"Tor User" Error, when not a Tor User

Post Reply New Topic

Was told this morning that I am TOR user, ( unbeknown to me ), "critical error" etc, and that could not post. Anyone else get this?

It seems to have gone away, but don't know why it did it. Was worried that it was that global worm.

.

The Problem

This seems to be cropping up more often. I gave a detailed explanation, somewhere else, but here goes again....

TOR is a system that lets people access the web anonymously and untraceably.

People volunteer to be "exit nodes", which means that all the traffic for the anonymous users comes from those IP addresses.

The system is used genuinely by political dissidents, say.

The system is misused heavily by spammers, etc.

The TOR designers understand this, and provide means whereby sites can easily reject TOR users, via blacklisting all IP addresses used as exit nodes.

All this would be OK if the people who set themselves up as TOR exit nodes knew what they were doing, but many of them don't. They have "dynamic" IP addresses. This means that each time they disconnect from the net, their old (now blacklisted) address goes back into a pool, and then passes on to some other user.

The blacklists are not updated terribly frequently (as a TOR exit node might just be temporarily offline). I think I heard it was something like a month, as the time an IP address might remain "tarnished" by having been used as an exit node.

It would be nice if ISPs could make it part of their rules. They could insist that a user with only a dynamic IP address was not allowed to operate as a TOR exit node.

The Solution

When the problem crops up, it will generally be just after you have re-connected to the net. Just disconnect and reconnect - which should give you a new IP address. Just possibly, you might get the same one back. So do it again, but stay offline for a little while.

Thank you very much for that very clear/illuminating, helpful, and reassuring explanation.

Shutting down everything is what I did, and went away and sat in the sun for an hour or so, enjoyably if stressed-outly imagining catastrophe scenarios ( the global worm conficker etc ), before finding on my return that everything was ok again.

Thanks.

.

I simply changed my routers MAC address to force Comcast into giving me a new IP address.

And how did you do that?

Just a restart of the router was needed.

not with Comcast. Comcast would require me to be offline totally for at least 6 hours to auto flop the IP. but to forcibly change it in about 30 seconds you can use the routers Mac Address clone tool.

And which router would that be?

Linksys WRT54G with Tomato

http://www.polarcloud.com/tomato

So, would you explain to ouinon how this is relevant to her?

I am not even going to bother answering this question. my posts are completely relevant to "Tor User Errors"

Most sysadmins don't "get" the computer underground unless the underground is messing around inside their systems. The Chinese are primarily focused on espionage and controlling vital systems; they have little reason to be inside Comcast's network, for example. (Comcast, for those of you outside the US, is a provider of wired television or "cable" television in much of the US. They use their wires to provide high speed internet access to their customers, most of which are just average Joes.)

The Russians just want bank account numbers and to set up botnets, networks of so called zombie computers that can pump out spam. They are not terribly concerned with personal computers because any unusual activity will be immediately noticed. I once picked up a Russian bot groper, apparently a scanning one like Conficker. Those scan for any computer that has their specific port open. I just happened to be in the line of fire when the groper drove by. My firewall kept blocking the botware, so I immediately disconnected, and when my virus program didn't get rid of it, I reinstalled. The Russians are mainly concerned with big server farms that can act as botnets without anybody noticing. If they want anything to do with your PC, they're looking for bank account numbers.

That leaves door #3, the ragtag collection of 15 year old "1337 g33kz" (elite geeks) who screw with anybody and everybody they can just because they can. They will crash some guy's PC over and over just to remotely watch him struggle with it. These are the people who tend to make up a lot of nodes of these underground nets. Their node will be used over and over to spam and wreak havoc, leaving a huge trail of dead IP's. Get one of those and you're fried until you can dump it.

The instance that comes to my mind is the infamous Great Basin Flagger on Reno, Nevada Craigslist. There is somebody lurking around there who screws with people, and keeps getting his dynamic IP blocked. He's smart enough to simply reset. He uses a local third party DSL provider, Great Basin Internet. This means that GBIS, as it's called, has amassed tons of dead IP's that are blocked by CL. So GBIS users keep getting told that they're blocked from CL. GBIS has shown an unwillingness to stomp this guy for good, so soon their service will be useless to post on a huge classified ad site.

The odds of somebody on a huge network like Comcast getting an IP that is blocked by their site is low, since there are so many sites. GBIS's problem is that it has so few users, and most of them are in the Reno/Sparks and Carson City areas, about 100,000 total households and an unknown number of those using GBIS which is the main competitor to the phone company in the Reno DSL market, and Craigslist is so widely used. The problem is that as dead IP's pile up, the odds of getting starcrossed increase, and suddenly your favorite site is dead. There's gotta be a better way of blocking people.