7 ms·

I'm curious how you would construct a switch that couldnt be bypassed by the police once they have full access to the servers.

by aqme28 9y ago

dankent 9y ago
Even if the primary service itself was compromised, it would be possible to have an automated dead man's switch running on an alternative service that would alert the world that you were being held incommunicado. Of course, failing to disclose the switch to the authorities and thus allowing it to trigger could be considered a violation of a court order and lead to punishment.
- thaumasiotes 9y ago
  Also, it doesn't look good when you're arrested on suspicion of running Hansa and next morning Hansa has a big banner saying "the admin hasn't checked in, we think something is wrong".
  - hkon 9y ago
    The best point of them all.
    - mfoy_ 9y ago
      "the alleged admin hasn't checked in" X'D
- the_af 9y ago
  > Of course, failing to disclose the switch to the authorities and thus allowing it to trigger could be considered a violation of a court order and lead to punishment. Black market operators are unlikely to be willing to take this risk for the sake of their customers, but political activists/dissidents might for the sake of their audience.
- nextlevelwizard 9y ago
  You could start from something like this: https://www.youtube.com/watch?v=-bpX8YvNg6Y https://www.youtube.com/watch?v=-bpX8YvNg6Y
guelo 9y ago
A dead man's switch could wipe the server and all backups to erase evidence. The police in this case let the server run for months to catch other sellers. A well hidden software trigger would have been hard for the police to notice without a thorough inspection of all the source code.
- amelius 9y ago
  Unless the police made a backup immediately.
- PeterisP 9y ago
  As the article states, "Immediately after the arrest of the administrators, these servers and their corresponding infrastructure were seized and an exact copy of the market place was transferred to Dutch servers". A dead man's switch can't wipe the server and all backups, imaging the machine is the first thing one does (before e.g. attempting to log in); the only thing that may vary if you dump the machine with or without turning it off, e.g. getting a memory image by direct hardware access of a live system or imaging disks (and possibly RAM as well, the chips can be read if they're cooled and re-inserted quickly) after cutting the power.
milesvp 9y ago
As with all security it's a matter of layers, with each layer making it more difficult, but perhaps not impossible to bypass. A simple deadman's switch might be to host some key piece of the software on a remote server that is harder to access geopolitically and have it stop responding without a periodic login. Recurse a few layers in different geopolitical zones, and it could be a relatively effective deadman's switch. Performance may take a hit such that some kind of in memory caching is needed, but anyone seizing the servers would have to know to capture the memory and not just the disks before the switch activates in this case and it would still probably be effective. Add in some server wipe jobs, and maybe add some kind of man in the middle payload modifications as well, and you could keep some computer forensics techs scrambling to try to find it all. It'd be a pain to maintain it all, and it'd probably be the operator in the end who compromised everything, but it could be done.
- Vespasian 9y ago
  Why would any admin do this? It would absolutely ruin their chances of getting a more lenient sentence by cooperating with the authorities. The police have these people in physical custody. Why would they take a fall for their (also criminal) customers? There is nothing to gain but much to loose. PS: If there is not enough evidence for prosecution, having a dead man's switch would be incredibly stupid. It announces to everyone "You got the right guys. Keep digging for evidence"
  - mullen 9y ago
    > Why would any admin do this? It would absolutely ruin their chances of getting a more lenient sentence by cooperating with the authorities. The police have these people in physical custody. Why would they take a fall for their (also criminal) customers? There is nothing to gain but much to loose. Actually, having the DB and all important files encrypted would be a better negotiating position for the admin. If the police catch the Admin and also get the DB and important files unencrypted, what is the admins negotiating position? They have the Admin and the important files. In a perfect world, for the police, they want both, but a second best choice would be having the DB and important files with some jail time for the Admin. If I was the Admin I would give the police a choice, you can get me or can get me with reduced jail time and the DB and important file. You can get the conviction for the Admin and the buyers of the drugs too or Life for the Admin and let thousands of buyers and seller go free. Encrypted files would put the Admin in a great position.
netsharc 9y ago
I'm more curious about how the police were able to transfer the operation to servers under their control. Maybe Docker? Haha. My first guess would be that the admins were lazy and never encrypted their systems. Or maybe the cops got them to spill out the password (or hacked it out of one of their systems). In another hypothetical, I wonder if one can give one's lawyer the (password-protected) decryption key, and he can only release it when one signs a letter saying "I hereby request the keys under my own will with no duress.". If the cops are making him hand over the keys, the lawyer knows that's bullshit and can't legally be allowed to handover said key...
wang_li 9y ago
full disk encryption with a process on the box that will wipe the keys if it's not given the secret handshake on a daily basis?
baybal2 9y ago
>I'm curious how you would construct a switch that couldnt be bypassed by the police once they have full access to the servers. Make the killswitch physical, an attempt to open a server physically destroys it. This appears to work for carding rings that operate in the clear

I'm curious how you would construct a switch that couldnt be bypassed by the police once they have full access to the servers.

by aqme28 9y ago

I'm curious how you would construct a switch that couldnt be bypassed by the police once they have full access to the servers.

dankent 9y ago

Even if the primary service itself was compromised, it would be possible to have an automated dead man's switch running on an alternative service that would alert the world that you were being held incommunicado. Of course, failing to disclose the switch to the authorities and thus allowing it to trigger could be considered a violation of a court order and lead to punishment.

thaumasiotes 9y ago
Also, it doesn't look good when you're arrested on suspicion of running Hansa and next morning Hansa has a big banner saying "the admin hasn't checked in, we think something is wrong".
- hkon 9y ago
  The best point of them all.
  - mfoy_ 9y ago
    "the alleged admin hasn't checked in" X'D
the_af 9y ago
> Of course, failing to disclose the switch to the authorities and thus allowing it to trigger could be considered a violation of a court order and lead to punishment. Black market operators are unlikely to be willing to take this risk for the sake of their customers, but political activists/dissidents might for the sake of their audience.
nextlevelwizard 9y ago
You could start from something like this: https://www.youtube.com/watch?v=-bpX8YvNg6Y https://www.youtube.com/watch?v=-bpX8YvNg6Y

guelo 9y ago

A dead man's switch could wipe the server and all backups to erase evidence. The police in this case let the server run for months to catch other sellers. A well hidden software trigger would have been hard for the police to notice without a thorough inspection of all the source code.

amelius 9y ago
Unless the police made a backup immediately.
PeterisP 9y ago
As the article states, "Immediately after the arrest of the administrators, these servers and their corresponding infrastructure were seized and an exact copy of the market place was transferred to Dutch servers". A dead man's switch can't wipe the server and all backups, imaging the machine is the first thing one does (before e.g. attempting to log in); the only thing that may vary if you dump the machine with or without turning it off, e.g. getting a memory image by direct hardware access of a live system or imaging disks (and possibly RAM as well, the chips can be read if they're cooled and re-inserted quickly) after cutting the power.

milesvp 9y ago

As with all security it's a matter of layers, with each layer making it more difficult, but perhaps not impossible to bypass. A simple deadman's switch might be to host some key piece of the software on a remote server that is harder to access geopolitically and have it stop responding without a periodic login. Recurse a few layers in different geopolitical zones, and it could be a relatively effective deadman's switch. Performance may take a hit such that some kind of in memory caching is needed, but anyone seizing the servers would have to know to capture the memory and not just the disks before the switch activates in this case and it would still probably be effective. Add in some server wipe jobs, and maybe add some kind of man in the middle payload modifications as well, and you could keep some computer forensics techs scrambling to try to find it all. It'd be a pain to maintain it all, and it'd probably be the operator in the end who compromised everything, but it could be done.

Vespasian 9y ago
Why would any admin do this? It would absolutely ruin their chances of getting a more lenient sentence by cooperating with the authorities. The police have these people in physical custody. Why would they take a fall for their (also criminal) customers? There is nothing to gain but much to loose. PS: If there is not enough evidence for prosecution, having a dead man's switch would be incredibly stupid. It announces to everyone "You got the right guys. Keep digging for evidence"
- mullen 9y ago
  > Why would any admin do this? It would absolutely ruin their chances of getting a more lenient sentence by cooperating with the authorities. The police have these people in physical custody. Why would they take a fall for their (also criminal) customers? There is nothing to gain but much to loose. Actually, having the DB and all important files encrypted would be a better negotiating position for the admin. If the police catch the Admin and also get the DB and important files unencrypted, what is the admins negotiating position? They have the Admin and the important files. In a perfect world, for the police, they want both, but a second best choice would be having the DB and important files with some jail time for the Admin. If I was the Admin I would give the police a choice, you can get me or can get me with reduced jail time and the DB and important file. You can get the conviction for the Admin and the buyers of the drugs too or Life for the Admin and let thousands of buyers and seller go free. Encrypted files would put the Admin in a great position.

netsharc 9y ago

I'm more curious about how the police were able to transfer the operation to servers under their control. Maybe Docker? Haha. My first guess would be that the admins were lazy and never encrypted their systems. Or maybe the cops got them to spill out the password (or hacked it out of one of their systems). In another hypothetical, I wonder if one can give one's lawyer the (password-protected) decryption key, and he can only release it when one signs a letter saying "I hereby request the keys under my own will with no duress.". If the cops are making him hand over the keys, the lawyer knows that's bullshit and can't legally be allowed to handover said key...

wang_li 9y ago

full disk encryption with a process on the box that will wipe the keys if it's not given the secret handshake on a daily basis?

baybal2 9y ago

>I'm curious how you would construct a switch that couldnt be bypassed by the police once they have full access to the servers. Make the killswitch physical, an attempt to open a server physically destroys it. This appears to work for carding rings that operate in the clear