5 ms·
This is why any server you want hidden should be behind something like whonix where no process running on the server should know the IP.
by ikeboy 9y ago
This is why any server you want hidden should be behind something like whonix where no process running on the server should know the IP.
- gruez 9y ago>where no process running on the server should know the IP. that's not the issue though. Even if the server was behind NAT (and thus only knows its internal IP), it could still find out its real external ip by sending packets to some other machine on the internet and checking what the "from" address was from. preventing this leak can only be done by having a strict routing table and/or outbound firewall. having VMs/containers 7 layers deep wouldn't help if the packets could freely reach the internet unproxied.
- ikeboy 9y agoif it was behind whonix, all outside traffic would be routed through tor. One of its selling points is that malware running on the VM as root cannot get the real IP (without additional exploits).
- therein 9y agoWhonix is great but the fact you need two servers and how the set up is more involved than just installing Tor and setting up a Hidden Service are the most common reasons why most takes the easy but less secure route. Whonix is amazing. I recommend it to anyone who is serious about avoiding even sending a single packet over the clearnet.
- ikeboy 9y agoEven doing it on a single server is more secure than whatever these guys had. You can only be found if there's an actual exploit in the VM or tor or something, webserver bugs don't pwn you alone.
- oh_sigh 9y agoDamn. If only those child pornographers knew this tip.
- KGIII 9y agoIf I were going to do something so very illegal, I'd research the hell out of it. If I were going to run something like this, I'd pretty much want to be an expert on the architecture and software stack. I'd be asking hundreds of questions, taking courses, and using as many layers as would be reasonable to hide even my efforts at learning. I'd probably be obsessed with security, more so than I am now. Much more so, in fact.
- cyphar 9y agoAnd then you'd likely be in a select group of people who could be investigated individually. OPSEC is hard in most circumstances, but it's very hard if you're trying to be an expert on one topic in a short period of time.
- KGIII 9y agoYeah, I'd even have to make a point to hide my learning. Only a specific subset of people would be asking how best to allow uploads while ensuring the IP address was masked via Tor. Added with other questions, it'd put me into a pretty narrow group, so even gathering information would need to be masked. Fortunately, I don't actually want to do anything illegal. That will make it easier. I do kind of want to learn how to set up a hidden service, but just to satisfy my curiosity.
- gjjrfcbugxbhf 9y agoThe original silk road fell because of an opsec failure in a post on stackoverflow...
- KGIII 9y agoA few weeks ago, and prompted by an HN post, I considered writing about the possibilities if ML as applied to large aggregate datum and with criminal investigation as the motivation. With all the public posts, writing style analytics, and use of a common moniker across services, it seems that it may be possible to do just that on a large scale. It seems that it could be made trivial to narrow down lists of suspects by crunching large data sets that contain stuff like SO questions, AC posts on Slashdot, or responses on HN. After all, how many people are actively seeking to secure a message board as a hidden service and doing so at that time? I sort of envision it as having some commonality with the timing attacks already in use to deanonymize Tor users. Subject A asked about securing IP addresses for uploads and Sevice A got this feature two weeks later. Subject C asked about this security aspect and Service A has that concern. Subject Q asked about using this forum software and requested this modification. Service A uses that software, etc... So, maybe Subjects A, C, and Q are all the same people. While it doesn't prove much, it does potentially aid in narrowing down the list of suspects. Coupled with other bits of information, it may narrow the list down significantly. That and there are huge sets of data out there. Processing that intelligently, and rapidly, could really change the way investigations are done.
- revelation 9y agoNo, it should be configured to use a purpose-made device that tunnels all traffic over Tor as gateway.
- Franciscouzo 9y agoYes, because running the server in your garage or getting a colocation deal for a special purpose-made device is certainly more secure.