Silk Road forums
Discussion => Silk Road discussion => Topic started by: JohnTheBaptist on September 03, 2013, 11:43 am
-
This is so fucking annoying, what the fuck is going on, constant time outs, repeated error your last posting from this I,P
Why is this running like a bag of shite? You try and click on a post or thread and its timed out. Can somebody tell me what on gods green fucking earth is happening?
-
Main site won't load for me just now at all.
-
I know its terribly frustrating, all the time the site's been here, and we cant have it running smooth yet.
-
It is never going to be perfect though with a constant steam of attacks by "hackers" and LE.
-
It's probably due to the massive increase in the number of clients connecting to the Tor network, which has gone from 500K per day to over 2 million per day.
https://metrics.torproject.org/direct-users.png?start=2013-01-01&events=off&end=2013-09-03&country=all
At the same time, the advertised bandwidth in the network has actually decreased.
https://metrics.torproject.org/bandwidth.png?start=2013-01-01&end=2013-09-03
Tor is mostly CPU-bound, meaning that the crypto operations used to build circuits and push encrypted traffic are the limiting factor on the network. High bandwidth relays max out their CPUs long before they max out their bandwidth. Even with 1 Gbit ports, they can only push about 200-300 Mbit of traffic per core.
Some relay operators have posted to the tor-relays mailing list:
https://lists.torproject.org/pipermail/tor-relays/2013-August/002594.html
I'm currently seeing more than a doubling of connections (from a mean of
c. 2000 established connections to just over 5000) on my relay at
0xbaddad. The log is full of the (expected) messages:
"Your computer is too slow to handle this many circuit creation requests!"
I guess this is related to the massive jump in connected clients
in the past few days and I assume that everyone else is seeing
something similar.
So even though the new clients don't seem to be doing much (bandwidth isn't increasing), maintaining open circuits for 4 times as many clients is straining the relays. The whole network is slowed down with increased lag and a high percentage of failures when connecting to sites. Because circuits to hidden services use twice as many relays as circuits to clearnet sites, we should expect hidden service to be affected more by this.
As for what's causing so many clients to connect, nobody knows yet.
-
This is a wrinkle that needs to be ironed out somehow...
-
Is it possible that bots are being used to overload the tor network in an attempt by either L.E. or some other group as a form of attack or frustration for those who use sites like The Silk Road?
-
we have always heard that the more people on Tor the better it will run, but then now that it has happened we see that it doesn't run worth a shit! it is what it is, as they say- but as of right now we still do not know why so many more users, or how to fix the almost crippling effects, right?
-
If everyone sets up relaying it will run much better. Simple to do and helps everyone.
Try setting up a non exit relay, if enough people with bandwidth/processing power do it we will be back to normal.
-
If everyone sets up relaying it will run much better. Simple to do and helps everyone.
Try setting up a non exit relay, if enough people with bandwidth/processing power do it we will be back to normal.
exactly...
-
this happens all the time for me too. Happening right now, it normally only last a day though. it'll pass
-
I have had the same issue last few days. Two days ago I could not access SR or the forums. Yesterday I had to refresh a few times and logged on both sites.
Hope it improves soon, there is dope for me to smoke. :)
-
I can't get to SR at all right now. Forums seem to be OK for me
-
someone said it was up for them now.. still down for me though :/
-
Took hours to get on this morning just to get addresses/fill orders. Then it took hours again just to get on to mark em shipped when i got home. This is getting ridiculous, not sure how business can go on like this. Is anything being done to fix this? Its becoming almost a daily issue.
-
When are we going to get word on what has being happening the last 2 days? is the site under attack again should we be worried? seen another thread about Tor sites being shut down so would like to know before i out coins on here, feel sorry for the vendors no warnings or anything loosing out on lots of money and no warnings or answers thanks..
-
It's probably due to the massive increase in the number of clients connecting to the Tor network, which has gone from 500K per day to over 2 million per day.
https://metrics.torproject.org/direct-users.png?start=2013-01-01&events=off&end=2013-09-03&country=all
At the same time, the advertised bandwidth in the network has actually decreased.
https://metrics.torproject.org/bandwidth.png?start=2013-01-01&end=2013-09-03
Tor is mostly CPU-bound, meaning that the crypto operations used to build circuits and push encrypted traffic are the limiting factor on the network. High bandwidth relays max out their CPUs long before they max out their bandwidth. Even with 1 Gbit ports, they can only push about 200-300 Mbit of traffic per core.
Some relay operators have posted to the tor-relays mailing list:
https://lists.torproject.org/pipermail/tor-relays/2013-August/002594.html
I'm currently seeing more than a doubling of connections (from a mean of
c. 2000 established connections to just over 5000) on my relay at
0xbaddad. The log is full of the (expected) messages:
"Your computer is too slow to handle this many circuit creation requests!"
I guess this is related to the massive jump in connected clients
in the past few days and I assume that everyone else is seeing
something similar.
So even though the new clients don't seem to be doing much (bandwidth isn't increasing), maintaining open circuits for 4 times as many clients is straining the relays. The whole network is slowed down with increased lag and a high percentage of failures when connecting to sites. Because circuits to hidden services use twice as many relays as circuits to clearnet sites, we should expect hidden service to be affected more by this.
As for what's causing so many clients to connect, nobody knows yet.
Is this the affect of the Forbes thing we were expecting? I bet running tails or whonix comes into its own, it wasn't down for you no?
-
It's been hit or miss with me. I tried logging all morning and after using a new identity I got in both forums and main and they are running smooth, right now.
-
Both forums and main site have been intermittent and slow for me. >:( Also doing lots of Tor surfing, and that seems to be running just fine
-
Ughhhh. So frustrating. Hopefully see her back up n running here soon.
Will report back if I get anywhere past a Problem Loading Screen.
- IW
-
still isnt working. im about to get pretty upset :( I've done everything imaginable and it still wont pull up for me. Im going to try again tonight and oh my god it better be up.
-
Now the forums are intermittent, and the main site is down again...ARRRGGGGGGHHH....why does this happen in the middle of the most important deal?
Sods law?
-
ITS UP FOR ME!
GOGOGOGOGOGO
no joke.
- IW
-
Is it possible that bots are being used to overload the tor network in an attempt by either L.E. or some other group as a form of attack or frustration for those who use sites like The Silk Road?
Are you suggesting that LE infected over 2 million people's computers in order DOS the Tor network and prevent people from using SR? That's a class action lawsuit of epic proportions. No, these are probably some Russian/Eastern European hacker shitheads.
we have always heard that the more people on Tor the better it will run, but then now that it has happened we see that it doesn't run worth a shit!
The more people that run Tor, the bigger our anonymity set, but some of them also have to run relays. If 4000 relays can support 500K daily users, then we need 16,000 relays for 2 million users. The number of relays hasn't increased to keep up with the number of clients.
When are we going to get word on what has being happening the last 2 days?
Keep an eye on the tor-talk, tor-dev and tor-relays mailing lists at https://lists.torproject.org. They are trying to figure out what's going on and how to stop it.
Is this the affect of the Forbes thing we were expecting?
Almost certainly not. The increase started on August 19, and I don't know if the print article has even come out yet. The online article has received fewer than 400,000 views, not enough to account for an increase of 2 million clients.
Why does everyone thing SR is so big and special? It is really a tiny part of the Tor network and pretty much nothing that happens at a global network level is due to SR. When SR got DOSed in April, it didn't affect the rest of the Tor network at all.
-
Is it possible that bots are being used to overload the tor network in an attempt by either L.E. or some other group as a form of attack or frustration for those who use sites like The Silk Road?
Are you suggesting that LE infected over 2 million people's computers in order DOS the Tor network and prevent people from using SR? That's a class action lawsuit of epic proportions. No, these are probably some Russian/Eastern European hacker shitheads.
we have always heard that the more people on Tor the better it will run, but then now that it has happened we see that it doesn't run worth a shit!
The more people that run Tor, the bigger our anonymity set, but some of them also have to run relays. If 4000 relays can support 500K daily users, then we need 16,000 relays for 2 million users. The number of relays hasn't increased to keep up with the number of clients.
When are we going to get word on what has being happening the last 2 days?
Keep an eye on the tor-talk, tor-dev and tor-relays mailing lists at https://lists.torproject.org. They are trying to figure out what's going on and how to stop it.
Is this the affect of the Forbes thing we were expecting?
Almost certainly not. The increase started on August 19, and I don't know if the print article has even come out yet. The online article has received fewer than 400,000 views, not enough to account for an increase of 2 million clients.
Why does everyone thing SR is so big and special? It is really a tiny part of the Tor network and pretty much nothing that happens at a global network level is due to SR. When SR got DOSed in April, it didn't affect the rest of the Tor network at all.
I appreciate all the information. If I could karma you I would!
-
Is it possible that bots are being used to overload the tor network in an attempt by either L.E. or some other group as a form of attack or frustration for those who use sites like The Silk Road?
Are you suggesting that LE infected over 2 million people's computers in order DOS the Tor network and prevent people from using SR? That's a class action lawsuit of epic proportions. No, these are probably some Russian/Eastern European hacker shitheads.
we have always heard that the more people on Tor the better it will run, but then now that it has happened we see that it doesn't run worth a shit!
The more people that run Tor, the bigger our anonymity set, but some of them also have to run relays. If 4000 relays can support 500K daily users, then we need 16,000 relays for 2 million users. The number of relays hasn't increased to keep up with the number of clients.
When are we going to get word on what has being happening the last 2 days?
Keep an eye on the tor-talk, tor-dev and tor-relays mailing lists at https://lists.torproject.org. They are trying to figure out what's going on and how to stop it.
Is this the affect of the Forbes thing we were expecting?
Almost certainly not. The increase started on August 19, and I don't know if the print article has even come out yet. The online article has received fewer than 400,000 views, not enough to account for an increase of 2 million clients.
Why does everyone thing SR is so big and special? It is really a tiny part of the Tor network and pretty much nothing that happens at a global network level is due to SR. When SR got DOSed in April, it didn't affect the rest of the Tor network at all.
Very possibly a state-level military/intelligence-run botnet. Attention has been drawn to the conspicuous absence of the traffic spike in one particular country: https://metrics.torproject.org/users.html?graph=direct-users&start=2013-05-29&end=&country=il&events=off#direct-users
-
Here's the warning the relay operators are getting:
[warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy.
[5700 similar message(s) suppressed in last 60 seconds]
5700 of those messages in a minute!
-
Cheers astor, them Albanians, Lithuanians, Kosovans (jesse) know how to give the rest of Europe a bad name. This is the worst I've seen since last summer.
Yes the rest of tor hidden wiki and tor library are fine.
-
Are we sure it's the TOR network if other tor sites are working?
What kind of attacks are possible on sites like the SR?
-
Very possibly a state-level military/intelligence-run botnet. Attention has been drawn to the conspicuous absence of the traffic spike in one particular country: https://metrics.torproject.org/users.html?graph=direct-users&start=2013-05-29&end=&country=il&events=off#direct-users
If they made it that obvious, then they're not very smart, are they?
-
Very possibly a state-level military/intelligence-run botnet. Attention has been drawn to the conspicuous absence of the traffic spike in one particular country: https://metrics.torproject.org/users.html?graph=direct-users&start=2013-05-29&end=&country=il&events=off#direct-users
If they made it that obvious, then they're not very smart, are they?
maybe they didn't want to muck up their silk road access :P
fuckers are doing a number on mine tho...
-
I don't know. Snowden v. NSA maybe? ;D
It's probably due to the massive increase in the number of clients connecting to the Tor network, which has gone from 500K per day to over 2 million per day.
.....
As for what's causing so many clients to connect, nobody knows yet.
-
It's not some invasion, its not some military botnet. Though its possible anonymous is joining in the CP fight - I'd bet that more than anything else. The military has a new scapegoat: Syria. Money has instantaneously and completely stopped moving towards the fight against us, and has instantaneously been set aside to shoot some incendiary at stockpiles and generally go "oh hai, you used chemical weapons. bai!"
On a more serious note, I've been noticing issues opening the SR URL for longer than the past couple of days. I don't think the forbes article has anything to do with it, but the increased TOR traffic could be a reply to some of the things DPR said. I've had a significantly easier time accessing the forums than the main site. Unfortunately we can't see traffic directly to the site or know what is going on. *** I mean to say that, I don't think the forbes article has increased popularity. If anything, I would think and be happier to believe its a DOS attack, or a competitive thing, as a reply from Atlantis (though, I don't give them that much credit, and I don't think they were behind the original one either).
RE: The israel thing. Israel is in a state of military alert, moreso than the rest of the world. I wouldn't be surprised if the lack of spike is due to that.
-
Is it possible that bots are being used to overload the tor network in an attempt by either L.E. or some other group as a form of attack or frustration for those who use sites like The Silk Road?
Are you suggesting that LE infected over 2 million people's computers in order DOS the Tor network and prevent people from using SR? That's a class action lawsuit of epic proportions. No, these are probably some Russian/Eastern European hacker shitheads.
we have always heard that the more people on Tor the better it will run, but then now that it has happened we see that it doesn't run worth a shit!
The more people that run Tor, the bigger our anonymity set, but some of them also have to run relays. If 4000 relays can support 500K daily users, then we need 16,000 relays for 2 million users. The number of relays hasn't increased to keep up with the number of clients.
When are we going to get word on what has being happening the last 2 days?
Keep an eye on the tor-talk, tor-dev and tor-relays mailing lists at https://lists.torproject.org. They are trying to figure out what's going on and how to stop it.
Is this the affect of the Forbes thing we were expecting?
Almost certainly not. The increase started on August 19, and I don't know if the print article has even come out yet. The online article has received fewer than 400,000 views, not enough to account for an increase of 2 million clients.
Why does everyone thing SR is so big and special? It is really a tiny part of the Tor network and pretty much nothing that happens at a global network level is due to SR. When SR got DOSed in April, it didn't affect the rest of the Tor network at all.
Rly astor, u want to come up with a super technical explaination for why theres problems even though i can use tor for anything else just fine, u must be a computer wizzerd. face it SR has always been a piece of shit, but hey we have to FOCUS ON FEEDBACK.
-
https://silkroadvb5piz3r.onion.to/silkroad/home new address?
-
It seems to be working fine. I was having issues earlier.
-
https://silkroadvb5piz3r.onion.to/silkroad/home new address?
No j00lz, that is not a new URL. DO NOT use onion.to -- it is an insecure darknet web proxy for those without tor. It is NOT anonymous.
As for this slowdown, I don't think it's an attack of any kind. Probably just the flood of new tor users hammering relays with 10,000 crypto requests every 15 nanoseconds, overloading their CPUs like astor said.
Then again you never know, it could be another DoS attack or worse. Hopefully it gets cleared up soon. The problem seems to be abating as of a few hours ago.
-
The site is definetily down. I have been trying to access it for the last hour or so to no avail. I see no mods stating this is meant to be happening for any reason, And when maintenance is happening they take it down and leave an update page notifiying you when you try to sign in, Im just getting cannot connect. I have btc I need access to and this is seriously messing everything up.
For the last few days the site has been abnormaly slow to access, working but taking 5 refreshes and a new identity via vidalia to access, Now it's not working at all, It has been building up to this. Im just not sure what could have caused it.
As people are saying about the forbes article, It would make no difference, the TOR network gets better the more users it has, Well that is my understanding anyway. Astor also said the other day that the number of relays has increased, So I would have thought that would have sped things up as well. Correct me if I am wrong however.
I have no clue what the hell is going on. Mods?
Just as I was about to post I got the login page, Who knows what the hell is going on here. Thank fuck.
The Btc price went down to 83 quid, then back up to 87, perhaps that has something to do with it.
-
Whatever been happening it's seems to let off a bit for the day. I have been quickly browsing the main site for the last 10 minutes. *crosses fingers*
-
Having trouble myself today once again. Took me a good 15 minutes to get on here and the main site isn't loading for me. Nothing to purchase or finalize right now but I still like to do my daily browsing
-
It's not some invasion, its not some military botnet. Though its possible anonymous is joining in the CP fight - I'd bet that more than anything else. The military has a new scapegoat: Syria. Money has instantaneously and completely stopped moving towards the fight against us, and has instantaneously been set aside to shoot some incendiary at stockpiles and generally go "oh hai, you used chemical weapons. bai!"
On a more serious note, I've been noticing issues opening the SR URL for longer than the past couple of days. I don't think the forbes article has anything to do with it, but the increased TOR traffic could be a reply to some of the things DPR said. I've had a significantly easier time accessing the forums than the main site. Unfortunately we can't see traffic directly to the site or know what is going on. *** I mean to say that, I don't think the forbes article has increased popularity. If anything, I would think and be happier to believe its a DOS attack, or a competitive thing, as a reply from Atlantis (though, I don't give them that much credit, and I don't think they were behind the original one either).
I'm surprised to see you say this, frankly, Adam. You impressed me with a few of your messages recently. This one doesn't impress me -- don't get me wrong, we all make mistakes... but yes, to be clear, I believe your statements here are mistaken.
For everybody else who's saying it's the site:
HEY!!! ALL OF YOU SHORT ATTENTION SPAN FOOLS WHO AREN'T READING THE THREAD! IT IS NOT THE GODDAMN SITE: it's the network itself, now stop making yourselves look like idiots by blaming SR or the mods, will you.
-
When can we get answers? honestly TOR is not the problem was on BMR fine all day and once again SR and the forums are acting the cunt yet again no answers why cant DPR or the admins just put our minds at ease?
-
pirate bay fucked us..
fucking cunts..
-
It's probably due to the massive increase in the number of clients connecting to the Tor network, which has gone from 500K per day to over 2 million per day.
https://metrics.torproject.org/direct-users.png?start=2013-01-01&events=off&end=2013-09-03&country=all
At the same time, the advertised bandwidth in the network has actually decreased.
https://metrics.torproject.org/bandwidth.png?start=2013-01-01&end=2013-09-03
Tor is mostly CPU-bound, meaning that the crypto operations used to build circuits and push encrypted traffic are the limiting factor on the network. High bandwidth relays max out their CPUs long before they max out their bandwidth. Even with 1 Gbit ports, they can only push about 200-300 Mbit of traffic per core.
Some relay operators have posted to the tor-relays mailing list:
https://lists.torproject.org/pipermail/tor-relays/2013-August/002594.html
I'm currently seeing more than a doubling of connections (from a mean of
c. 2000 established connections to just over 5000) on my relay at
0xbaddad. The log is full of the (expected) messages:
"Your computer is too slow to handle this many circuit creation requests!"
I guess this is related to the massive jump in connected clients
in the past few days and I assume that everyone else is seeing
something similar.
So even though the new clients don't seem to be doing much (bandwidth isn't increasing), maintaining open circuits for 4 times as many clients is straining the relays. The whole network is slowed down with increased lag and a high percentage of failures when connecting to sites. Because circuits to hidden services use twice as many relays as circuits to clearnet sites, we should expect hidden service to be affected more by this.
As for what's causing so many clients to connect, nobody knows yet.
This ^^^^^^
-
It's probably due to the massive increase in the number of clients connecting to the Tor network, which has gone from 500K per day to over 2 million per day.
https://metrics.torproject.org/direct-users.png?start=2013-01-01&events=off&end=2013-09-03&country=all
At the same time, the advertised bandwidth in the network has actually decreased.
https://metrics.torproject.org/bandwidth.png?start=2013-01-01&end=2013-09-03
Tor is mostly CPU-bound, meaning that the crypto operations used to build circuits and push encrypted traffic are the limiting factor on the network. High bandwidth relays max out their CPUs long before they max out their bandwidth. Even with 1 Gbit ports, they can only push about 200-300 Mbit of traffic per core.
Some relay operators have posted to the tor-relays mailing list:
https://lists.torproject.org/pipermail/tor-relays/2013-August/002594.html
I'm currently seeing more than a doubling of connections (from a mean of
c. 2000 established connections to just over 5000) on my relay at
0xbaddad. The log is full of the (expected) messages:
"Your computer is too slow to handle this many circuit creation requests!"
I guess this is related to the massive jump in connected clients
in the past few days and I assume that everyone else is seeing
something similar.
So even though the new clients don't seem to be doing much (bandwidth isn't increasing), maintaining open circuits for 4 times as many clients is straining the relays. The whole network is slowed down with increased lag and a high percentage of failures when connecting to sites. Because circuits to hidden services use twice as many relays as circuits to clearnet sites, we should expect hidden service to be affected more by this.
As for what's causing so many clients to connect, nobody knows yet.
This ^^^^^^
Why like someone mentioned are other sites like BMR running like butter? Why am I getting quick page loads on these forums but the SR site won't even load up for me? It would just be nice to know if SR is having tech difficulties or if it is actually tor related. Initially I agreed and was thinking tor related but every other site I try to get on runs smooth and fast. Is SR under attack?
-
Just now got logged in to main site after several hours of trying. Whew...
Looks like it's just a congestion problem.
-
No signed message from DPR. Definitely seems like the site is under attack to me. This can't simply be congestion I've been trying to get on for hours.
-
No signed message from DPR. Definitely seems like the site is under attack to me. This can't simply be congestion I've been trying to get on for hours.
I'm having trouble making up my mind. First I thought tor issues then an attack and now it appears to just be a server over load or something because I was finally able to login and it's running pretty slow.
-
Well, sonofabitch, I was logged on, but now pages won't reload. Yeah, something no bueno is going on....
-
Yeah I havent been able to even see the login screen all day today
-
Just loaded for me!
-
DPR needs to add some more juice to the cluster or SR business will come to a halt. No vendor is going to be able to get anything done today.
-
Just loaded for me!
Cool. While you're logged on, would you mind checking on my order for me? Thx. ;-)
-
It's probably due to the massive increase in the number of clients connecting to the Tor network, which has gone from 500K per day to over 2 million per day.
+1 and thanks Astor for all the info.
From the Tor Project Blog (4th September 2013): "The tremendous influx of new clients that started mid-August is stretching the current Tor network and software to its limits. Several relay operators reported their relays to be saturated by the amount of connections and circuits that relays currently have to handle."
-
Tor is under attack, at least according to one of our resident experts (kmf): http://dkn255hz262ypmii.onion/index.php?topic=209957.0
A huge botnet is attacking Tor, nobody is sure exactly what it is doing but some think it could be trying to trace hidden services by tracing to entry guards and knocking them out until the HS's select attacker guards.
I know they're trying to figure this out over at tor talk, although I'm not sure if they're going with the "it's an attack" angle or if the tor devs are still assuming this problem is caused by the large influx of users eating up CPU.
EDIT: ...and the tor project just released their latest newsletter addressing the issue: https://blog.torproject.org/blog/ (CLEARNET)
-
it looks like from that newsletter that too many people are using the old Tor software. update, people, update!
-
"Use a New Identity" until you get a fast response. It's not the site it seems, it's the routes to the site, I think.
-
it looks like from that newsletter that too many people are using the old Tor software. update, people, update!
Having the clients update their Tor version won't help. It's the relays which have to update.
In case it wasn't already clear, it's not just the Silk Road which suffers. It's all hidden services. Even the hidden service of the OFTC (clearnet) IRC network suffers, so it's not targeted at any specific hidden services.
-
it looks like from that newsletter that too many people are using the old Tor software. update, people, update!
Having the clients update their Tor version won't help. It's the relays which have to update.
In case it wasn't already clear, it's not just the Silk Road which suffers. It's all hidden services. Even the hidden service of the OFTC (clearnet) IRC network suffers, so it's not targeted at any specific hidden services.
+1
-
Thank you for everyone who has joined this discussion.
I feel that if it is a traffic or relay problem then it is time for me to do my part and get a relay going, I mean it's only right; I enjoy the site and want others to do so too.
If it is a traffic problem demand will grow and so will the number of relays to match demand; it's either keep up with the growth of the network or risking a possible crash (I am not an expert on computer programming or networking so if it is not possible to crash the tor network forgive my ignorance).
Like anything else that we hold dear we each have a role in insuring the survival and prosperity of the thing.
And if it is an attacker it is sad that in a world with all the things available to us that such an individual cannot find any fulfillment in anything other than impeding the growth of other beings..
-
Malware botnet confirmed: Why Silk Road is down
« on: September 05, 2013, 01:00 pm »
Quote
Quote
In recent days, we have indeed found evidence which suggests that a specific and rather unknown botnet is responsible for the majority of the sudden uptick in Tor users.
Quote
. It does however originate from a Russian spoken region, and is likely motivated by direct or indirect financial related crime.
http://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-network-overload/
Recently, Roger Dingledine described a sudden increase in Tor users on the Tor Talk mailinglist. To date there has been a large amount of speculation as to why this may have happened. A large number of articles seem to suggest this to be the result of the recent global espionage events, the evasion of the Pirate Bay blockades using the PirateBrowser or the Syrian civil war.
At the time of writing, the amount of Tor clients actually appears to have more than quintupled already. The graph shows no signs of a decline in growth, as seen below:
An alternative recurring explanation is the increased usage of botnets using Tor, based on the assertion that the increase appears to consist of mostly new users to Tor that apparently are not doing much given the limited impact on Tor exit performance. In recent days, we have indeed found evidence which suggests that a specific and rather unknown botnet is responsible for the majority of the sudden uptick in Tor users. A recent detection name that has been used in relation to this botnet is “Mevade.A”, but older references suggest the name “Sefnit”, which dates back to at least 2009 and also included Tor connectivity. We have found various references that the malware is internally known as SBC to its operators.
Previously, the botnet communicated mainly using HTTP as well as alternative communication methods. More recently and coinciding with the uptick in Tor users, the botnet switched to Tor as its method of communication for its command and control channel. The botnet appears to be massive in size as well as very widespread. Even prior to the switch to Tor, it consisted of tens of thousands of confirmed infections within a limited amount of networks. When these numbers are extrapolated on a per country and global scale, these are definitely in the same ballpark as the Tor user increase.
Thus one important thing to note is that this was an already existing botnet of massive scale, even prior to the conversion to using Tor and .onion as command and control channel.
As pointed out in the Tor weekly news, the version of Tor that is used by the new Tor clients must be 0.2.3.x, due to the fact that they do not use the new Tor handshake method. Based on the code we can confirm that the version of Tor that is used is 0.2.3.25.
The malware uses command and control connectivity via Tor .onion links using HTTP. While some bots continue to operate using the standard HTTP connectivity, some versions of the malware use a peer-to-peer network to communicate (KAD based).
Typically, it is fairly clear what the purpose of malware is, such as banking, clickfraud, ransomware or fake anti-virus malware. In this case however it is a bit more difficult. It is possible that the purpose of this malware network is to load additional malware onto the system and that the infected systems are for sale. We have however no compelling evidence that this is true, so this assumption is merely based on a combination of small hints. It does however originate from a Russian spoken region, and is likely motivated by direct or indirect financial related crime.
This specific version of the malware, which includes the Tor functionality, will install itself in:
%SYSTEM%\config\systemprofile\Local Settings\Application Data\Windows Internet Name System\wins.exe
Additionally, it will install a Tor component in:
%PROGRAMFILES%\Tor\Tor.exe
A live copy for researchers of the malware can be found at:
hxxp://olivasonny .no-ip .biz /attachments/tc.c1
This location is regularly updated with new versions.
Related md5 hashes:
2eee286587f76a09f34f345fd4e00113 (August 2013)
c11c83a7d9e7fa0efaf90cebd49fbd0b (September 2013)
Related md5 hashes from non-Tor version:
4841b5508e43d1797f31b6cdb83956a3 (December 2012)
4773a00879134a9365e127e2989f4844 (January 2013)
9fcddc45ae35d5cdc06e8666d249d250 (February 2013)
b939f6ef3bd292996f97aa5786757870 (March 2013)
47c8b85a4c82ed71487deab68de196ba (March 2013)
3e6eb9f8d81161db44b4c4b17763c46a (April 2013)
a0343241bf53576d18e9c1329e6a5e7e (April 2013)
Thank you to our partners for the help in investigating this threat.
ProtACT Team & InTELL Team
« Last Edit: September 05, 2013, 01:12 pm by Bazille »
Report to moderator Logged
Tutorial: Encrypted and Torified Linux Virtual Machine on a Windows USB Stick: http://dkn255hz262ypmii.onion/index.php?topic=201405.0
Tutorial: Bootable and Encrypted Whonix on 8GB USB Stick: http://dkn255hz262ypmii.onion/index.php?topic=209572.0
Repost of Bazille's post.