3 ms·

Well maybe. If you become a big enough target then defence is about how expensive it is to find you.. Still, look at the folks who get caught by such agencies

Well maybe. If you become a big enough target then defence is about how expensive it is to find you.. Still, look at the folks who get caught by such agencies -- usually it's some amateur mistake... I think most of us can obtain suitably anonymous/blended bitcoins and spin up a .onion site which couldn't be directly linked to us in the way that SR was linked to DPR though, which was the point... Completely anonymous? Maybe not, you're right. Could you or I host a .onion site that, if we abandoned it as soon as it was up, would be impossible to tie to our real identities? Yes.

mirimir 10y ago
Yes, I am appalled by all the amateur mistakes that I read about. But one can't rely just on Tor. CMU's exploit of the relay early bug, and cooperation with the FBI, pwned a few onion services. That didn't depend on any misconfiguration of the onion services that got pwned. The only defense would have been using private entry guards and/or nested VPN chains between the onion server and its guards. And that's not something that's widely known outside the darknet community. Your point about "abandoned it as soon as it was up" is a good one, though :) It's totally nontrivial to get around adversaries sniffing at those network edges ;)
- cyberpunk 10y ago
  I think it's pretty trivial to get around the edge sniffing.. You just need a bunch of pwned hops to go through first.. I mean.. Did you take a the infector code for mirai [0] when it was kicking about? It's beyond basic.. 20 of those nodes (literally CCTV cameras with busybox netcat....) is enough. Want to go harder? Burner 3G sim before you even start proxying through them towards entering TOR is what, an afternoon's work? Today the "Hajime" botnet [1] is reported at 300,000 infected internet connected nodes... Recon they're logging? [0]: https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be681b839eeff8ece1de8b245bcd5ffb02/mirai/bot/scanner.c https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be6... [1]: http://www.networkworld.com/article/3192925/security/next-gen-iot-botnet-hajime-nearly-300k-strong.html http://www.networkworld.com/article/3192925/security/next-ge...
  - mirimir 10y ago
    It's very hard for servers to evade edge sniffing, because it's trivial to modulate traffic with them. For an adversary with access to lots of intercepts, anyway. Users can protect themselves by using public WiFi hotspots or burner cell modems. But that's not workable for servers, unless you host them yourself, which is too iffy for me. But yes, DPR could have stayed anonymous, even if his onion server had been pwned.

mirimir 10y ago

Yes, I am appalled by all the amateur mistakes that I read about. But one can't rely just on Tor. CMU's exploit of the relay early bug, and cooperation with the FBI, pwned a few onion services. That didn't depend on any misconfiguration of the onion services that got pwned. The only defense would have been using private entry guards and/or nested VPN chains between the onion server and its guards. And that's not something that's widely known outside the darknet community. Your point about "abandoned it as soon as it was up" is a good one, though :) It's totally nontrivial to get around adversaries sniffing at those network edges ;)

cyberpunk 10y ago
I think it's pretty trivial to get around the edge sniffing.. You just need a bunch of pwned hops to go through first.. I mean.. Did you take a the infector code for mirai [0] when it was kicking about? It's beyond basic.. 20 of those nodes (literally CCTV cameras with busybox netcat....) is enough. Want to go harder? Burner 3G sim before you even start proxying through them towards entering TOR is what, an afternoon's work? Today the "Hajime" botnet [1] is reported at 300,000 infected internet connected nodes... Recon they're logging? [0]: https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be681b839eeff8ece1de8b245bcd5ffb02/mirai/bot/scanner.c https://github.com/jgamblin/Mirai-Source-Code/blob/6a5941be6... [1]: http://www.networkworld.com/article/3192925/security/next-gen-iot-botnet-hajime-nearly-300k-strong.html http://www.networkworld.com/article/3192925/security/next-ge...
- mirimir 10y ago
  It's very hard for servers to evade edge sniffing, because it's trivial to modulate traffic with them. For an adversary with access to lots of intercepts, anyway. Users can protect themselves by using public WiFi hotspots or burner cell modems. But that's not workable for servers, unless you host them yourself, which is too iffy for me. But yes, DPR could have stayed anonymous, even if his onion server had been pwned.