Tor node operator. I'm arguing the opposite. Not only did an actor commit a string of seemingly sloppy and unrelated "mistakes", where they had correctly executed that same things n times before for x amount of time, but they then brought their own existence to the attention of a technically empowered group to see how many of those seemingly unrelated and sloppy mistakes the system tolerates. I'm not sure how this is an example of the "toupée fallacy", as I'm just positing as ti why this toupée would look so intentionally bad; to figure out the tolerance for a bad toupée and discover what about it made the toupée "bad".
makomk 5y ago
The attacks they want to carry out are inherently loud. They're attacking visits to well-known websites at scale in ways that require changing the response returned when visiting those websites in a way that's trivial to detect (the websites should immediately redirect to the SSL version but the attack has to remove that redirect in order to modify the contents in malicious ways, regardless of the exact details of the modification or how sneaky they make it). There's no real way around that. It's easy to just scan the entire exit node list for nodes launching this attack if you know what sites they're targetting.

by ajcp 5y ago

notriddle 5y ago

You're suffering from the Toupée Fallacy. You assume that these people must be intentionally making themselves noticeable, because there's no way the average malicious Tor node operator could be this dumb. But there's no rule saying that these are average malicious exit node operators. They could just be particularly stupid ones. We don't know about the competent ones.

ajcp 5y ago
I'm not assuming this actor must be doing this intentionally *because* these are a lot of stupid things, nor that it is indictive of the average, malicious Tor node operator. I'm arguing the opposite. Not only did an actor commit a string of seemingly sloppy and unrelated "mistakes", where they had correctly executed that same things n times before for x amount of time, but they then brought their own existence to the attention of a technically empowered group to see how many of those seemingly unrelated and sloppy mistakes the system tolerates. I'm not sure how this is an example of the "toupée fallacy", as I'm just positing as ti why this toupée would look so intentionally bad; to figure out the tolerance for a bad toupée and discover what about it made the toupée "bad".

makomk 5y ago

The attacks they want to carry out are inherently loud. They're attacking visits to well-known websites at scale in ways that require changing the response returned when visiting those websites in a way that's trivial to detect (the websites should immediately redirect to the SSL version but the attack has to remove that redirect in order to modify the contents in malicious ways, regardless of the exact details of the modification or how sneaky they make it). There's no real way around that. It's easy to just scan the entire exit node list for nodes launching this attack if you know what sites they're targetting.