Source
r/IAmA•
PeeBagger

I run a Tor exit node on a pool of 25 cablemodems to provide uncensored internet to China and Iran, AMA

Pretty much what the title says, for the last several years I have run a Tor exit node on a pool of cable modems and a few commercial internet connections. The cablemodems are all uncapped so I have a pool of about 50-75mb/sec up and 200-500mb/sec down just on that alone. (The cablemodems are spread across the city so the bandwidth is spread out)

Although I don't pick and choose the traffic that comes through I do restrict only to ports 80, 443, and 53 to allow only web and DNS traffic through, I'm sure some bittorrent goes through but that's NOT my intention.

EDIT: Thanks for the questions everyone but I think I'm about done.

Posted Apr 4, 2012, 11:18 PM UTC · edited

561306
Windowlickr•

To the OP....most MSO are running scripts to detect these clones and ban the MACs forcing the purchase of a new modem. Not to mention the limited amount of bandwidth per month the subscriber can use before penalties can happen.

How do you justify harming strangers you have cloned, in the name of your hacktivism. Not to mention if for whatever reason something illegal happens on this cloned MAC IP and draws the attention of the law and the subscriber is faced with legal issues?

38
PeeBaggerOP•

The ISP where I live does not do this, many modems have been up for 1+ years.

42
DrMnhttn•

Are you cloning the MAC addresses of legitimate subscribers, or are you just making up MAC addresses? If you're just making up MACs, you don't run the risk of framing someone else.

Are you concerned about your nodes being used for criminal purposes, though? Have you examined the traffic at all? I'm curious as to how much of it is people in oppressive countries fighting for their freedom vs people surfing CP or controlling their botnets.

13
[deleted]•

[deleted]

-50
ios_k•

It seems that own3d these days means "has an interesting question and gets an answer"

31
[deleted]•

[deleted]

1
[deleted]•

[deleted]

3
Legionaairre•

Rick Santorum 2012

0
[deleted]•

[deleted]

1
eastlondonmandem•

It would more than likely be possible to discriminate between the legit subscriber and the cloned one, especially if they are both online with an IP at the same time, as he says he runs them in a different area and it still connects.

1
[deleted]•

ban the MACs forcing the purchase of a new modem.

or, you know, you could just change the MAC? durr...

-2
tppiel•

Read the rest of the argument, smartass.

It's not about how he's unable to change MAC address (we all know he isn't), it's about how changing the MAC implies he's framing other people.

4
jackzander•

Or, you know, you could just keep reading and actually understand the argument.

How do you justify harming strangers you have cloned

-[Edit]: durr...

-5
OnVeryThinIce•

Sir,

Do you feel at all guilty or bad about using cable company bandwidth without paying? Do you consider what you are doing stealing?

What is the combined bandwidth that you are offering up to the tor network?

Also, do you plan on setting up more exit nodes?

Note: I think what you are doing is fucking awesome and fuck the cable companies. I just want to know how you rationalize it.

23
PeeBaggerOP•

I don't consider it stealing, and right now I have enough exit nodes to maintain.

18
Xatom•

The law considers this theft of service, you are using up bandwidth that you have not paid for. You are also stealing customers MAC addresses.

You could of tried to help without resorting to theft.

edit: downvotes, really? Is reddit saying that its ok to steal as long as you have a good enough reason?

2
jhartwell•

Is reddit saying that its ok to steal as long as you have a good enough reason?

I think most redditors will always support Robin Hood no matter what the cost (steal the bandwidth from the rich and give it to poor/oppressed)

8
SoFunAnon•

Don't go against the hive. It is not stealing if it is a corporation.

And so it goes...

2
ShufflinEveryday•

He's not using other customer's MAC addresses, read his other comment.

-6
PeeBaggerOP•

No I do use other customers MAC addresses, what comment did I make that confused this? They're all taken from people with open wireless who are likely to have trouble as it is.

3
[deleted]•

[deleted]

-2
tobusdm•

How did you get started? what gave you the idea?

17
PeeBaggerOP•

I watched the green protests in Iran on Al Jazeera English and decided to get involved with Tor. I had used Tor in the past.

27
fuckthisthread•

I live in China how do I connect to your internet so I don't have to deal with the firewall?

21
Saeveo•

Nice try, Chinese censor.

90
fuckthisthread•

Haha, right like a China censor would have perfect English and understand the plight of the foreign internet user.

17
[deleted]•

he obviously doesn't care for this thread

2
[deleted]•

[deleted]

-2
PeeBaggerOP•

It is my understanding that if you connect to a standard port (such as 80 or 443) it should work from within china, they do block the exit nodes as they can but all of mine are on DHCP so the blocks would only last until the exit node gets a new IP, a day or two.

7
fuckthisthread•

Well, I'll have to give it a shot and let you know if I can get it to work. The only thing I am worried about is that tor networks aren't secured. Do you think that could create a problem for me?

3
graingert•

They can block new nodes as they are announced on the network when a tor user connects they first get a list of all tor nodes to connect to. Also blocking access to exit nodes does not help, as routing nodes will be used to access them first

1
[deleted]•

[deleted]

3
fuckthisthread•

Yeah, it works but some articles/links are not. For the most part reddit is totally okay here. The big ones that don't work are r/funny, r/music, r/gonewild. The first two because of widespread useage of youtube the last because it is porn which is totally illegal here.

12
nibbles_and_bits•

Not sure how to connect directly to OP's TOR network with the TOR client, but here's the link to install Tor on your computer. It will automatically find the best route to connect to. You can configure it with Firefox by downloading an extension, or configure Windows with a proxy server pointing to Tor.

2
fuckthisthread•

I've tried tor here and can never get it to work. I use another service that works okay but is a little too expensive.

2
colondee•

And you think the censors don't download the newest version of Tor every time it's released and figure out how to block the default settings? It's their full time job.

1
Andreasgk•

What kind of shit do you see on there? O.o

14
PeeBaggerOP•

I do not have any way of inspecting the packets :)

I also do not look at destination IPs and don't log ANYTHING or keep any records :)

I do watch the state table from time to time and I have seen every country you could imagine so it is being used for something :/

24
Andreasgk•

I bet it would be so interesting to know what happens in there..

7
HiImDan•

So much child porn.

27
[deleted]•

how do you say " why don't you take a seat over here" in chinese?

9
Andreasgk•

Other than child porn... Like the drugs trades and assassins and so on.

0
OVKhaz•

Child Porn, Drugs, and Wikileaks.

OP is a terrorist.

-2
C0mmun1ty•

I thought you would be able to inspect packets, cause isn't it all decrypted on your end?

3
PeeBaggerOP•

You are correct I could (although it is not all decrypted only HTTP would be decrypted anything they do through HTTPS would be encrypted still) but I do not.

5
[deleted]•

[deleted]

3
[deleted]•

[deleted]

1
thebeefytaco•

I mean, people are also using TOR for child pornography, arms dealing, drug dealing, and contract killers...

(I still support the TOR project, just saying it's not all rainbows and gumdrops.)

12
PeeBaggerOP•

That happens over cellphones too, do you think the cell carriers feel bad?

Some bad comes with the good, can't stop it, so just have to assume it would happen anyway.

52
thebeefytaco•

Fair point; it's out of your control and the good seems to outweigh the bad.

17
[deleted]•

someone else would have done it; I'm in the clear!!```~~!!

Check the state table from time to time. Notice people who aren't from China, Iran, etc (the majority)? All CP, drugs, etc.

Keep fighting the good fight, bro. I'm sure the neckbeards of reddit love their kiddie fix.

-8
PeeBaggerOP•

Do you really think that me running an exit node makes any difference? People who want that sort of content will get it however they get it. Does outlawing drugs stop people from doing them?

Why don't you get pissed at the CP downloader's ISP they're just as responsible as I am -- in fact they're more so, they're taking money from the person to provide them their kiddy porn fix.

3
[deleted]•

Does outlawing drugs stop people from doing them?

That argument does not compare in any way. Outlawing drugs is an effort to reduce usage. What you are doing actively enables usage.

I'm not making a value judgement, just saying that your argument sucks.

0
[deleted]•

I noticed how you didn't reply.

I'm going to assume you wouldn't stop even if 100% were kiddie diddlers.

-1
[deleted]•

You're obviously supporting it. Is your ethical philopshy really "lol other people do no responsibility1!!"? Sure, they'll get it however they want, and you're not at fault for giving them the resources, derp.

Keep on, white knight, but know your "noble" is allowing untraceable kiddiefiles.

Why don't you get pissed at the

I do, shitbrain. Don't assume things.

-3
gigitrix•

You could say the same damn thing about SSL/TLS hiding your transactions from the government. What do YOU have to hide???

1
platypusmusic•

yes, 100% if it wasn't for TOR all crime would stop immediately, just like there wasn't any crime before TOR.

12
thebeefytaco•

That's not what I was implying...

19
[deleted]•

how do you have a taco next to your name

8
thebeefytaco•

Next to it? It's park of my username. Does your keyboard not have a taco key?

38
[deleted]•

a.author[href$="/thebeefytaco"]:before { content: url(http://f.thumbs.redditmedia.com/pbNn0E0OXrtMzceY.png) }

– http://www.reddit.com/r/iama/stylesheet.css

1
gigitrix•

All these things are facilitated by an untraceable currency that is sweeping he nation. It's called Bit.... no I mean Cash.

2
thebeefytaco•

How do you think I know about all of those things? ;)

3
bengtc•

don't know about you but I would rather be a part of the solution not part of the problem

1
mariuolo•

Let me see if I got this straight: you're having random people route the traffic of other random people without their knowledge?

What would happen if some tor user did something illegal and the ISP was asked to identify the subscriber?

12
94svtcobra•

you're having random people route the traffic of other random people without their knowledge?

That's how Tor works.. for everyone.. which is why it's secure

6
strolls•

No, the traffic which comes out of the Tor exit node is identifiable to whoever's hosting that exit node.

Not to the Tor user, but to the host of the exit node.
And OP is spoofing the host of the exit node.

So let's say the FBI set up an entrapment website full of child porn, and some dude from Tor accesses it.

If I'm the person hosting at my house the Tor exit node that happens to be used for this particular connection, then the Feds will turn up at my house. They'll seize all my computers, but I'll tell them that I'm hosting a Tor network and they'll eventually find no evidence and return them without charging me. It can be a bit more stressful than that, but that's it.

If the Tor connection to this CP site happens to be made through one of this guy's exit nodes, then the Feds will ask the ISP for the details of the subscriber who was allocated the IP at the time. So the exit node uses a cloned MAC belonging to J Smith of 33, Riverside Street, and that's where the Feds and their warrant will show up. The Feds will, once again, find no evidence of child porn (presumably), but a lot of inconvenience has been caused to Mr Smith - not only did the Feds seize his computers, but his wife may have divorced him.

14
krackbaby•

I drive a tan ciera

A pair of murderers drive a tan ciera

I get pulled over and accused of murder

I am innocent

Fuck tan cieras

-3
mariuolo•

A more fitting metaphor would be: a pair of murderers drive the same car with your cloned plates.

9
smellsliketuna•

Not sure if My Cousin Vinny fan, or Internet expert..

2
musschrott•

These do it without their consent or even knowledge!

3
relet•

Even better!

2
cp5184•

Ignorance is not an excuse.

1
mariuolo•

As long as it's a deliberate choice you can take your chances as you like.

Problem is this guy is doing it by proxy: in my neighbourhood this is called being a fag with somebody else's ass.

1
PeeBaggerOP•

The people are running open APs without protection, its likely their APs are being used for much worse already.

-1
Ijustdoeyes•

It would be more likely that the guys using "free internet" would do something wrong and n you get a request for the physical location of the IP.

First look will give you the MAC but you'll be able to see the node and that MAC will give you two simultaneous locations

1
PeeBaggerOP•

Yes this will happen, the ISP will detect that the modem was cloned. They will report this to the DMCA requester, and send a tech to the registered subscriber to replace their modem with a new one.

5
musschrott•

You might give the ISP too much credit. The subscriber might also be fucked.

4
DrMnhttn•

If your ISP isn't sophisticated enough to prevent your clones from coming online, what makes you think they can detect them?? I'll wager the ISP has received subpoenas from law enforcement to get the identity of your tor nodes, and they've handed over the innocent subscriber's information. :-O You've probably framed someone for child porn.

4
Ijustdoeyes•

That's unlikely.

It's not like jacking somebody's wireless which can be covered and routes to one point.

The ISP probably sweeps for clones once or twice a year, the numbers would be negligible but they would be always be able to discern that you have two MACs at two nodes.

On a cable network you an specify down to the actual tap being used.

Another thing to remember is that law enforcement doesn't need to look for the operators of TOR nodes to find people, all they do is run their own.

If you want to have fun run your own one day and log what goes through it, people /tend to miss that small detail.

3
PeeBaggerOP•

I have talked to people in the signal theft decision of the cable company on their own official discussion board and they flat out told me before they send a DMCA notice they check all nodes to detect duplicate MACs. It's not automated but they told me their own procedure is to check.

The people are running open APs (how I get the MACs) so its much more likely they would have someone doing something on their own connection than me getting them in trouble.

1
dtfgator•

This is pretty cool, I must say. Any tips on uncapping a modem? Anything to be aware of? Any risks? I'm capped at 20 because its the "fastest they provide in my area"... (Its bullshit, when Comcast first leased me the modem they accidentally left it uncapped and I was getting 50+ mbps down, hrmpf)

Also, any way I can use this to get free interwebz for myself?

11
PandaDentist•

Is it docsis 1.1?

1
dtfgator•

Its 3.0. Used to be a Motorola Surfboard but they just swapped it with a Ubee or something.

Does the generation effect the uncap or is that mostly based on the model or firmware?

1
PandaDentist•

IDK?

0
dragonworthy•

Why do you do it? What does it cost to you to do this?

10
PeeBaggerOP•

I just realized you probably meant per month.

I was at a conference that discussed "cable modem cloning" which simply put is a way to make your modem a clone of another subscribers. So I do this, connect a linux PC (ALIX or DD-WRT) with Tor. Some of these I give to friends to put in their house for me (free internet for them) others I have hidden in the utility closets of apartment complexes around the area. Marked them "MONITORED SECURITY SYSTEM DO NOT TAMPER" so I'm confident they'll be left alone.

31
dragonworthy•

I guess I might need some explanation on this - I imagine others here might too. How does this work? I can understand the concept of a cloned cable modem with internal settings pretending to be another, but I don't know how that works. If you can explain it I think we'll benefit, but a link to the right resource would work just as well.

13
PeeBaggerOP•

I wrote a custom app on my laptop that connects to open wifi APs and then scrapes the cable modem config page (usually http://192.168.100.1) and records the MAC address of the cable modem. These are all internet subscribers all over town (I drive all over the town for my job and all the surrounding towns). Then I program these MAC addresses into MY modems 3rd party firmware to "become" that subscriber. As long as you are not on the same node (the same physical cable network) your modem will give you full internet access. You can then do SNMP writes to remove the caps on the modem.

Of course if the subscriber cancels your internet also goes down, so something to be aware of.

22
dragonworthy•

Wow, that's actually pretty freagin amazing :)

To clarify: by cloning the cable modem (using the same MAC address), you can plug it into some other cable outlet so long as they don't reside in the same physical cable network?

If I'm right, how do you determine if a downtown cable modem is not part of the same network down south of the city? Is it more: within the street/apartment?

12
thisusernametakentoo•

So you deal with ARP conflicts by geography. Don't most cable companies authorize service based on the MAC? They don't notice two alike registered devices?

5
greenRiverThriller•

SNMP writes to remove the caps on the modem.

There is no way that STILL works

3
EarleneHadlock•

Care to drop your script in a pastebin?(or, if it's python/bash/ruby, give us a few hints and i'll have fun making it myself)

1
IDidntChooseUsername•

Wait a minute, so with only another internet subscriber's modem's MAC address you can steal their internet? Why don't the routers protect this info better?

1
redditorfor16days•

so are you using routers with a built in coax cable thing and plugging them into the wall, or how exactly are they connecting to the ISP's network?

0
[deleted]•

Dude you're like a goddamn spy. I love you!

0
PeeBaggerOP•

Each node probably costs about 250 and I've paid for it myself or used equipment that I have gotten for free (free cablemodems as people upgrade to DOCSIS 3 modems, old Linksys WRT54gs which can run TOR)

9
dragonworthy•

What's the recurrent cost on running/providing this service? I hope it's low enough, good on you to try and forward causes you believe in.

7
PeeBaggerOP•

Sorry hope you see my other reply, I don't pay anything per month.

7
[deleted]•

[deleted]

1
PeeBaggerOP•

I'm good, thanks. They'd have to be motorola surfboard 5100 for me to be interested at all, and those are dirt cheap.

3
[deleted]•

[deleted]

2
itsmrmarlboroman2u•

Proof? You aren't saying anything that can't be found on Google.

10
xooiid•

How does it feel being a hero?

On a serious note; how can others get involved?

7
PeeBaggerOP•

I'd suggest going alone because what I'm doing is not something you want to have someone blab about; and the only way to keep a secret is to tell no one! (Except the internet LOL)

25
overlord220•

Pretty Zen. 'Tell no one except everyone'

25
gigitrix•

He's no doubt using the freedoms that his own tools themselves bring to the world in order to safely impart his knowledge with us. Somewhere around the world, 3 other servers brought you these Reddit replies, so that he may inspire the network to grow. I find that Zen....

1
jggm2009•

Loose lips-sink ships!

1
The_Urban_Core•

Loose lips sink scripts in this case.

1
pwnyoface•

what is a tor exactly...?

7
[deleted]•

You send packets that lose shells of encryption at every node, peeling it down to the original thing you wanted to send by the time it reaches the recipient but being protected in route because of the encryption method. TOR is a network of these nodes that are hooked up to allow this type of communication. You will here the method called onion routing because that describes how the layers of encryption are sort of shed one after the other.

5
jackzander•

I've messed around with TOR, but didn't know that this is how it operates.

That's pretty neat, thanks for the rundown.

2
jpsirian•

Here you go!

3
pwnyoface•

thanks, still way confusing.
I wish i knew more about networking =/

3
slashblot•

You should probably not brag about this, or you're going to have a bad time.

6
[deleted]•

[deleted]

5
slashblot•

This is the dumbest thing I've ever heard. Next you'll tell me he knows who he is dealing with.

1
rabiat•

Yeah, because TOR makes you completely anonymous...

-2
[deleted]•

[deleted]

2
slashblot•

Who said he would be identified by TOR?

Just the fact that he is exposing himself in any way gives them clues. It's just kind of a bad practice to brag when you are doing something illegal or subversive.

He could be compromised by any number of details and correlation.

This is just plan stupid. Clearly OP needs validation and it will be his undoing. And it won't be the NSA coming after him.

1
gigitrix•

I fail to see any real flaw in the technology providing the user leaks no social information...

1
rlaw68•

So hopefully the social information OP has posted in this thread has been made up (props to you, OP -- so, so funny/pathetic that they're still trying to keep everybody from talking to everybody else).

1
musschrott•

First of, thank you for doing that.

But: Don't you have concerns about the people who's MAC address you cloned being liable when someone accesses cp/hacks somebody/$illegal activity and your their IP shows up in the logs? Or do I misunderstand the concept of exit node?

5
bluehat9•

If anything, I think that this possibly strengthens the argument of "My wifi is open/not open, but either way, someone other than me or my household 'hacked' my wifi and did these bad things you are saying." End result being that an IP is not strong enough evidence, and neither is a MAC address, to definitively say, "You did this bad thing on the internet."

3
gigitrix•

True this sucks, but on the other hand it provides plausible deniability. This phony idea of IP + timestamp = gotcha has to end.

2
PeeBaggerOP•

Yes, I have known people who have been "threatened" with DMCA lawsuit. On the one hand I wanted so bad to go to their lawyer and say "watch as I show you how I can become you on the internet in 5 minutes" but then again I would risk getting in trouble for having this knowledge. In the end they wrote a 2000 dollar check and never hired a lawyer.

2
[deleted]•

Do you catch any trouble from the Chinese or Iranian government? I can't imagine that they're OK with uncensored internet.

4
PeeBaggerOP•

I am not too concerned none of the boxes could easily be traced back to me and there are Tor exit nodes all over the globe so I'm certainly not raising any ire.

11
[deleted]•

(Other than you shaking your dick at the ISP throughout this post.)

1
gigitrix•

It's not like he posted IPs!

1
[deleted]•

[deleted]

4
freebullets•

http://www.sbhacker.net/forum/

Be warned that things aren't as easy as they used to be, and people aren't very helpful there. I'd love to find a more helpful and documented site.

3
PeeBaggerOP•

Things aren't easy if you live in Comcast country. If you have a rural American cable company (we don't even have digital cable available yet) then it's not nearly as hard.

1
jimbo-5-•

I live in Ireland we're just as far behind....

1
maheswara•

unless your modem is motorola surfboard type, I dont think its easy to uncap

0
justinb01981•

Upboat.

A brief writeup needs to be submitted to 2600, just to highlight how tenuous the cable-modem networks are, just sayin'. Thanks for posting this.

4
PeeBaggerOP•

It is well known, I have heard of people with pools of several thousand cable modems for controlling botnets, etc.

6
imatworkprobably•

Reading this thread made me feel like breaking out my trusty "Best of 2600"

1
tabledresser•
QuestionsAnswers
To the OP....most MSO are running scripts to detect these clones and ban the MACs forcing the purchase of a new modem. Not to mention the limited amount of bandwidth per month the subscriber can use before penalties can happen. How do you justify harming strangers you have cloned, in the name of your hacktivism. Not to mention if for whatever reason something illegal happens on this cloned MAC IP and draws the attention of the law and the subscriber is faced with legal issues?The ISP where I live does not do this, many modems have been up for 1+ years.
How did you get started? what gave you the idea?I watched the green protests in Iran on Al Jazeera English and decided to get involved with Tor. I had used Tor in the past.
I live in China how do I connect to your internet so I don't have to deal with the firewall? It is my understanding that if you connect to a standard port (such as 80 or 443) it should work from within china, they do block the exit nodes as they can but all of mine are on DHCP so the blocks would only last until the exit node gets a new IP, a day or two.
Well, I'll have to give it a shot and let you know if I can get it to work. The only thing I am worried about is that tor networks aren't secured. Do you think that could create a problem for me?Tor is encrypted but I have never lived behind an oppressive regime so I can't tell you what problem using it can/can't cause.
How does it feel being a hero? On a serious note; how can others get involved?I'd suggest going alone because what I'm doing is not something you want to have someone blab about; and the only way to keep a secret is to tell no one! (Except the internet LOL)
What kind of shit do you see on there? O.o.I do not have any way of inspecting the packets :)
I also do not look at destination IPs and don't log ANYTHING or keep any records :)
I do watch the state table from time to time and I have seen every country you could imagine so it is being used for something :/

View the full table on /r/tabled! | Last updated: 2012-04-09 12:34 UTC

This comment was generated by a robot! Send all complaints to epsy.

4
mrafaeldie12•

Have you ever been deteced/noticed by someone? Have you ever gotten any "funky" mail or anything of the sort?

3
[deleted]•

[deleted]

1
ftball21•

How boss do you feel as a human being?

3
94svtcobra•

A lot of people don't seem to understand how Tor works..

Here's a start, or better yet, do some research on your own before bashing OP

3