[tor-relays] IP addresses as false positives?

[Kura]

On 05/01/2015 08:59:41, grarpamp <grarpamp at gmail.com> wrote:
On Mon, Jan 5, 2015 at 3:33 AM, Kura wrote:
> I would say that maybe it's a possibility that traffic gets
> flagged as such too?
> ...
> antivirus [...] one that does
> traffic inspection

Oh, well that could be too. Tor traffic is crypted/obfuscated
and thus could generate a random hit that AV points at the
Tor binary as responsible for.

But the OP is getting URL's from AV so it may be
watching his localhost SOCKS for http streams.

What's weird is OP's "Object" is https://, which is
not terminated to plaintext anywhere but in the browser
or tor.

Perhaps not enough info.
Kura:   Indeed. I'm not exactly sure how or why that would be the case but, I thought my recent experiences with Tor on Windows might at least shed another piece of light on how AVs sometimes treat Tor. May be related, may be totally unrelated.

>From the error, you would expect the AV to be picking out content it deems as dangerous from the final response, i.e. the destination after the exit but, that seems a little odd to me, unless the AV consistently lists the same page as having a virus.


> machine, AVG reported that tor.exe was a possible virus and removed it, this
> also happened when we tested the Tor Vidalia bundle. This was simply a
> filesystem check though, rather than packet/traffic inspection. It was also
> very recent, within the last week.

Gratuitous listing by AVG perhaps?
Kura:   Quite possibly. AV companies are odd with how they treat certain things. Keygen programs on Windows are another big thing that they used to flag even if they were not dangerous at all.

On a semi-related note, I run a  fair number of exit and middle/guard relays that I can guarantee do not try to do anything naughty to content, feel free to test your Tor against them to see if you still get the same virus warnings, OP.



> On Mon, Jan 5, 2015 at 2:30 AM, eliaz wrote:
>> The antivirus program on a machine running a bridge occasionally
>> reports like so:
>>
>> Object: https://
>> Infection: URL:Mal [sic]
>> Process: ... \tor.exe
_______________________________________________
tor-relays mailing list
tor-relays at lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20150105/7b97f628/attachment-0001.html>