Category Archives: Cyber Infrastructure

06/18/13

Weaponize the Tor Network:

weaponizing-the-web1-720x2808

Weaponize the Web

prism-01

if you got nothing to hide – you got nothing to worry about

 gAtO wAs - asked the Tor-Network is slow as heck, does not support sending outgoing email and does not support UDP packets of the TCP/IP protocol, so can it be weaponized? Maybe monitoring the Tor-Network like Prism and Nucleon or the Japan based Daedalus Monitoring program at the very least?

Data collection in Tor:

I guess this all depends on your definition of what a weaponize cyber weapon is-///-IP theft- here we have a vast collection of both /IP-(intellectual Property) and /copyright – /hacking /sql-i in Tor// -.- /hacktivism -how about /personal privacy online-collection of all internet transaction and data sharing with Google, Facebook, Microsoft and others— /government censorship of it’s people /Worldwide Internet monitoring-///  Like a room 641a for Tor only traffic.

prism-03

Daedalus Monitoring program

Mix a little more counter-offensive cyber class weapons like Stuxnet, Flame and DuKu – add a bit of misinformation and propaganda to the mix and we have a better question.

Next we have a more military type cyber weaponized solution. Control Drones planes in Tor -another one is dDos, attacks on the electric grid or sabotage satellites. Cyber attacks like power outage, hacking attacks on cell phones and wall street computers and add traffic lights and traffic in the northeast going wacko. Like they say trains, planes and automobiles are all connected to cyberspace from China to Canada… prism-02

Tor can also be used in all the above scenario- Yes big brother/sister it can. So the answer is Yes, but Tor is not the pony network that can do this work. There are other kinds of anonymized networks that can be used, and with your own relays all over the world you can create your own Tor-private network that only you use so it will be faster and side nobody can see it – well Tor is not the only network one to watch for cyber weaponized products - gAtO oUt

 

 

 

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2013/06/weaponizing-the-web1-720x2808.jpgDigg ThisSubmit to reddit
06/16/13

Mapping Tor Relays

gAtO- been working on Mapping Tor-OR and here is some fun stuff – just got o – https://maps.google.com – google maps – the for location type this in -http://uscyberlabs.com/tormap.kml  – or the .kml file will load Google Earth to- Google Maps – or Google Earth – your flavor..// tor-map-01

You may need to reload it or hit the return a few times but you should get a big map of the world with Tor OR all over the place – This is a static view 2013-04-01 14:57:00 MET – I have a nice automated code that can produce this anytime with whatever the consensus document in Tor gives me. This is a good little tool to have and monitor all known Tor OR-relays.

tor_2010

Biggest Growth Tor OR Usage Washington-DC 2011-2013 

I found some mapping code from 2011 Tor-OR that shows all 900 OR-(2011)  in Tor at that time (currently – 3798 OR-relays june-2013) . Then I got a hold of some code that get’s me all OR-relays 2013. When I compared them both my biggest shock was the number of OR-relays in Washington, DC area shows the biggest growth (2011- 2013)  of OR-relays  on the To network.

 

So tell me why the US government seems to be the biggest user of Tor??? We did hear that The NSA Shroden guy had 2 stickers on his laptop computer – yeah the one with all the secret he got from the NSA – Sticker 1 – EFF 2 – Tor… does NSA use Tor?? it’s contractors do I guess….ummmmm

tor_2013

Last year we where running about 3,000 Tor-OR this year so far we have another 500 more OR bringing us up to 3,500 OR we have also increased the Authority-Directory servers to 10 from 8 that’s a good thing. Anyway here are some statistics from the last few days - gAtO oUt

 

Tor Network - Total Number of Routers: 3426 100%
Routers in Current Query Result Set: 3416 99.71%
Total Number of ‘Authority’ Routers: 10 0.29%
Total Number of ‘Bad Directory’ Routers: 0 0%
Total Number of ‘Bad Exit’ Routers: 2 0.06%
Total Number of ‘Exit’ Routers: 875 25.54%
Total Number of ‘Fast’ Routers: 3015 88%
Total Number of ‘Guard’ Routers: 1154 33.68%
Total Number of ‘Hibernating’ Routers: 1 0.03%
Total Number of ‘Named’ Routers: 2164 63.16%
Total Number of ‘Stable’ Routers: 2311 67.45%
Total Number of ‘Running’ Routers: 3426 100%
Total Number of ‘Valid’ Routers: 3426 100%
Total Number of ‘V2Dir’ Routers: 2087 60.92%
Total Number of ‘Directory Mirror’ Routers: 2087 60.92%

2013-04-01 14:57:00 MET

Mapping Tor OR – we will be doing more Tor-mapping project that will make things funs with Google-Maps – gAtO oUt

Tor Logs:- jun 16-1213

 

——————————————————————————————

Tor network - Application Server Details
Cache Last Updated (Local Server Time): 2013-06-16 14:57:00 MET
Last Update Cycle Processing Time (Seconds): 646
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3798
Number of Descriptors In Cache: 9172
Approximate Page Generation Time (Seconds): 0.0137
Aggregate Network Statistic Summary | Total Number of Routers:
Total Bandwidth of displayed Routers [KBytes/s]: 2572613
Total Number of Routers: 3798 100%
Routers in Current Query Result Set: 3796 99.95%
Total Number of ‘Authority’ Routers: 10 0.26%
Total Number of ‘Bad Directory’ Routers: 0 0%
Total Number of ‘Bad Exit’ Routers: 1 0.03%
Total Number of ‘Exit’ Routers: 894 23.54%
Total Number of ‘Fast’ Routers: 3303 86.97%
Total Number of ‘Guard’ Routers: 1228 32.33%
Total Number of ‘Hibernating’ Routers: 0 0%
Total Number of ‘Named’ Routers: 2244 59.08%
Total Number of ‘Stable’ Routers: 2363 62.22%
Total Number of ‘Running’ Routers: 3798 100%
Total Number of ‘Valid’ Routers: 3798 100%
Total Number of ‘V2Dir’ Routers: 2342 61.66%
Total Number of ‘Directory Mirror’ Routers: 2342 61.66%

——————————————————————————————

Tor Network - Application Server Details
Cache Last Updated (Local Server Time): 2013-06-07 22:02:39 MET
Last Update Cycle Processing Time (Seconds): 477
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3546
Number of Descriptors In Cache: 6712
Approximate Page Generation Time (Seconds): 0.0099

 

Aggregate Network Statistic Summary |
Total Bandwidth of displayed Routers [KBytes/s]: 2434525
Total Number of Routers: 3546 100%
Routers in Current Query Result Set: 3544 99.94%
Total Number of ‘Authority’ Routers: 10 0.28%
Total Number of ‘Bad Directory’ Routers: 0 0%
Total Number of ‘Bad Exit’ Routers: 2 0.06%
Total Number of ‘Exit’ Routers: 848 23.91%
Total Number of ‘Fast’ Routers: 3076 86.75%
Total Number of ‘Guard’ Routers: 1217 34.32%
Total Number of ‘Hibernating’ Routers: 1 0.03%
Total Number of ‘Named’ Routers: 2228 62.83%
Total Number of ‘Stable’ Routers: 2336 65.88%
Total Number of ‘Running’ Routers: 3546 100%
Total Number of ‘Valid’ Routers: 3546 100%
Total Number of ‘V2Dir’ Routers: 2131 60.1%
Total Number of ‘Directory Mirror’ Routers: 2131 60.1%

——————————————————————————————

Tor Network - Application Server Details
Cache Last Updated (Local Server Time): 2013-06-06 13:29:39 MET
Last Update Cycle Processing Time (Seconds): 539
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3502
Number of Descriptors In Cache: 6383
Approximate Page Generation Time (Seconds): 0.0084

 

Aggregate Network Statistic Summary |
Total Bandwidth of displayed Routers [KBytes/s]: 2474946
Total Number of Routers: 3502 100%
Routers in Current Query Result Set: 3501 99.97%
Total Number of ‘Authority’ Routers: 10 0.29%
Total Number of ‘Bad Directory’ Routers: 0 0%
Total Number of ‘Bad Exit’ Routers: 0 0%
Total Number of ‘Exit’ Routers: 849 24.24%
Total Number of ‘Fast’ Routers: 3049 87.06%
Total Number of ‘Guard’ Routers: 1201 34.29%
Total Number of ‘Hibernating’ Routers: 0 0%
Total Number of ‘Named’ Routers: 2225 63.54%
Total Number of ‘Stable’ Routers: 2355 67.25%
Total Number of ‘Running’ Routers: 3502 100%
Total Number of ‘Valid’ Routers: 3502 100%
Total Number of ‘V2Dir’ Routers: 2112 60.31%
Total Number of ‘Directory Mirror’ Routers: 2112 60.31%

——————————————————————————————

Tor network -Application Server Details
Cache Last Updated (Local Server Time): 2013-06-05 16:06:50 MET
Last Update Cycle Processing Time (Seconds): 582
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3534
Number of Descriptors In Cache: 6168
Approximate Page Generation Time (Seconds): 0.0098

 

Aggregate Network Statistic Summary | 
Total Bandwidth of displayed Routers [KBytes/s]: 2572752
Total Number of Routers: 3534 100%
Routers in Current Query Result Set: 3532 99.94%
Total Number of ‘Authority’ Routers: 10 0.28%
Total Number of ‘Bad Directory’ Routers: 0 0%
Total Number of ‘Bad Exit’ Routers: 0 0%
Total Number of ‘Exit’ Routers: 851 24.08%
Total Number of ‘Fast’ Routers: 3088 87.38%
Total Number of ‘Guard’ Routers: 1210 34.24%
Total Number of ‘Hibernating’ Routers: 0 0%
Total Number of ‘Named’ Routers: 2230 63.1%
Total Number of ‘Stable’ Routers: 2363 66.86%
Total Number of ‘Running’ Routers: 3534 100%
Total Number of ‘Valid’ Routers: 3534 100%
Total Number of ‘V2Dir’ Routers: 2123 60.07%
Total Number of ‘Directory Mirror’ Routers: 2123 60.07%

——————————————————————————————

 

Tor network -Application Server Details
Cache Last Updated (Local Server Time): 2013-06-04 02:11:43 MET
Last Update Cycle Processing Time (Seconds): 553
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3599
Number of Descriptors In Cache: 5817
Approximate Page Generation Time (Seconds): 0.01

——————————————————————————————

 

Tor network -Application Server Details
Cache Last Updated (Local Server Time): 2013-05-29 23:19:07 MET
Last Update Cycle Processing Time (Seconds): 645
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3582
Number of Descriptors In Cache: 16099
Approximate Page Generation Time (Seconds): 0.1987

——————————————————————————————

——————————————————————————————

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2013/04/tor-map-01.pngDigg ThisSubmit to reddit
06/11/13

Stopping Pedophile websites in Tor

gAtO-nOtEs- Stopping Pedophile websites in Tor 4 LE

Dark web drugs site Silk Road knocked offline by hacker - http://www.bbc.co.uk/news/technology-22381046

From the IEEE report about “Trawling for Hidden Service” they explain as any network person knows that it take little more overhead to make a Tor connection than a regular Internet connection. (SSL-connections) That Tor-Relay will have to work harder and as more and more connections are made, Just like a DdoS attack but with a simple crawler we can bring down any Tor-Website from communicating with any new clients. The Tor-network has no load balance.

So a simple crawler looking for URL’s doing it’s work to gather information for a Tor search engine- Like I have – could accidentally play havoc on a Tor-websites -entry-relay —even silk road // no way pedro // so if we use enough of these crawlers we can stop people from getting to the website and they will have no clients.

Example for Law Enforcement:

Natural Spanking Website is Tor website- They have over 13,000 URL on their website – so that’s 13,000 pages of pedophile crap.  If we launch 8 crawlers from different places to crawl this site’s 13,000 pages again and again and again – all at the same time coming from different directions. Tor has no load balance so the websites Guard-relays cannot keep all these connections up. The (-combine crawlers coming all at the same time-from all over the world ) will prevent new clients accessing the site. The site will be un-reachable. You know what Amazon ec2 VPS server would be a great choice for this test.

If we do this for about 2-3 weeks – the word will go out that the site is down – The site will have to deploy and advertise new URL’S. if we also plan a campaign of propaganda news-feeds about that website and spread it on Twitter and get all the groups that hate pedophiles (anonymous and other groups). We can bring down any pedophile site this way.

But that’s a lot of work for any Law enforcement agency, but maybe not.01_29_tdp_xx

IEEE 2013 -Trawling for Tor- Hidden Service - http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf

From this paper we find new ways to go after the websites and find the IP and geo-location, we can take over the entry-guard-relays and get statistics and usage and maybe clients of the website.

  •  We have a way to get Tor-Websites stats- we have a method to measure the popularity of any hidden service without the consent of the hidden service operator.
  • We will work on this way of stopping a Tor-website form operating -We show how connectivity to selected hidden services can be denied by impersonating all of their responsible hidden services directories.
  • We will demonstrate a technique that allows one to harvest hidden service descriptors (and thus get a global picture of all hidden services in Tor) in approximately 2 days using only a modest amount of resources.
  • We show how to reveal the guard nodes of a Tor hidden service.
  • Harvest all known Tor-hiddens service-websites.
  • We propose a large-scale opportunistic deanonymization attack, capable of revealing IP addresses of a significant fraction of Tor’s hidden services over a one year period of time.

Of course going after a website like this is only allowed by Law Enforcement - gAtO oUt

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2012/04/01_29_tdp_xx-300x231.pngDigg ThisSubmit to reddit
06/6/13

Tor friendly ISP

gAtO FoUnD this- an wanted to share- When you work with Tor servers you need a good ISP behind you – my last ISP inMotion just locked out my site and email and file access – unless I upgraded – This was because of Tor- traffic to my site. So if your site get users from Tor- do NOT us InMotion they SUCK-tor_2013

We are in the process of deploying Tor-OR-relays to help the Tor-network and help us in our research. No we will not run exit-relays – too many problems-/ but it would be nice since the government loves exitNodes so they can monitor traffic. Washington, DC area loves Tor – ummmmm wonder why.    Biggest Tor-relay Growth Tor Usage Washington-DC 

This page aims to list community experiences with Tor and various Internet Service Providers (ISPs) around the world. Some ISPs are Tor-friendly, some are not. Some are competent and clueful about Tor or about security in general. Let us know!

Be sure to provide useful information like how much bandwidth you pushed, whether you thought the deal was cheap or expensive, how hard you had to work to make them understand what’s going on, how long your server has been running, and whether you’d recommend them to others. Also include dates. – gAtO oUt

Good experiences

US

  •  Amazon Web Services (AWS) (hosting) allows customers to run any type of Tor servers provided abuse complaints are handled in a timely manner. It makes sense why  Tor Cloud is run off of AWS.
  •  Axigy is a superb Tor hoster. Handles abuse perfectly. Ask for custom quote.
  •  Blacklotus allows Tor exits and has (quote management) “pretty liberal abuse handling policies”
  •  Binary CPU allows Tor nodes. I got a promotional unmetered package and been hosting an exit relay since January 2012. – December 2012: Sadly everything has come to an end, I guess. Binary CPU has discontinued their VPS services so there goes my fast exit node :(
  •  BuyVM.net Low cost and “good” bandwidth limit. Section 5.2 of their  Acceptable Use Policy state that any Tor services is fine as long as your (the user) personal information is registered to the IP you have in the ARIN database (SWIP). This requires the user to purchase at least an IPv4 /29 (6 IPs). (IPv6 only relay _could_ not require to purchase that. Answer is pending with an open ticket at buyvm.net).
  •  ChunkHost Good bandwidth, great uptime, excellent support, all around excellent VPS provider. However they questionable policies about TOR. They received one DMCA notice and despite the standard response, tell me VPS will be disable with one more notification. Still working this out. -hRB Jan/2012
  •  Team Cinipac Team Cinipac “allow on all server locations services like Tor/VPN/I2P because we are supporting projects who safe the privacy like wikileaks, Tor etc. We stand behind our customer and abuse will be forwarded to you to take action. If you have problems, need help etc. just only contact our Abuse/Law Department they will help you in this case. We do not provide any kind of information to third parties. Our company locate in Panama and we ignore court orders from other countries, because we think privacy is an human right.”
  •  Cyberonic is now on the COVAD backbone, so you should be able to get service from them anywhere you could get other COVAD-based service. They offer 6.0m/768kbps at $59/month, w/ a static IP. Can’t recall ever having downtime due to them and their TOS only restrict Email relay servers (and that’s probably only enforced if you have complaints). All other servers ok. If you sign up, tell ‘em brianwc sent you and I think I get a free month. — BrianC
  •  Ethr.net is a Tor-friendly ISP that already has a 20Mbit Tor Exit Node hosted there. Their services are a bit pricey, but they have excellent peering, and offer a “Cheap-Net” option to give you he.net bandwidth at a little less than half of their listed prices (~$20/Mbit).
  •  Evolucix is a low cost VPS provider. They offer TUN/TAP extensions on top of OpenVZ to provide VPN capabilities. They are fine with bridges and relays but due to the US regulations running exit nodes can be tricky. Great service from my experience.
  •  HostGator allowed Tor on VPS and Dedicated at least last year (2011), however you might want to check if this policy still applies. Their phone and live chat support is on 24/7. Hosted an exit relay for a couple of months. I discontinued my VPS because of the heavy price (still a great host though).
  • RoadRunner (TimeWarner) (USA): Very reliable service. Been running web server on 80 for several years. IP changes when cable modem reset (almost never for me). No ports blocked (that I know of). No BW limits, only speed caps. I’ve got 5Mbps down/384kbps up. Definitely recommend. Running Tor since Jan 06. — MichaelAnsel
  •  Softlayer allows for customized WHOIS, reverse DNS from their portal, and they are an utility provider. They have dedicated servers and cloud instances (Hourly or monthly billed). They come with 3,000 GB bandwidth standard, if you get a dedicated box. You can pick Dallas, Seattle, Washington D.C., and San Jose for server locations. By the end of the year (2011), you will also be able to run nodes in Europe and Asia as well. You may remember these guys: ThePlanet.com merged with SoftLayer in late 2010.
  •  Speakeasy (merged with  Covad and  Megapath in 2010) allows users to run arbitrary servers without port or traffic volume restrictions. Static IP addresses are offered without question or complaint.
  •  Slicehost/Rackspace (a hosting provider, not an ISP) allows running Tor on their servers, but if anybody downloads copyrighted material illegally through Tor, that’s a ToS violation. I had an issue with a DMCA (copyright violation) notice triggered by Tor activity exiting through my server, and I had to agree to block the port on which the material was downloaded for them to let me continue running the exit relay. Setting an ExitPolicy that only allows certain ports is probably smart if you don’t want to get into trouble. Otherwise, the service is great; each server gets guaranteed 10 Mbps, and the network has never been down in the 6 months I’ve been a customer. Plans start at US $20/month, reasonably cheap as these things go. Update: 3 March 2010: Approach with caution. I’d love to move my exit node to Slicehost, but after trading several e-mails with a Greg in technical support, I could not get a straight answer about whether Tor complies with the company’s AUP. Greg’s response when pushed: “Again, we do not recommend this service to be run on our platform. If you have any other questions, please let us know.” — EricB
  •  Sh3lls says their dedicated servers can be used for anything legal, as long as the customer handles abuse they’re fine
  •  Tailored VPS has a  blog post about hosting Tor relays so I assumed they allow hosting one. Been their member since late January 2012. Good experience so far. -> I can confirm they are quite tor-tolerant (even exit nodes). They ask you to deal with the abuse letters they forward you, and may ask to add an exit policy to the “victim”‘s IP as a precaution. Not the cheapest, but they play nice with Tor relays.
  •  VPS6.NET Tor initially allowed. Been hosting for an exit a couple of days there (also very nice support team!). – December 2012: They are now more strict about Tor. Middle nodes should be fine. However, if planning to host an exit, you might want to check if your desired exit policy is fine with them.
  •  VPSWebServer.com Windows VPS provider who allows to install Tor on their VPS Servers. I’m their customer for few months and ask them to install Tor and get positive answer. They allow to install all applications which are legal and don’t abuse others. Also when you make order you will get dedicated IP address. Also their support is full managed who always help to solve your problem’s and issue’s.
  •  ServerAxis Low-cost VPS provider offering both metered and un-metered (100Mb/s) plans. I’ve been a customer since mid-2012 and have run a bridge node the entire time without incident. The infrastructure seems solid, I’ve had no downtime. Low-end metered plans come with 1TB/mo data transfer allocation and $0.01/GB after that. Their AUP does not explicitly disallow Tor.

Austria

  •  EDIS GmbH (Hosting) allows Tor Exits and other nodes on dedicated servers (not virtual), Abuse will be forwarded. – please contact me personally (william A/T edis.at) before setting it up so i can mark the account in our backend as proxy/VPN (which means we forward the abuse and dont bother reading it + giving more time to react to it). IP will be nullrouted at Incoming DDoS. Please block common Torrent ports (since we dont want to deal with copyright abuse which is *VERY* annoying in Austria), IRC allowed. Client data will only be forwarded at subpoena from an Austrian court (or acknowledged from an Austrian court if it is foreign). *torexit* or similar reverse DNS can be forced at our discretion (unlikely). SWIP of IPs possible (25EUR onetime for a 4 IP subnet on your data + 1,5EUR per IP per month). (william, 12/2011)
  •  InterneX GmbH (Hosting) seems not to care about Tor nodes, likely mainly because their upstream/IP provider does not (see next ISP, UPC). Rather cheap VPS but openVZ based with low limits on connections. (william, 12/2011)
  •  UPC Austria GmbH (ISP) does not care what their customers do at all (unless you have a business connection), Cheap 100Mbit (down) 10Mbit (Up) connections (59EUR with VAT). (william, 12/2011)
  •  Silver Server GmbH Forwards abuse. Hosts already some big exit/entry nodes which seem to have no problems. Very expensive traffic. (william, 12/2011)
  •  Tele2 Austria GmbH Forwards abuse at business connections, good quality traffic, does not like “proxys” on private lines. Cheap synchronous (SDSL) connections. (william, 12/2011)
  •  A1 (former Telekom Austria) Does not like Abuse (in any form) at all. Seems to give out customer data at alleged abuse. Not recommended but cheap. (william, 12/2011)
  •  xpirio GmbH in general rather relaxed at all services, but better get in touch with their (very understanding) support when you expect abuse. (william, 12/2011)

Germany

  •  netcup GmbH allows hosting and does not restrict any TOR services at all but everybody should be aware that there can be huge legal consequences if laws are broken. I received this statement from the CEO Mr. Dipl.Ing. Felix Preuss today via mail (goose, 07.11.11)

Me and a friend hosted TOR both on our own netcup server a year ago, and the consequences were fatal! They wanted more than 350 EUR for a special effort (disable my and my friends server). We responded with the official EFF statement about TOR. No response from netcup. 1. dun, 2. dun. We went to a lawyer. He wrote them. No response from netcup. 1. collection agency, 2. collection agency. Lawyer responded to them and to netcup. No response from netcup. Finally they gave up. But they NEVER responded to any action me or my friend took. I wouldn’t recommend netcup as a TOR friendly provider. NEVER!

I also had a _terrible_ experience with netcup:

 

The service in it self was not very good. Being artificially limited to 400KB/s is extremely bad, especially when bandwidth was supposedly ‘free’.

 

Inability to cancel something via the internet that I was able to order via the internet. How can I legally enter an agreement over the internet but not exit an agreement? That is ludicrous.

  •  Weesly is very liberal and allows hosting Tor in any kind. Statement in German: “Bei mir kann man alles machen was nicht gegen das deutsche Recht verstößt”, in English: “With me you can do anything that does not violates German laws” (q23p, 10.06.11)

Note that you should let them know about your intention when ordering a server or in advance. (ch, 06/2013)

  • Although its located in the Netherlands, Germans could try Leaseweb. They’re hosting more than one *big* Tor-server and are quite tolerant. (anonym, 4/2010)
  • EUServ seems to be a good ISP for Tor (see what they think  here). They have a bad support, but if you know how to maintain your server, this ISP is a good choice. –JensKubieziel? ( http://identi.ca/notice/15888906)
  • IPX-Server.de (DE) has generous traffic limits (there are contracts including 1TB/Mo) and behaves as I’d expect it from good partners. Some BSA-notice regarding Torrents arrived, they informed me and told me to stop this “illegal activities” and said, after reading and (at least it seems so) understanding my reply explaining Tor with “ok, we won’t interfere, your problem”.
  • HostEurope: “generell schränken wir die Nutzung nur bei IRC-Diensten ein. TOR-Server können grundsätzlich betrieben werden. Allerdings müssen wir eventuell auftretende Beschwerden dennoch an Sie weiterleiten. Vor allem wenn der Server als Exit-Node fungiert ist es wahrscheinlich dass Beschwerden eingehen werden.” I’ve had a contradicting answer a few days later: “Leider müssen wir Ihnen mitteilen, dass wir aufgrund interner Richtlinien das Hosting für Ihre gewünschten Zwecke ablehnen müssen.”

 

I had a positive answer again (regarding running TOR on a VPS): “TOR services are allowed, as long as the load on the host system is not getting too big.” (1/2012) (but note that numtcpsock are set very low (550) on their VPS)

  •  http://www.keyweb.de/ offers cheap and reliable Virtuals Servers with 2GB HDD-space and liberal policies. The cheapest VPS is around 8 Euros. Not useful for high traffic nodes, they limit heavily after 5TB
  •  Afterburst (formerly Fanatical VPS) provides unmetered VPS on 1000mbps line. Fair usage applies. Quoting Nick from the team: “Yes hosting tor relays is allowed, however depending on the VPS you choose you’ll probably want to enforce a speed limit”. The Micro package fair usage is 1-2mbit a second which I gladly honor. Been hosting an exit relay since November 2011.
  • I’ve asked their support and I got a negative answer (4/2012): “We used to allow Tor on our nodes, but unfortunately we have had some issues with our datacenter (Hetzner) in terms of AUP and such. Sorry but we cannot allow anything tor-related anymore.”
  • That’s sad but understandable. This policy likely means “no new Tor relays”. I had some problems with abuse this month (5/2012), and they said it’s fine for now but if they see too much abuse they would ask me to switch to a non-exit node. Still counts as a good experience as Nick seems to be very understanding of Tor.
  • No longer allows exits at all. Middle relays are fine.
  • Tried to sign up for VPS for non tor related purpose, was informed that when doing a “fraud check”, they found my email associated with Tor. I asked for a refund.
  •  Server4You (Germany, part of  Intergenia AG) hasn’t complained about a Tor server (running on a non-virtual server) pushing 300GB/month for more than two years. They only block incoming port 6667. They are hosting more than a dozen Tor servers. — SvenNeuhaus (2008/01)

Server4You limits on virtual servers are ridiculous, actually. numtcpsock 288, tcpsndbuf/tcprcvbuf 3598712, lots of failcnt. Can’t use them with Tor. [2010/02]

I’ve asked Server4You support and they state servers with complaints about Tor will be canceled immediately (see the quote in the “Bad Experience” section)

United Kingdom

  •  Clustered.net has nothing against Tor nodes in principle, but warned that they’d asked me to stop if a large number of abuse reports were received. My fast/stable exit node’s been running there for three months now with no hassle.
  •  Gigatux has graciously allowed me to run a Tor relay for over a year and a half with no problems. They actually run their own relay named ‘gigatux’. Customer support has been very good as well, and they have helped me handle two abuse complaints admirably. They also offer servers in the US, Germany, and Israel. -Blackpaw
  •  Bitfolk allows Tor exits and relays. They are very knowledgable and understand Tor and its uses. They are hot on spam and abuse so advise changing the default exit (good idea in the UK anyhow). Any DMCA notices received were simply forwarded on without agro.

Finland

  • TeliaSonera Finland: Largest ISP in Finland. I’ve been running Tor node on 8/1 ADSL with semipermanent IP address (changes rarely). ISP has not interfered in anyway. They block only port 25. In the future TSF may activate “black lists” based on DSN (sorry effort to “fight kiddied porn). 60+ kBps continuosly. — JussiSavola

Iceland

  •  1984Hosting Has no problems with Tor, asked directly and was told they are fine with them. Fairly cheap as well. –Maquis196
  •  FlokiNET Privacy Hoster – TOR Nodes are welcome

Italy

  •  Prometeus Middle relays are fine, exits are forbidden by TOS. “A relay only Tor node or similar software which only allows traffic to other nodes is OK. For example, Freenet is allowed.”

Netherlands

  • John Brooks  runs a 2TB node at  LeaseWeb. He would recommend them for running a relay. — JensKubieziel.  In a mail to Tor-talk, a LeaseWeb employee (Alex de Joode) offered his help to sort out complaints regarding Tor.
  •  Ecatel explicitly allows Tor exit nodes and forwards abuse/DCMA, but their network isn’t the most stable. You need to email them for a custom offer. They also accept UKash/CashU.
  •  Netrouting has no problems with Tor
  •  DirectVPS has no problems with Tor
  •  Versio has no problems with Tor
  •  NForce has no problems with Tor

Norway

  • NextGentel (Norway): Allows Tor-servers. Assists Norwegian secret police in doing total surveillance of customers they torture for sharing their opinion without warrant or even a reason.

Sweden

  • TeliaSonera is also big in Sweden and deliver where other ISPs can’t (They were previously the state monopoly, which they still are, but they now pretend it’s free competition while they still own all the fiber). Blocks port 25 for all customers. Does not bother Tor-server operators.
  •  PRQ has no problems with Tor exits and abuse forwarding, but at a heavy price…

Canada

  •  TekSavvy has a server-friendly Internet Use Policy (e.g., running a Tor relay) and has taken a stand in favor of net neutrality. (2008-12)

Slovenia

  • With  Tuš Hosting we had really good experience running a 5 MB/s full-exit Tor on a dedicated server on colocation. They said that they care just that we pay our bills and they just simply forward DMCA notices to us to handle (or ignore) them and forward police to our home doors to question us. I really recommend them and if anybody wants to put another Tor node/server there I am willing to help. Mitar (mitar@…)

Ukraine

New Zealand and Australia

  •  http://rimuhosting.com/index.jsp Quite open to the proposition when approached. Have servers in N.Z.; Sydney; London; and Dallas. Locations may vary, but quite happy with the specific Oz/NZ query. No co-lo, but root access. “You can run anything you like, as long as it’s legal.” The moving goal-posts of legality are the only concern here.

Bad experience

US

  •  Ezzi.net. Running Tor was fine until Undernet mailed Ezzi.net a complaint which falsely claimed Tor was somehow a “botnet”. This made a  very rude person at Ezzi send a mail which falsely claimed the Tor servers were hacked and “It appears whoever caused this hacked the servers by brute forcing SSH logins and uploading a fake httpd binary and launching it.”. This person kept on insisting the servers were hacked after being politely informed that Undernet had confused Tor traffic with a “botnet” and that the servers where not compromised in any way, so it’s kind of hard to tell if the person was troublesome because the person did not understand what Tor is or if this person at Ezzi generally just imagines things and think they are part of reality. But it is clear that most ezzi customers  become ex-customers after meeting this known-to-be-rude tech.
  •  LayeredTech are a server hosting company located in Texas. I ran a server for six months without any issues, but then someone used the Tor server to exploit a PHP vulnerability. Explaining the goals of Tor to LayeredTech resulted in it being made clear that I was responsible for any and all abuse through my IP address. Shortly after this they ordered me to shutdown Tor. — Steve_Crook
  •  SONIC.NET of Santa Rosa, CA have terms of service that would apparently be Tor-friendly; but this thread http://www.dslreports.com/forum/remark,15272743 includes comments by SONIC.NET’s CEO that don’t sound particularly friendly or open to the idea of running an exit node.
  •  Linode will require you to shut down an exit node if it receives repeated abuse complaints. Non-exit relays are allowed.
  •  Tektonic will suspend your VPS with no prior notice if you run “any proxy”. They used to tolerate Tor if you didn’t run an exit node but they are now apparently auditing the VPSs for processes named Tor. They did however restore the VPS very promptly after I promised to uninstall Tor and Privoxy.
  • Comcast’s  Acceptable Use Policy for residential customers says no servers or proxies under “Technical Restrictions” (2009-08-10 tip from Scott Bennett).
  •  100tb.com (Softlayer) allows Tor exits, abuse needs to be addressed within 24 hours. Despite this “policy”, my experience was bad. They were very understanding at first when the exit was just made and got about 5 DMCA notices, and replied explaining Tor. A few days later, I got forwarded about 30 DMCAs, and few from Spamcop (even though common mail ports were blocked); as usual, I replied that it’s entirely because of Tor, and that I have no pirated content or viruses on my box. Apparently they got fed up with the constant DMCAs, and replied with “More will need to be done to block this. We will not tolerate open abuse of our network (DMCAs and SPAM via a “Tor Exit Node”). This type of service is prone to abuse and tarnishes not only our reputation but your reputation with us. If action is not taken to help prevent this going forward we will be forced to block access to the server”. At this point, I set it as a “middleman” instead of an exit, in hopes that it would stop the flow of DMCA notices. Nope, they disabled the interface. I have at this point stopped Tor on the 100tb box, and do not know what to do now. There is no way at all to block all P2P, and 100tb refuses to acknowledge this. They make claims “Tor is ALL RIGHT on 100tb boxes!”, but then go and screw you over when you get DMCA notices (it’s a when, not an if. Running a Tor exit WILL produce DMCA notices). I highly suggest avoiding these people at 100tb/Hosting Services, Inc./midphase if you are seriously considering running a stable Tor exit. We had a server there for 6 months, but then they told us Softlayer as DC doesn’t allow it any longer. (torservers.net)
  •  M5 Hosting does not explicitly forbid Tor in their AUP, but after operating an exit node for 3 weeks and receiving three DMCA complaints, their abuse department communicated, “Whereas Tor exit nodes facilitate unaccountable actions by anonymous users and those actions regularly expose [M5] to undue risk as well as oversight costs and unknowable legal expenses, Tor exit nodes will not be permitted on M5′s network” because “just responding to the abuse complaints costs [them] money and it costs money to [their] upstream providers and increase[s] [their] risks of incurring legal defense expenses” and ordered the Tor exit node to be shut down.
  •  FDCservers allows Tor, and customers to react to abuse within 24 hours before taking further steps. Be cautious if operating an exit node, for the boilerplate abuse responses are “not acceptable” per their Network Security Administrator. He sited the AUP/TOS and stated I have “the full responsibility for the content hosted and passing through the server. So if you cannot track or take actions against reported abuse issues you should terminate or restrict specific service” (which was a single exploitable php script probe).
  •  Santrex (1) Santrex gave me a poor experience, no abuse was forwarded, and my server was suspended without prior notice. (2) Santrex suspended the vps running an exit Tor node after 1 day telling me that torrenting was not allowed and I was abusing the service. No warning was given. They kept billing my credit card even after having the vps service suspended. (July 2011) (3) Santrex threatened to disconnect my dedicated machine after the second abuse complaint from an exit node. (In their Denver colo, at least, they appear to be subletting from FDCServers.net, mentioned above.) (Nov 2011)
  •  http://dreamhost.com Abuse department says Tor violates AUP and should not be run. Also said they had had Tor nodes run before on VPSes and it had caused performance degradation for other VPSes. 6/27/2011
  •  Mediacom Within one week of running an exit node on their residential service, my account was suspended due to DMCA requests. No requests were forwarded to me. No amount of reasoning/explaination/screaming at them would get them to restore service.
  •  http://rethinkvps.com Altough they weren’t against Tor exit nodes themselves at first, they run a three strikes policy about abuse complaints from “their datacenter”, meaning they themselves could get their machines kicked off. Running a non-exit relay should be fine.
  •  Chicago VPS First claimed I could host a node as long as I dealt with abuse reports. Then I got an automated abuse mail and I handled it with a proper reply. Then I got a rude threat they would terminate my VPS if this happened again. Not recommended unless you want a host that runs its hands up screaming on every abuse report they get. This abuse mail did not even state the web address this supposed spam/abuse happened but they fully bought it.
  •  VPSCheap.net Tor not allowed.
  •  5ITE Hosting Solutions Tor not allowed. Supposedly forbidden by TOS/AUP even though not directly mentioned
  •  DigitalOcean Tor was allowed, then they stealth changed the ToS after their KVM network stack was failing. Tor will get grandfathered status (Unlimited Bandwidth) removed, and they weren’t exactly keen to warn.
  •  VPSWebServer.com I’ve ordered their service, but they sent me my password only after 4 days, after I ordered another service already. I asked them to cancel my order and refund – but they just deleted my account, gave me no refund and they do not reply to my mails.
  •  owned by http://www.cirtexhosting.com/ Tor not allowed. Even middle nodes violate their TOS/AUP.

Phobos’ research

ISP Name Allowed IRC? Allowed Proxies? Allowed Tor?
 CI Host N Y Y
 Iweb.ca N Y Y
 Host Voice N N N
 Super Servers N N N
 Vericenter N Y Y
 Dedicated Now] N Y Y
 Soft Layer Y Y Y
 Tek Tonic N N N
 Unixshell N N N
 Verizon FiOS N N N

Notes:

  • Unixshell/Tektonic are the same company. They nullroute you on the first abuse complaint. Middleman nodes are ok, but the abuse dept requests “SafeLogging 0″ set in your torrc and wants full access to your logs on demand.
  • Verizon FiOS officially does not allow any incoming traffic, they reserve the right to disconnect you at any time for violation of this policy. Users have run middleman nodes without any incidents from VZ. Exit nodes with abuse problems have resulted in legal threats and disconnection threats, but no disconnection as of yet.

Germany

  • The german ISP dogado ended up killing the Tor server process and blocking the OR-port on my vServer. — d00b
  • The german ISP EuServ / ISPro — they just broke the contract, switching our Server off. — padeluun
  •  Manitu forbids any anonymisation techniques in their AGBs –qbi (gamambel: I have asked and they made me an offer for 100mbit dedi at 1500 euro)
  •  OVH (German ISP) offers root server with a high bandwidth (up to 5.000 kB/s). They changed their AGB and cancel “problematic” contracts very fast. — qbi
  • The german ISP Plusserver.de shut down h07onion due to gross incompetence. Look at  http://archives.seul.org/or/talk/Mar-2005/msg00120.html for more details.
  • “I have recently checked  manitu because they advertise with internet without censorship and data retention. Unfortunately they explicitly forbid providing anonymization services in their  general terms and conditions. On inquiry they have justified this restriction with the enormous bandwidth consumption and the impossibility to achieve fair combined costing in this case. For the same reason they forbid running mirrors of public data such as open source software. So I believe their argument is no pretense.” — Alex, Dec 01 2009 via email.
  • The german provider netcup.de suspended one vserver running a Tor exit node, analyzed stuff, and charged 192€ for processing _one_ dmca-notice. – ari
  • netdirekt.de: “Leider unterstützen wir keine Tor Exits. Sofern diese in unserem Netzwerk sind gab es vermutlich noch keine Vorfälle.”
  •  Strato writes in their  AGB ”Abschnitt III: Sonderregeln für dedizierte und virtuelle Server … 1.1 Eine Nutzung der Server zur Bereitstellung folgender Dienste ist ausgeschlossen: … Anonymisierungsdienste, z.B. Tor, JAP, Proxyserver”
  •  netcup.de Running a tor relay node with 256 kB/s bandwidth and 600gb traffic limit configured in tor I was moved to a high traffic node after about 8 days or 400 GB traffic usage, at which point the average bandwidth dropped to less than 50 kB/s. I was not notified of this changed but its clearly noticable via vnstat -d and a different cpu usage pattern on the new server (as in 100% _all_ the time).
  • I’ve asked the  Server4You support about Tor and they stated “TOR Dienste sind bei uns ebenfalls aufgrund der rechtlichen Graulage nicht gerne gesehen und werden bei Abuse Aufkommen direkt gekündigt.” (March 2011). In April 2012 they turned off my server because “Tor ist illegal in Deutschland” (“Tor is illegal in Germany”, according to their support).
  •  Hetzner has some Tor Exits, but they send an abuse request for each BayTSP request, and you have to respond each. Now (today, 05.09.2011) they disconnected my Tor IP, because someone did a netscan on a /23 via Tor. They requested a statement via mail / fax now, which I sent, but didn’t get a response yet. –morphium
    • Same thing (disconnect b/c of netscan) happened to me sometime around March 2011 . Connection restored after a few hours (Fax & Phone call “plz look at it right away”). Stopped me from having an exit there. :/ — Fusselwurm
  •  Alvotech doesn’t allow Tor exit nodes: “unfortunately we had several problems in the past with tor exit nodes (police stuff, ddos, lawyers etc.), so we don’t wish it in our network”. — Nyr

France

  • The french hosting company  http://www.online.net/fr (member of  iliad) suspended without warning a bunch a machines that were running Tor after the police came down about creditcard fraud. (Also, any kind of relay is explicitely forbidden in their term of service.)
  •  Gandi VPS will give one warning and then delete your account if you run a Tor node on their VPS system. Don’t try this if you have any domains registered with that account as well, it’s difficult to get them back.
  • OVH / Kimsufi suspended and restarted into FTP only mode claiming “hack” even when running as relay, Contacted OVH to explain Tor got the following reply: Actually we don’t like TOR on our network, as either a relay or an exit node. You can check our T&C. (Indeed, any kind of relay is explicitely forbidden in their term of service, however, I have a few servers there which are relays on non-standard port, never had a complain.)

Finland

Canada

  • Rogers has a no-servers clause in the TOS for their home internet service. If you are running an exit node and receive DMCA notices, you will have no legal recourse except to cancel service. (2008-03)

Sweden

  • Perspektiv bredband supposedly allows for running Tor nodes, but will disable your account due to spam.

United Kingdom

  • I have asked and  Swiftway doesn’t want Tor exits on their network.
  •  Memset do not allow Tor servers under their (rather vague) AUP.
  •  UK Dedicated aka Colo.net informed me that I couldn’t continue to run my Tor relay or in anyway effect, conduct or facilitate any activity involving: IRC or anonymous proxy services.
  • I asked  OVH/Kimsufi about their policies regarding Tor exit nodes and was told that an exit node is classed as an open proxy which is against the TOS. I replied that I’ll be running it in bridge mode then. No feedback on that so far. –Maquis196
  •  123-reg found out I was running an Exit Node (received a notice regarding filesharing, someone downloading torrents using my Exit). I was asked to shut it down. I complied and asked if i could run a Relay node. They said no as that would violate their AUP. — September 2012, vandal2

Italy

  • avoid SEFLOW.it! they say it’s against Italian law to have a Tor relay, asked which law, they said to contact a lawyer. (atrent: do you need a more articulate explanation? I’m the one who had the bad experience, I have all the emails exchanged and I can translate them)
  • GARR.it: well… it’s not an ISP but nonetheless since it’s the connectivity provider of italian universities we should mention that they do NOT allow exit nodes on their net (I had one, they obliged me to tear it down)

Slovenia

  •  Domenca has crazy prices (10 EUR/Mbit/s + 300 EUR/U for dedicated server per month) and they require not just to respond to all complaints in one working day, but also to prevent them in the future. Just replying with explanation that it is an anonymous service and there is no way to prevent this, is not enough for them. So it seems impossible to really host Tor exit node there. Mitar (mitar@…)

Netherlands

  •  PCextreme does not allow hosting of a Tor relay node on their VPS. (Tue, 31 Jan 2012)
  •  Seedmonster does not list Tor as being against their TOS, but they suspended a major tor node because of 4 web forum spam reports on a 1gbps exit. They will try to work with you, but their upstream provider is zero tolerance, so when it comes down to it, they will not back Tor exits. (Update:) They agreed to let it keep running after the exit policy was modified, but then came back a week later and said Tor had to be disabled completely. Three complaints were received out of approx. 10TB of traffic.

Malaysia

  •  Shinjiru is not allowing Tor since their new  policy (feb 2012), Even if all the exit ports are blocked, and even as relay : they are u-turning completely . (In the past they even  donated a server to the Tor project); traffic is expensive though

Russia

  •  Smile blocks any traffic, by redirecting to statis web page with message about that user is possibly providing access to third party. It does not like many simultaneous outbound HTTP-connections.

Switzerland

“TOR is not allowed to be ran on our containers. This is the reason why the process gets killer every minute. The reason why we do not allow TOR, is because over time we have seen that it consumes way too much CPU time, so we have decided not to allow it on our VPS. ”

  •  SolNet does not list Tor as being against their TOS, but they will ask you to shut it down if they receive complains via abuse (Fri, 15 Feb 2013).

Czech Republic

  •  NQhost They don’t allow running relays of any kind:

“We don’t allow to use our servers for tor exit nodes and/or relays”

Ukraine

  •  0x2A Refuses Tor traffic.
Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2013/04/tor_2013.tiffDigg ThisSubmit to reddit
06/3/13

Tor Websites over 1/3 TANGO DOWN

gAtO bEeN- doing some work on his Tor- search engine and finding Tor-websites IP but other are doing the same thing and publishes the news-

I guess the news is getting out and people are bringing their Tor-hidden service-websites are going DOWN. Not by my work – I wish – but by a simple little report -:tor-revealing_guard_nodes

IEEE 2013 just put out a report: Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization

http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf

yes kiddies wee can find your Tor-Website and find the IP and get the geo-location and track you down. The worst part now others know and Tor-websites are being taken down by their own administrators  so they can do countermeasures and not be caught.

2013-05-29 we had 16,000 Tor websites

2013-06-04 we have 3,517 Tor Websites

Application Server Details
Cache Last Updated (Local Server Time): 2013-05-29 23:19:07 MET
Last Update Cycle Processing Time (Seconds): 645
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3582
Number of Descriptors In Cache: 16099
Approximate Page Generation Time (Seconds): 0.1987
Application Server Details
Cache Last Updated (Local Server Time): 2013-06-04 02:11:43 MET
Last Update Cycle Processing Time (Seconds): 553
Current Cache Expire Time (Seconds): 300
Number of Routers In Cache: 3599
Number of Descriptors In Cache: 5817
Approximate Page Generation Time (Seconds): 0.01

So what happened to all the Tor-hidden serve-websites? All I care about is that my work now backed up by this reports shows we are on the right track and we can do what we say we can do and that is to bring down pedophiles websites down in the Tor-network.

The Tor-network is great but these monsters are making Tor a bad place to work and do legit business. Let’s hope other get the message that we are hunting you down even in Tor cowards- gAtO oUt

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2013/06/tor-revealing_guard_nodes.tiffDigg ThisSubmit to reddit
05/5/13

Finding Tor Websites –geo-location

Finding Tor Websites –geo-location

gAtO tHiNkInG- to find Tor-hidden service-website geo-location we must understand Tor and how it works better. Figure 1 shows us how a basic Tor connection is made. Let’s take a closer look, to understand the weak points in Tor and to find the location of the Tor-hidden service-website:Tor-connection

1,2 and 3 are how a Tor-hidden service-websites tells the world that it is available to the world. 4-5 and 6  create the map’s to the location of the meeting between the client and the HS. 7,8 and 9 are the key’s to finding the website…

The HS –hidden service needs to advertise that it’s available thru the IP –introduction points to the DS- Tor-DNS –so other Tor-clients can find them. The workload of data exchange goes on between the RP -Rendezvous Point and the client and the Tor-website.

 

All Tor connection have 3 relays they must use to connect to the Tor-network.

Client–|> 1.Entry-node 2.Relay-node 3.Exit-node -HS-website

1. Tor weakness :-A hidden service uses 3 IP and/or 3 RP as part of the ”descriptor information“ so the TOR-DNS can find the site.tor-passive_attack111

a}. To find the geo-location we need to find the 3RP for a HS-website and direct our crawlers to crawl from 8 different geo-location– the delay signals from all location should be the [same/different] from the RP to the HS. This data with data from the OR should give us enough information to tag a location to these signals.

B}. –this is part of the information that is kept in the ”descriptor information“ that the Tor-DNS (directory service) uses to find and connect to the hidden service-website.

We will now have 8-Tor servers  from different worldwide locations finding these 3 RP for the target hidden service-website. Once we have the geo-location of the RP –using  network delay signals that we collect with our cralws. This data can give us triangulation information using data correlation to find the geo-location of the target- Tor hidden tor-relay_01service-website. At least in threory it works, we have started testing some of these new ideas and will keep you posted. So far we can find the country of the target hidden service-website but we need to come closer and get a pinpoint location without an IP address with our medthod of triangulation and data correlation – gAtO oUt

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2013/05/Tor-connection.pngDigg ThisSubmit to reddit
03/24/13

Tor is NOT the ONLY Anonymous Network

gAtO fOuNd – this very interesting and wanted to share -

Tor does some things good, but other anonymous networks do other things better. Only when used together do they work best. And of course you want to already know how to use them should something happen to Tor and you are forced to move to another network.fin_07

Try them! You may even find something interesting you cannot find on Tor!

Anonymous networks

These are well known and widely deployed anonymous networks that offer strong anonymity and high security. They are all open source, in active development, have been online for many years and resisted attack attempts. They run on multiple operating systems and are safe to use with default settings. All are well regarded.

  • Tor – Fast anonymous internet access, hidden websites, most well known.
  • I2P – Hidden websites, anonymous bittorrent, mail, out-proxy to internet, other services.
  • Freenet – Static website hosting, distributed file storage for large files, decentralized forums.

Less well known

Also anonymous networks, but less used and possibly more limited in functionality.

  • GnuNet – Anonymous distributed file storage.
  • OneSwarm – Bittorrent, has a non-anonymous mode, requires friends for anonymity.
  • RetroShare – File-sharing, chat, forums, mail. Requires friends, and not anonymous to those friends, only the rest of the network.
  • Omemo – Distributed social storage platform. Uncertain to what extent it is anonymous.

Non-free networks

These are anonymous networks, but are not open source. Therefore their security and anonymity properties is hard to impossible to verify, and though the applications are legit, they may have serious weaknesses. Do not rely on them for strong anonymity.

  • Osiris – Serverless portal system, does not claim to provide any real anonymity.

In development

  • Phantom – Hidden Services, native IPv6 transport.
  • GlobaLeaks – Open Source Whistleblowing Framework.
  • FreedomBox – Project to create personal servers for distributed social networking, email and audio/video communications.
  • Telex – A new way to circumvent Internet censorship.
  • Project Byzantium – Bootable live distribution of Linux to set up wireless mesh nodes with commonly available hardware.
  • Hyperboria A distributed meshnet built on cjdns.

Routing Platforms

These are internets overlaid on the internet. They provide security via encryption, but only provides weak to none anonymity on their own. Only standard tools such as OpenVPN and Quagga are required to connect. Responsibility for a sufficiently anonymous setup is placed on the user and their advertised routes. More suited for private groups as things out in the open can be firewalled by other participants. Can be layered above or below other anonymity nets for more security and fun.

  • Anonet – AnoNet2, a more open replacement for AnoNet1.
  • dn42 – Another highly technical routing community.
  • CJDNS, an IPV6 overlay network that provides end to end encryption. It is not anonymous by itself.

Alternative Internet

  • Netsukuku – A project that aims to build a global P2P online network completely independent from the Internet by using Wi-Fi. The software is still in active development, although the site is no longer updated. A new site is in progress of being built.
  • Many other wireless communities building mesh networks as an alternative to the Internet, e.g. Freifunk, http://guifi.net and many more around the globe. see also

Alternative domain name systems

  • Namecoin – Cryptocurrency with the added ability to support a decentralised domain name system currently as a .bit.
  • OpenNIC – A user controlled Network Information Center offering a democratic, non-national, alternative to the traditional Top-Level Domain registries.
  • Dot-P2P – Another decentralized DNS service without centralized registry operators (at July 18, 2012 page is not accessible and has not known anything about the status of project from February 2011).

See Also

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2012/03/fin_07.tiffDigg ThisSubmit to reddit
03/10/13

Finding the Bad Guy’s in Tor -triangulated irregular network

gAtO ThInKiNg - a car GPS works very simple, It takes the delay time from one geo-positioned satellite and compares is to another geo-positional satellite and estimates the position of the GPS in my CAR – I think they call it satellite triangulation or something cool, it’s been done with radios to guide pilots navigate ever since they developed radios. We do it with satellite and we can use networks too.

triangulated irregular network  -So now apply this to the Tor bad guy’s websites- a hidden service!math_clouadTag

With a simple command you can get the time it takes to crawl a website, so you have one server in the U.S one is South America, one in Europe and one in Asia and we run the same command getting the delays from each location. I bet with a little math and some basic network tools we could figure out the geo-location of any given website in Tor. One of my good mentors told me that in my crawls I was capturing timing information, we all see timing information with a simple ping command in the clear web but in Tor – UDP is unsupported so it does not work -//- we must take into account the Tor network thru-put and utilization bit that’s easy to get from a number of Tor tools.

Reverse triangulation of a network server should be easy to find with a little math, just take a good sample and the longer you wait the more data you collect and the better the chance you can find a geo-location of a website. We do this in the clear web all the time we can see bad areas of the world that are bad spammers, and other like mail from Africa Prince Scams offering you millions if you send them some money to cover the transfer, or Russian and Chinese phishing attacks. So we know geo-location and some IP are more prime to bad actors and we can draw a profile, a geo-location of a place and/or  country or an ISP so not having the IP of a Tor server may not be neededto find them we could use network triangulation. “triangulated irregular network  ” So the same thing can be done with networks and timing delays of data back and forth from a // client <–> Tor OR <–>server.

I got a crazy Idea that may or may-not work, but it sounds good—//  so— Now if I can only find a government grant and a good math major to help out and we have a big business model to find the bad guy’s geo-location even in Tor - gAtO oUt…

Share on TumblrSubmit to StumbleUponhttp://uscyberlabs.com/blog/wp-content/uploads/2012/09/math_clouadTag.tiffDigg ThisSubmit to reddit
03/1/13

Currency of the Cyber Economy

gAtO tHiNk- the bad evil hackers are the least of your worries, the real bad guys are the corporate geeks that want every click, every nuance of your digital life and they tell you it’s to give you a better web experience. WoW I didn’t know that selling all my information as I go from site to site is a good thing for me. How about if I’m sick and search for my medical problems will my insurance company want that information to raise my payments. You betcha they do!!!

I’m doing some Tor work now so I’m away from the hump and grind but I been changing my search engines because like google they know what I look for and they give me the same crap and then I switch to yahoo and soon the have me profiled then Bing, whoa!!! what a mistake but I expected very little from them anyway. They were robbing us blind back before Netscape days.

Think about those high tech security geeks they get paid big bucks to guard the hen house and you hear about a new hack every other day why because if you understand the “book” the same one every security geek get’s all those certification all teach the same old done thing and that’s their job to take the masses and control them but the ones that think for themselves are the true pioneers, the ones that dance to a different drum. Look I don’t have any certifications anymore and I know more today about the Tor network than most people around. That’s what interest me and that’s what I like.

The currency of information economy is going swell and the big corporate boys are all for selling everything you do so use Tor and be safe and have a little privacy. Be different and use the tools that work for you and keep your digital breadcrumbs to yourself. I know your not doing anything wrong and you don’t have to prove it to anybody. People say if I use Tor then people will think that I’m a bad guy. Oh Me, Oh My do you really care about other’s control of you. It’s a propaganda war just to keep you afraid of Tor because with it they cannot sell your data. Don’t sell your click for free make them earn them -gATO OuT

Share on TumblrSubmit to StumbleUponSave on DeliciousDigg ThisSubmit to reddit