Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Drastic increase in Tor clients from Germany

metrics.torproject.org

Post reply on HN
Print view View original

191–200 of 262 posts

Re: Drastic increase in Tor clients from Germany

#191

Post by rurban »

doubleorseven wrote: post #145
throwaway290 wrote: post #121

Earlier quoted context omitted.

Note that the growth is not just in Germany. Ireland, Sweden, Switzerland also show jumps (however in absolute terms they are still much smaller). I would not rule out it's people or bots connecting from third country/countries through VPNs based in Europe... for whatever reason.

VPSs in germany are much cheaper. But I'm guessing this increase is paid with crypto or debit cards so pin pointing it to a specific provider like hetzner is hard

Hetzner used by criminals would be my guess.

Re: Drastic increase in Tor clients from Germany

#192

Post by riedel »

aeyes wrote: post #187
ballenf wrote: post #165

Earlier quoted context omitted.

Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?

My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers. And ISPs are usually limited to a single country.

That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? It is just unlikely (but far from impossible) that this is something 'normal' happening.

My fear would be that someone still is trying to gather a critical mass of nodes to contact controll servers via TOR to cause mass havoc in a single country from within a single country. Generally IMHO Germany would be a good target for destabilisation currently. But I think and hope this could just a bit of overinterpreting. Probably one would need a good statistic on the subnets the users come from.

Re: Drastic increase in Tor clients from Germany

#193

Post by eitland »

riedel wrote: post #192
aeyes wrote: post #187

Earlier quoted context omitted.

My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers. And ISPs are usually limited to a single country.

That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? It is just unlikely (but far from impossible) that this is something 'normal' happening. My fear would be that someone still is trying to gather a critical mass of nodes to contact controll servers via TOR to cause mass havoc in a single country from within a…

> That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react?

I hope to be wrong but I am afraid you are overestimating the technical competency of the average ISP.

Re: Drastic increase in Tor clients from Germany

#194

Post by sweetjuly »

hedora wrote: post #181
supriyo-biswas wrote: post #173

Earlier quoted context omitted.

I already have per-IP ratelimiting, and I'm against using captchas have bad UX (including the much-hailed Turnstile). I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part (for a free website FWIW), and the quickest way to mitigate it would be to block Tor.

IP blocking blocks most of the people on our local ISP. They are small, and use CGNAT, so one owned windows machine across town breaks sites like yours for everyone, and the root cause is extremely difficult to debug for end users. As much as I deeply, deeply dislike captchas, ip blocking is far worse.

IP blocks also just don't work on IPv6. Unless you're prepared to block entire by ASN, an adversary can cheaply just buy up a lot of address space and churn through them. It gets even messier when dealing with real ISP networks because some hand out /40s for residential customers whereas others give just a /56.

Re: Drastic increase in Tor clients from Germany

#196

Post by kadoban »

chezelenkoooo wrote: post #162
brucethemoose2 wrote: post #115

Is someone trying to compromise the Tor network? I read that Tor needs a certain percentage of non-malicious nodes to function, though I am not sure if that is applicable clients.

I think you're thinking of blockchain

Sybil attacks are more general than just in cryptocurrencies. They actually apply to Tor as well, just not to _this_ part of Tor.

Re: Drastic increase in Tor clients from Germany

#197

Post by niemandhier »

joeythedolphin wrote: post #144
virtualritz wrote: post #80

Earlier quoted context omitted.

I don't know why this is getting down voted. Poster didn't say it's rampant, just that "it is very much alive." I'm German, I live in Berlin, I regularly spend time in eastern Germany, outside Berlin. I can sadly confirm this.

Can you say more about East Germany and what is going on there for them to be open to conspiracy theories, neurotic thoughts, etc?

The german lands east of the river Elbe have been different from the western parts of Germany for more than a 1000 years. In the historical record you see a pretty sharp change in marriage patterns,land ownership and political structure when crossing the Elbe.

The enlightenment was less influential in the rural estates of the ultra conservative east elbian Junkernklasse than it was in the more densely populated Rhineland regions. Fukuyama has a nice chapter on the matter in “The Origins of Political Order”.

On top of that you have the separation, and the dislike of the GDR to foster critical thinking and the economic collapse of the east after reunification that lead to a lot of brain drain.

Re: Drastic increase in Tor clients from Germany

#198

Post by bauruine »

isoos wrote: post #18
VWWHFSfQ wrote: post #11

[flagged]

I use tor for exploring topics that I don't want to tie to my regular profile (ranging from professional software development, through health care issues, but also hobbies, fiction and nsfw content). Having these browsing in a separate profile and also IP address makes it much more relaxed to look for interesting stuff on the internet. (I am not really fond of advertisement that tries to sell me whatever I've visited…

Whenever I read something like this I look my access and sshd logs for abuse IPs and check if they are Tor exit nodes. The Tor traffic is always negligible like 100 failed ssh logins out of 170k are from Tor exit nodes. Or 670 out of 400k for my nginx access.log. Am I unique and everyone else sees vastly different numbers where blocking Tor exits makes a significant difference in the abuse they get?

Re: Drastic increase in Tor clients from Germany

#199

Post by tetris11 »

mantas wrote: post #171
ballenf wrote: post #165

Earlier quoted context omitted.

Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?

Maybe German state itself is the actor.

My bet is Russia.

I work in a German institution. I was recently hacked by such a botnet recently (lessons learned: use AuthorizedKeys, allow only one SSH user, proxy all http connections to a webhoster, and check your SSH and UFW logs often!)

It setup a virtual environment where it downloaded some kind of Tor node and ran some sort of code that used 100% of my CPU. My guess is crypto-mining. I purged the account, deleted everything before I could do forensics, but I checked the logs for the connections and they all came from Russia.

Re: Drastic increase in Tor clients from Germany

#200

Post by kobieyc »

hattmall wrote: post #129
flangola7 wrote: post #117

Earlier quoted context omitted.

What is unmasking? What does it have to do with a botnet

Revealing the identities of tor users or hidden services. One way to do it is by controlling a large share of the network.

Yes but this clients, not nodes. So this actor does not control a large share of the network, they just use a large share of the network.
Post reply on HN