Tor Exit Nodes Mapped and Located

http://hackertarget.com/tor-exit-node-visualization/

by the_wanderer • 13 years ago

129 61 13 years ago

dgesang• 13 years ago

15 exit nodes in the kyrgyz republic hospital area alone? Can that be correct?

wfn2• 13 years ago

Perhaps simply multiple network interfaces / assigned IP addresses - all could actually reside in the same physical machine. (That's probably not good practice Tor-wise, of course - the nodes should be as dispersed as possible..)

edit now that I think about it, placing Tor exits in a hospital area might be a clever tactic to avoid them being raided (e.g. to freeze memory and attempt to extract some data about other nodes etc)..

anonymfus• 13 years ago

And just by coincidence they are placed at the center of the capital.

codesuela• 13 years ago

Thats just an error, if you check the IPs they all belong to EuroVPS who in turn seem to lease their lines from Leaseweb(Netherlands). Maybe Eurovps office used to be in Kyrgyzstan and the whois data was stale at the time this was mapped. (e.g. http://whois.domaintools.com/77.235.32.0) Same thing for the one in Almaty, Kazakhstan which is actually located in Belgium (http://whois.domaintools.com/89.106.244.21). Another example 46.37.160.114 maps to Vladivostok, but it actually belongs to BurstNET London.

kl0nk• 13 years ago

IP geolocalisation sucks badly. For example OVH got only 1 DC (well to be precise one big room) in Paris. Kimsufi are hosted in their DC in Roubaix (north of France). They also got another one located in the east (near Strasbourg). You can also buy an IP located in somewhere else in Europe but linked to your server in Roubaix.

X-Istence• 13 years ago

I'm with OVH, and I have various IP's with them. Some Geo-IP to the US, some Geo-IP to Canada ... always fun :-)

wfn2• 13 years ago

Just as I thought, the Kimsufi line is really popular (at least for these kinds of things)! :)

Wilya• 13 years ago

Any background on who "Conformal Systems" are and why they would operate exit nodes ? I'm not really familiar with who they are and what they do, but they seem to be the only one in the top-25 that isn't either a hosting company or a residential ISP.

(apart from Formless Networking, but that one is a bit more well known)

Not that it's not nice of them, but it seems a bit out of place.

EwanG• 13 years ago

Government contractor. Feel free to guess what they're being paid to do...

jazzyb• 13 years ago

Everything I can find on them indicates that they are simply an open source company who takes privacy and data security very seriously [1] -- which would explain why they are running tor exit nodes.

What information do you have that they are government contractors?

[1] https://www.conformal.com/

jcr5• 13 years ago

Casting doubts and aspersions when you don't know anything and haven't bothered to read up on what they do is extremely unfair.

They do some very impressive cryptographic deduplication. Essentially it's a method to deduplicate already encrypted data reliably. If you don't realize how amazingly cool that is, you need to do some reading. It's a really tough problem, and it solves a major pain point for anyone with large volumes of encrypted data (i.e. governments).

EDIT: Links

https://www.conformal.com/

https://www.cyphertite.com/

conformal4• 13 years ago

that's a pretty definite statement that is definitely false. Conformal Systems LLC has no government contracts at this time.

jolan• 13 years ago

Conformal is primarily a group of former OpenBSD developers.

lost_name• 13 years ago

https://www.conformal.com/about-us.html

Seems to me like it fits in with what else they do.

jcr5• 13 years ago

Conformal is a startup run by a group of former OpenBSD developers including Marco Peereboom (marco@), Owain Ainsworth (oga@), and others. I've met most of them in person, and I've interacted with them on mailing lists for nearly a decade and a half. They are all good people in my book, and they're very talented. On many occasions, both Marco and Owain have helped me debug problems while adding support for new hardware. I can think of one time when Marco asked for both root and serial access to one of my boxes so he could debug a HBA. I gave him root on the system, root on the serial concentrator box, and root access to the network enabled power strip for hard reboots. Yes, I trust him.

Surio2• 13 years ago

Very nice answer. Qualified, thoughtful with no loose ends.

conformal4• 13 years ago

hi there jcr, this is jy-p, thanks for the kind words :)

conformal4• 13 years ago

we have more bandwidth than we use and we donate this bandwidth to the tor project. we are fans of the tor project and care about protecting personal privacy and individual expression.

we have 3 nodes running up to 4 processes on each node. each node is capable of pushing out up to ~600 Mbps with 4 processes on it. the nodes run bitrig, a fork of openbsd that several of our developers hack on.

EDIT: i just read the linked article and i see why we are listed - we have our own ASN and run openbgpd from our colo space.

malandrew2• 13 years ago

Can you guys write up about your exit nodes, like how they are setup and whatnot? Maybe even post images of the software setup on the machines. This would make it easier for others to run an exit node, since they wouldn't have to worry about setting anything up.

bergie• 13 years ago

Interesting, all the Berlin exit nodes are in a place that is a huge construction area on the Museum Island. Based on this I suppose they were only able to do city-level positioning (GeoIP or something similar).

ffffruit• 13 years ago

I agree. Majority of Central London ones are right in the middle of the financial district.

koralatov• 13 years ago

And Edinburgh's are smack-bang in the middle of Princes Street Gardens, which is staggeringly unlikely unless they're subterranean...

tych02• 13 years ago

It's worth noting that the statistics may be skewed because e.g. of US-based operators run their nodes at foreign ISPs due to fear of US law enforcement. Countries with more "liberal" policies probably have more nodes because of this, but it doesn't necessarily mean there are more operators based in those countries.

badgar• 13 years ago

Ah, I see the distinction you're making: this is a map of exit nodes, not exit node operators. The operators can of course be anywhere in the world. For all we know based on just this map, all the tor exit node operators live in Antarctica.

hkmurakami• 13 years ago

I'm curious: what are the specific laws that we should be concerned about?

(Obviously the US has many draconian laws regarding cyber-anything, but I'm curious what specific lines we cross with Tor Exit Node operation. Does it include something like ownership and responsibility of the data that passes through a node that we operate?)

liotier2• 13 years ago

Yes, obviously city-level GeoIP lookups.

yk• 13 years ago

He notes just above the map, that they used freegeoip.net. So it is indeed city level.

laumars• 13 years ago

The article clearly states that they're using GeoIP:

"Geolocation was performed against the IP addresses using the Free GeoIP API"

That quote even contained a hyperlink to Free GeoIP's website.

nwh2• 13 years ago

There's nothing new here. The exit nodes are public knowledge.

liotier2• 13 years ago

Sure, but public knowledge represented in a nice synthetic graphic way is more informative and more efficient at getting a point across.

nwh2• 13 years ago

It's already out of date though. You'd be better looking at the live list the author used.

http://torstatus.blutmagie.de/

josephscott• 13 years ago

Interesting map, zooming into Utah (where I live) shows that the local ISP Xmission is running 3 exit nodes. The map shows 4, but two of them have the same IP address.

kjackson2012• 13 years ago

Only 3 exit Tor nodes in the Bay Area? I'm surprised, I would have expected a lot more.

reycharles• 13 years ago

I think it's interesting that the vast majority are in Europe. I would have expected more in Asia and South America.

bifrost• 13 years ago

In case its not already obvious, most Geo-IP data is not particularly correct. In my experience its often off by 50-100 miles, and lucky if it even says the correct city. I've actually had Google say my IPs were in Singapore, when they were obviously not, and its a big pain to get Google to change that. Some of the other Geo-IP providers are better, but not by a whole lot in my experience.

If its also not obvious, most large TOR exit nodes are in datacenters and not in people's houses, for a variety of reasons.

D9u2• 13 years ago

I concur with your statements, as I've seen my own GeoIP resolve to someplace 3,000 miles away from my actual physical location.

Bravo for the data center mention as well. As someone who lives in a rural area, without access to high-speed connections, the idea of running a home based server just doesn't make sense.

jes5199• 13 years ago

That's an uncomfortably small number of exits, in my opinion.

lukejduncan2• 13 years ago

I'm a strong advocate of the Tor project, but man would I ever be afraid to be an exit node

mburns2• 13 years ago

It is worth noting that you can run Tor in non-exit mode, but still route (secure, encrypted) tunnels around for other Tor users. This is (ideally) how every Tor user should act, if at all possible.

traskjd• 13 years ago

Being pedantic, but if EVERYONE did that surely you'd never reach the actual internet right? :-)

lukejduncan2• 13 years ago

True. In fact I personally do this. I really want to run an exit node, but I'm also terrified of having my apartment raided and turned upside down for traffic flowing out of my place.

bcherry• 13 years ago

Two exit nodes near Washington DC. The NSA's headquarters are within the error tolerance of GeoIP. Coincidence?!

snowwrestler• 13 years ago

The map puts them in Ashburn, VA, which makes sense as there are massive commercial data centers there. If you have a server or VPS whose location is "east," there's a good chance that it is in an Ashburn data center.

chimeracoder• 13 years ago

Zooming in and clicking on the arrows:

> IP: Location: Netblock: AS Name: ISP: Reverse DNS: 50.16.161.238 Ashburn, United States 50.16.0.0/16 AMAZON-AES AMAZON.COM INC. ec2-50-16-161-238.compute-1.amazonaws.com

So, not a coincidence, but also not suspicious - it's just Amazon's data center.

malandrew2• 13 years ago

It's very sad that Europe has many times the number of exit nodes as the US has.

Tor Exit Nodes Mapped and Located

Related Stories