Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.advocacy > #291466
| From | owl <owl@rooftop.invalid> |
|---|---|
| Newsgroups | comp.os.linux.advocacy |
| Subject | Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) |
| Date | 2015-04-24 20:08 +0000 |
| Organization | ok by me, so long as it doesn't get out of hand |
| Message-ID | <nnvhdu3.3r@rooftop.invalid> (permalink) |
| References | (2 earlier) <81daff98-d402-4ceb-ab92-aef9942cbda0@googlegroups.com> <55397705$0$41760$c3e8da3$5d8fb80f@news.astraweb.com> <7cd0518f-0036-4f44-a37e-ed96f27f6cc8@googlegroups.com> <11c76b70-4702-4244-b509-87150f3cb842@googlegroups.com> <3ac41851-0689-4c0d-a8e8-56f953f68615@googlegroups.com> |
Steve Carroll <fretwizzer@gmail.com> wrote: > On Friday, April 24, 2015 at 5:32:02 AM UTC-6, cc wrote: >> On Friday, April 24, 2015 at 12:44:26 AM UTC-4, Steve Carroll wrote: >> > On Thursday, April 23, 2015 at 4:49:43 PM UTC-6, vallor wrote: >> > > On 04/23/2015 12:59 PM, Steve Carroll wrote: >> > > > On Thursday, April 23, 2015 at 1:12:53 PM UTC-6, Tomas wrote: >> > > >> > > >> >> > > >> Here is what What's my IP Address shows. >> > > >> Confirmed proxy. >> > > >> http://whatismyipaddress.com/ip/209.126.110.113 >> > > >> >> > > >> >> > > >> General IP Information >> > > >> >> > > >> IP: 209.126.110.113 >> > > >> Decimal: 3514723953 >> > > >> Hostname: ncc-1701-d.tor-exit.network >> > > >> ISP: Hosting Solutions International >> > > >> Organization: Hosting Solutions International >> > > >> Services: Confirmed proxy server >> > > >> Recently reported forum spam source. (124) >> > > >> Type: Corporate >> > > >> Assignment: Static IP >> > > >> Blacklist: >> > > >> Geolocation Information >> > > >> >> > > >> Country: Anonymous Proxy >> > > > >> > > > What does this mean, that it's a proxy server and that it didn't necessarily come from that location in St. Louis? Elsewhere, you said it may not even be using TOR. Why does it point to the TOR site? >> > > > >> > > >> > > Because it appears to be a TOR exit. >> > > >> > > $ nslookup 209.126.110.113 >> > > Server: xx >> > > Address: xx >> > > >> > > Non-authoritative answer: >> > > 113.110.126.209.in-addr.arpa name = ncc-1701-d.tor-exit.network. >> > > >> > > Authoritative answers can be found from: >> > > 110.126.209.in-addr.arpa nameserver = ns2.nameserverservice.com. >> > > 110.126.209.in-addr.arpa nameserver = ns1.nameserverservice.com. >> > > ns2.nameserverservice.com internet address = 69.64.44.21 >> > > ns1.nameserverservice.com internet address = 69.64.45.121 >> > > >> > > That's where traffic emerges after "tunneling" through TOR. It almost >> > > certainly has nothing to do with whomever is at the other end. >> > >> > Are you saying it just looks like it's coming from Hosting >> > Solutions International but it really isn't? This is what >> > TOR does, it let's you 'forge' an IP address? >> >> Nope. It means Hosting Solutions International is hosting a tor >> server, whether they realize it or not. To use the proxy, the >> IP address has to be legit, or you wouldn't get traffic routed >> back to you properly. You can use a spoofed IP packet when using >> connectionless protocols like UDP. Since there's no connection to >> establish, you can blast out UDP packets with whatever source >> IP you want, causing problems. > Would a business purposefully run a TOR server? Conversely, how could they not know their server was comprised? Wouldn't it be noticeably slower if it were being used for this purpose? They're a hosting service. Hosting *is* their business. >> That's what attackers do for some DoS and for DNS amplification >> attacks. Ping and DNS and require no handshake. They spoof >> the source IP and send the packet. Then the destination responds, but >> to the source IP, not to where it was actually sent. That way >> attackers can redirect traffic. Using enough machines, coupled with >> a response that is much larger than the request (DNS), you can >> really hammer someone. > Why do idiots waste time with this kind of crap? Snit once ran a script on Sandman's site to the tune of 300,000 times. It sounds like, if Snit actually knew what he was doing, he could have done it in a way where it didn't point right back to him. Of course, that was years ago, the 'IT Master' may have figured all this stuff out by now. But my point is that I fail to see what gets accomplished in the long run. So you take down a server for a bit? It goes back up. What's the allure? >> TOR doesn't spoof or forge an IP. It just hides the IP of >> whoever is using it. With the proxy you want all of your >> traffic sent back to you, so you can browse web pages, etc. So >> each TOR hop along the way is a legit IP address, it's just >> that the final destination is unaware where the traffic >> originally came from. >> >> TOR Proxy: >> You -> Proxy1 -> ProxyN -> Website -> ProxyN -> Proxy1 -> You >> >> Spoofed IP: >> You -> DNS/Website/Whatever -> Spoofed IP > I don't understand fully everything you've said (i.e. - "no connection to establish" ?) but it's apparent that it didn't originate at Hosting Solutions International. Thanks (to all) for the info. ;; QUESTION SECTION: ;tor-exit.network. IN A ;; ANSWER SECTION: tor-exit.network. 21599 IN A 5.79.68.161 tor-exit.network. 21599 IN A 188.138.1.229 tor-exit.network. 21599 IN A 188.138.17.15 tor-exit.network. 21599 IN A 209.126.110.112 tor-exit.network. 21599 IN A 209.126.110.113 ----- ;; QUESTION SECTION: ;tor-exit.network. IN NS ;; ANSWER SECTION: tor-exit.network. 21599 IN NS ns2.transip.eu. tor-exit.network. 21599 IN NS ns0.transip.net. tor-exit.network. 21599 IN NS ns1.transip.nl. ----- A guy named TR van der Woerdt owns the "tor-exit.network" domain. He apparently uses several hosting services for his tor nodes and for forward/reverse DNS. All of the IPs in the A records go to hosting services. Two are from "Hosting Systems International." Two are from "Pluserver AG." One is from "LEASEWEB." DNS is handled by transip.eu/net/nl, another hosting service. ----- Domain Name: tor-exit.network ... Registrant Name: TR van der Woerdt ... Registrant Email: info@tvdw.eu ----- https://tvdw.eu/blog/2015/01/24/implementing-a-tor-relay-from-scratch/ <quote> Tom "TvdW" van der Woerdt </quote> https://twitter.com/tvdw <quote> Perl software engineer & Tor contributor & Bitcoin user & Pirate Party member & NSA target & brony & I fight for privacy and internet freedom. XMPP: </quote> He is credited with a couple of patches here: https://gitweb.torproject.org/tor.git/tree/ChangeLog
Back to comp.os.linux.advocacy | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 11:40 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 11:46 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Tomas <tgif9fri@numo.net> - 2015-04-23 15:12 -0400
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-23 12:23 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 12:59 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) vallor <vallor@cultnix.org> - 2015-04-23 15:49 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Tomas <tgif9fri@numo.net> - 2015-04-23 20:41 -0400
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-23 21:44 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) cc <scatnubbs@hotmail.com> - 2015-04-24 04:31 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-24 10:30 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-24 20:08 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-25 10:49 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-25 18:40 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-25 11:53 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-25 19:18 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-25 12:25 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 09:54 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 17:30 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 10:43 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 11:29 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 18:49 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 12:23 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 12:48 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 19:55 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 13:25 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 13:33 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 14:00 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 21:22 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 14:32 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 21:50 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:01 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:05 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:35 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 14:35 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 14:40 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:09 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 15:21 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:21 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:40 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:47 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:51 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 15:49 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 22:56 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 16:00 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 23:32 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 16:46 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 00:00 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 17:02 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 17:08 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 00:47 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 18:14 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 01:41 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 19:04 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 02:32 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 19:38 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 02:46 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 19:59 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 03:21 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:38 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:45 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 03:58 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 21:04 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 21:06 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) tmelmosfire <tmelmosfire@gmail.com> - 2015-04-26 21:12 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 04:20 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 03:55 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:57 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 04:02 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Steve Carroll <fretwizzer@gmail.com> - 2015-04-26 20:59 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-27 04:04 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 19:01 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) tmelmosfire <tmelmosfire@gmail.com> - 2015-04-26 19:11 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 19:47 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 17:11 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) tmelmosfire <tmelmosfire@gmail.com> - 2015-04-26 20:06 -0700
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) owl <owl@rooftop.invalid> - 2015-04-26 20:47 +0000
Re: OT: IT Pros or anyone with a clue about TOR (not you Snit) Snit <usenet@gallopinginsanity.com> - 2015-04-26 12:40 -0700
csiph-web