Slashdot Mirror
Tor Anonymity Network Reaches 100 Verified Nodes
James A. Y. Joyce writes "Tor is an onion routing anonymous network. It routes your data transfers through a series of encrypted links between random nodes in the network; the greater the number of nodes, the greater the anonymity afforded. To commemorate the 100th verified node in the Tor network, the EFF are putting up a request for other organisations and personal users to start up Tor nodes of their own. (Tor has been mentioned on Slashdot twice before.)"
Should be tor.eff.org.
While I think Tor is a great idea, I also think it makes it way too easy to be a bad netizen.
With Tor, you can flood sites and services such as IRC, web boards, instant messaging, and so forth. You could possibly use it to spam as well. All of this would be done by seemingly random IP addresses. In essence, it is an inflated case of Open Proxy Syndrome. The only remedy that the victims have is to block all Tor sites by using some of the RBLs that exist for doing just that. I'd really like to allow legit use of Tor on my services, but there are some jackasses that flood from within Tor that make it impossible.
With anonymity comes a lack of recourse. I understand that this is the point of anonymity and Tor, but it isn't always good.
Beware, Nugget is watching... See?
Tor isn't designed to shield you from timing attacks (read the Tor website - they specifically disclaim this).
Here, I'll try and do it again right now.
The nodes are what people use to remain anonymous. They nodes themselves need to be well-known so they can be used. 100 people use node X. Someone from China could use node X or someone from America could use Node X or someone from England could use Node X. How do you know where any of those people live, by knowing where node X is?
Answer: You can't know. Hence the people using Node X remain anonymous.
And dont forget the TOR DNSBL, since you know TOR is just itching to be abused.
Your hair look like poop, Bob! - Wanker.
Note that you can be a server without allowing users to make connections from your computer to the outside world. This is called being a middleman server.
You may think its stupid, but unfortunately, its reality. The reality is that even though it slower, its still effective.
Here is an example of some log entries of spammers using Tor to forge referers and trackback spam to domains I host. Whatever tool they're using "broke" the url because they lowercased it (the url is valid, if the 'q' is uppercased).
At first I thought it was a new worm hitting us, but its coming too fast from far too many IPs in a very predictable pattern to be a random worm. The list of countries represented is very un-wormlike.
We survived 2 slashdottings 2 days in a row last week, barely a blip on our network radar, bu t a few days later, we were hit with this mountain of traffic from random locations, all within a 10-15 minute span, and only about an hour after I blocked the entire country of Brazil from reaching port 25 (the whole 200.0.0.0). Its definately maliscious, and definately intentional. I'm fending off attacks on our servers almost daily now, from netbios floods to SYN and TIME_WAIT attacks, to other things. I've been using the TARPIT module in iptables to slow things down, but they keep on coming, from thousands of unique IPs, across all range of our open ports (22, 53, 80, 2401, whatever).
So yes, Tor is most-definately being used to spam and DDoS sites, that is a fact and reality, which I can consistently prove with graphs, logs, and charts.
But it does serve a valid purpose, so I don't block the Tor IP range... yet.