Skip to content

Instantly share code, notes, and snippets.

View nusenu's full-sized avatar

nusenu

105 followers · 0 following
View GitHub Profile
@nusenu
nusenu / tor-eol-contacts-2018-10-09.txt
Created October 9, 2018 09:21
contacts running end-of-life versions of tor as of 2018-10-09
+----------------------------------------------------------------------------------+-------------------------------------+--------+---------+
| contact | tor versions | cw | #relays |
+----------------------------------------------------------------------------------+-------------------------------------+--------+---------+
| Privacy Republic <abuse-team _at_ PrivacyRepublic _dot_ org> | 0.3.1.10 | 282500 | 4 |
| sirmatt ksu edu 0x94FBBB0A | 0.3.2.10,0.3.2.10-dev | 166800 | 2 |
| abuse@to-surf-and-protect.net | 0.3.2.10 | 157700 | 3 |
| Aleksandar Todorovic <aleksandar AT r3bl DOT me> GPG key ID: 0x2EC04023 | 0.3.2.10 | 106000 | 1 |
| tor-relay-admin robgjansen c
@nusenu
nusenu / 2018-09-24-ASNs-announcing-RPKI-unreachable-prefixes.txt
Last active September 25, 2018 14:46
2018-09-24 RPKI INVALID and unreachable IPv4 and IPv6 IP address space per announcing ASN
Data as of 2018-09-24
context: https://medium.com/@nusenu/where-are-rpki-unreachable-networks-located-65c7a0bae0f8
IPv4
====
+----------+------------------------------------------------------------------------------------------------+---------+---------------+
| ASN | (announcing) AS Name | Country | /24 netblocks |
+----------+------------------------------------------------------------------------------------------------+---------+---------------+
| AS4134 | CHINANET-BACKBONE No.31 | CN | 3714 |
| AS14080 | Telmex Colombia S.A. | CO | 484 |
@nusenu
nusenu / 2018-09-14-unreachable_INVALIDs_prefix-origin-pairs.txt
Last active September 15, 2018 13:07
A list of actually unreachable prefix-origin pairs due to RPKI validity state of INVALID with no alternatives (2018-09-14)
#
# context: https://medium.com/@nusenu/towards-cleaning-up-rpki-invalids-d69b03ab8a8c
#
# columns in that order:
#-------------------------
# source (trust anchor name)
# ASN according to ROA
# prefix according to ROA
# maxLength according to ROA (not all ROAs have that field)
# INVALID reason (length or ASN mismatch)
@nusenu
nusenu / tor-dns-april-2018.txt
Last active May 13, 2018 22:00
Tor Exit Relays using DNS resolvers outside their own AS (April 2018)
This list is NOT false-positive or false-negative free (IP-to-AS data is not perfect and some orgs have more than one AS number).
+----------------------------------------------------+---------------------+-----------------------------------------------+----------+
| contact | nickname | resolvers | FP |
+----------------------------------------------------+---------------------+-----------------------------------------------+----------+
| Zdravko Tzenov <torzpi222 AT gmail dot com> | torzpi222 | remoteAS | 53BB4CA9 |
| yonailo <juan@tuxe.es> - 12JG1Kpoet4nHYVtXTp7muzLf | yonailo | google/sameAS | 8C8F0AA3 |
| watchme <mydisco .AT. s y s t e m l i DOT o r g> | argenla | sameAS/remoteAS | 3A0D8802 |
| watchme <mydisco .AT. s y s t e m l i DOT o r g> | watchme |
@nusenu
nusenu / ContactInfo-for-EOL-relays-2018-05-01.txt
Last active May 1, 2018 07:22
ContactInfo-for-EOL-relays-2018-05-01.txt
+---------------------------------------------------------------------------------------------------------------------------+---------------------------------------------+------------+----+
| contact | versions | cwfraction | # |
+---------------------------------------------------------------------------------------------------------------------------+---------------------------------------------+------------+----+
| root@hacked.computer | 0.3.0.10 | 0.126 | 1 |
| unser_heim%at%gmx.ch | 0.2.5.16 | 0.121 | 2 |
| staff@dotsrc.org
@nusenu
nusenu / exit-dnssec-2018-04-09.txt
Created April 9, 2018 11:16
Let's increase the amount of exit relays doing DNSSEC validation
Dear Tor Exit Relay Operator,
thanks for operating tor exit relays!
In addition to forwarding packets exit relays also do DNS hostname resolution
on behalf of tor clients.
DNSSEC [1] is a standard that allows DNS clients to validate the authenticity of
DNS records (if the domain owner choose to enable DNSSEC). By enabling DNSSEC
on your exit relay DNS resolver you (and therefore also tor clients) are less prone to DNS-based attacks.
@nusenu
nusenu / exits-failing-dns
Last active November 20, 2017 23:05
tor exits failing DNS (>80%) as per 2017-11-12
+------------------------------------------+--------------------+----------------------------------------------------------------------------+
| fingerprint | nickname | contact | contacted
+------------------------------------------+--------------------+----------------------------------------------------------------------------+
| DAB96CEA61CC039A803217035293FAB32645FDDA | kree | 0x02225522 Frenn vun der Enn (FVDE) <info AT enn DOT lu> | y
| B84F248233FEA90CAD439F292556A3139F6E1B82 | tollana | 0x02225522 Frenn vun der Enn (FVDE) <info AT enn DOT lu> | y
| 9BDEC15EAE422563716AFE0025B9E66C9D4CCEBD | freki | 0x02225522 Frenn vun der Enn (FVDE) <info AT enn DOT lu> | y
| B0279A521375F3CB2AE210BDBFC645FDD2E1973A | chulak | 0x02225522 Frenn vun der Enn (FVDE) <info AT enn DOT lu> | y
| 5D1
@nusenu
nusenu / hackerfactor-blog-comment-nusenu.txt
Created September 23, 2017 22:57
my comment to blog post "A little honey goes a long way" on hackerfactor.com
This was meant as a comment for
https://www.hackerfactor.com/blog/index.php?/archives/776-A-little-honey-goes-a-long-way.html
but tor users cannot comment there.
Hi Neal,
you are linking to the page "https://nusenu.github.io/OrNetStats/" with the link
named "undocumented families". This might lead readers to think that all groups
(there are multiple) on that page are "undocumented" (bad) families - which is not the case.
@nusenu
nusenu / tor_version-to-proto.txt
Created September 9, 2017 18:22
Four unique proto lines identified (used partial Sep 2017 descriptor archive):
proto Cons=1-2 Desc=1-2 DirCache=1-2 HSDir=1-2 HSIntro=3-4 HSRend=1-2 Link=1-4 LinkAuth=1,3 Microdesc=1-2 Relay=1-2
proto Cons=1-2 Desc=1-2 DirCache=1 HSDir=1-2 HSIntro=3-4 HSRend=1-2 Link=1-4 LinkAuth=1,3 Microdesc=1-2 Relay=1-2
proto Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1-2 Link=1-4 LinkAuth=1,3 Microdesc=1-2 Relay=1-2
proto Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1-2 Link=1-4 LinkAuth=1 Microdesc=1-2 Relay=1-2
@nusenu
nusenu / potential_seizure_candidates.txt
Last active June 12, 2017 17:12
OVH and Online SAS (FR) based guard-only relays that disappeared between 2017-05-12 and 2017-05-18
Reach me at https://twitter.com/nusenu_ (or via email)
if you have more details.
+---------------------+----------+-----------------+---------------------+--------------------------------+
| last_seen | FP | IP | nickname | contact | comments
+---------------------+----------+-----------------+---------------------+--------------------------------+
| 2017-05-14 22:00:00 | 9E339307 | 37.187.18.109 | 1001001de2 | Admin 0671 D82 F F0 E1 9 3AA |
| 2017-05-18 23:00:00 | 0C2E5558 | 51.255.211.2 | AmnesicProsecutor | NULL |
| 2017-05-15 15:00:00 | 0639612F | 92.222.20.130 | Baki | tor0517@kiito.xyz | seized (confirmed by operator)
| 2017-05-12 17:00:00 | F0A13CA9 | 163.172.185.161 | caf4f922534cea81d13 | NULL |