Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of mit.edu
	designates 18.7.68.36 as permitted sender) client-ip=18.7.68.36;
	envelope-from=jlrubin@mit.edu;
	helo=dmz-mailsec-scanner-7.mit.edu; 
MIME-Version: 1.0
From: Jeremy <jlrubin@MIT.EDU>
Date: Sun, 27 Jul 2014 22:12:11 -0400
Message-ID: <CAD5xwhhKKooGBfSY3nZzMmS=3WD=EdX9FQ7mZtQL3fkikuwyLg@mail.gmail.com>
To: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Content-Type: multipart/alternative; boundary=089e014941489553f604ff3774bd
Cc: alex@stamos.org
Subject: [Bitcoin-development] Abnormally Large Tor node accepting only
	Bitcoin traffic
Precedence: list

--089e014941489553f604ff3774bd
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hey,

There is a potential network exploit going on. In the last three days, a
node (unnamed) came online and is now processing the most traffic out of
any tor node -- and it is mostly plaintext Bitcoin traffic.

http://torstatus.blutmagie.de/router_detail.php?FP=3D0d6d2caafbb32ba85ee516=
2395f610ae42930124

Alex Stamos (cc'ed) and I have been discussing on twitter what this could
mean, wanted to raise it to the attention of this group for discussion.

What we know so far:

- Only port 8333 is open
- The node has been up for 3 days, and is doing a lot of bandwidth, mostly
plaintext Bitcoin traffic
- This is probably pretty expensive to run? Alex suggests that the most
expensive server at the company hosting is 299=E2=82=AC/mo with 50TB of tra=
ffic


--=20
Jeremy Rubin

--089e014941489553f604ff3774bd
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-family:arial,he=
lvetica,sans-serif;font-size:small;color:rgb(0,0,0)">Hey,<br><br></div><div=
 class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans-serif;fo=
nt-size:small;color:rgb(0,0,0)">

There is a potential network exploit going on. In the last three days, a no=
de (unnamed) came online and is now processing the most traffic out of any =
tor node -- and it is mostly plaintext Bitcoin traffic.<br><br><a href=3D"h=
ttp://torstatus.blutmagie.de/router_detail.php?FP=3D0d6d2caafbb32ba85ee5162=
395f610ae42930124">http://torstatus.blutmagie.de/router_detail.php?FP=3D0d6=
d2caafbb32ba85ee5162395f610ae42930124</a><br>

<br></div><div class=3D"gmail_default" style=3D"font-family:arial,helvetica=
,sans-serif;font-size:small;color:rgb(0,0,0)">Alex Stamos (cc&#39;ed) and I=
 have been discussing on twitter what this could mean, wanted to raise it t=
o the attention of this group for discussion.<br>

<br></div><div class=3D"gmail_default" style=3D"font-family:arial,helvetica=
,sans-serif;font-size:small;color:rgb(0,0,0)">What we know so far:<br><br><=
/div><div class=3D"gmail_default" style=3D"font-family:arial,helvetica,sans=
-serif;font-size:small;color:rgb(0,0,0)">

- Only port 8333 is open<br></div><div class=3D"gmail_default" style=3D"fon=
t-family:arial,helvetica,sans-serif;font-size:small;color:rgb(0,0,0)">- The=
 node has been up for 3 days, and is doing a lot of bandwidth, mostly plain=
text Bitcoin traffic<br>

</div><div class=3D"gmail_default" style=3D"font-family:arial,helvetica,san=
s-serif;font-size:small;color:rgb(0,0,0)">- This is probably pretty expensi=
ve to run? Alex suggests that the most expensive server at the company host=
ing is 299=E2=82=AC/mo with 50TB of traffic</div>

<br clear=3D"all"><br>-- <br><div dir=3D"ltr">Jeremy Rubin</div>
</div>

--089e014941489553f604ff3774bd--