Conversation

Notices

1. Embed this notice
   Georg Engelmann (georgengelmann@mastodon.electroncash.de)'s status on Thursday, 07-Nov-2024 15:19:11 JST Georg Engelmann

   Is there an ongoing attack on the Tor network right now?

   My relay was doing some weird stuff.

   I got abuse reports even though I am not running an Exit relay.

   #tor #privacy #darknet #hacking #hacker

   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Thursday, 07-Nov-2024 15:19:09 JST 翠星石

     in reply to
     @georgengelmann There is an attacker spoofing TCP packets with the source IP to pretend to mass-connect to ssh honeypots - meaning that Tor relays are getting TCP RST packets and abuse reports.
     
     Such attack shouldn't be possible, but BCP38 has seen little implementation.
     
     It's best to reply to such abuse reports noting that such was an IP spoofing attack and none of such connections came from your server.
     
     https://forum.torproject.org/t/tor-relays-tor-relays-source-ips-spoofed-to-mass-scan-port-22/15498 (too bad you cannot view the issue comments without running proprietary gitlab JavaScript).
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Thursday, 07-Nov-2024 15:22:02 JST 翠星石

     in reply to

     • tsoifan1997
     • nyanide :nyancat_rainbow::nyancat_body::nyancat_face:
     @nyanide @sysrq @georgengelmann https://delroth.net/posts/spoofed-mass-scan-abuse/
   • Embed this notice
     nyanide :nyancat_rainbow::nyancat_body::nyancat_face: (nyanide@lab.nyanide.com)'s status on Thursday, 07-Nov-2024 15:22:03 JST nyanide :nyancat_rainbow::nyancat_body::nyancat_face:

     in reply to

     • 翠星石
     • tsoifan1997
     @Suiseiseki @georgengelmann cc @sysrq