3 ms·

It’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https. Here’s research

It’s not even about three letter agencies; many exit nodes are being scanned for passwords, if you happen to go through http instead of https. Here’s research conducted years ago about this matter: https://www.vice.com/en/article/mgbdwv/badonion-honeypot-malicious-tor-exit-nodes https://www.vice.com/en/article/mgbdwv/badonion-honeypot-mal... Effectively they set up a honeypot and used clear text passwords to log in, and plenty of exit nodes picked up on this and those credentials were later used to (attempt to) log in into the honeypot.

thealig 5y ago
the article talks about the research stumbling upon exit nodes performing MITM and other sniffing but does not refer to the exact details. is there a paper for this? only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf
- heavyset_go 5y ago
  What research are you talking about? The article talks about at least two different researchers working on separate projects. Here's the link for first one:https://web.archive.org/web/20150705184539/https://chloe.re/2015/06/20/a-month-with-badonions/ https://web.archive.org/web/20150705184539/https://chloe.re/...
  - thealig 5y ago
    well, was referring to the research indicated by the title of the article- honeypot setup to detect malicious exit relays. yes thats the one. interesting, seems they caught 15 unique relays harvesting logins. There seems to be scope to improve reporting and detection of malicious actors like this. They also have a block list on Tor's gitlab repo but doesn't seem to be up to date.
- deleted 5y ago
  [deleted]
- codsane 5y ago
  It’s not related to that particular article, but you might find this interesting, they write about a lot of similar research: https://nusenu.medium.com/tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df https://nusenu.medium.com/tracking-one-year-of-malicious-tor...
conradev 5y ago
I will also point out that even if they are only observing ciphertext, they can still glean a lot: http://web.cs.wpi.edu/~claypool/papers/yt-crawler/final.pdf http://web.cs.wpi.edu/~claypool/papers/yt-crawler/final.pdf

thealig 5y ago

the article talks about the research stumbling upon exit nodes performing MITM and other sniffing but does not refer to the exact details. is there a paper for this? only found this paper going over systematic process of exposing bad relays - http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf http://www.cs.kau.se/philwint/spoiled_onions/pets2014.pdf

heavyset_go 5y ago
What research are you talking about? The article talks about at least two different researchers working on separate projects. Here's the link for first one:https://web.archive.org/web/20150705184539/https://chloe.re/2015/06/20/a-month-with-badonions/ https://web.archive.org/web/20150705184539/https://chloe.re/...
- thealig 5y ago
  well, was referring to the research indicated by the title of the article- honeypot setup to detect malicious exit relays. yes thats the one. interesting, seems they caught 15 unique relays harvesting logins. There seems to be scope to improve reporting and detection of malicious actors like this. They also have a block list on Tor's gitlab repo but doesn't seem to be up to date.
deleted 5y ago
[deleted]
codsane 5y ago
It’s not related to that particular article, but you might find this interesting, they write about a lot of similar research: https://nusenu.medium.com/tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df https://nusenu.medium.com/tracking-one-year-of-malicious-tor...

conradev 5y ago

I will also point out that even if they are only observing ciphertext, they can still glean a lot: http://web.cs.wpi.edu/~claypool/papers/yt-crawler/final.pdf http://web.cs.wpi.edu/~claypool/papers/yt-crawler/final.pdf