14 ms·

A dark web tycoon pleads guilty, but how was he caught?

168 points by havella 7y ago

Causality1 7y ago
It's strange to me that people who make a habit of doing fantastically illegal things on the internet are always so sloppy about it. Even if they don't have the technical ability to break into their neighbor's wifi or set up a long range antenna to connect to an open access point they can still get a burner smartphone and drive to a Starbucks. Back when I used to torrent my TV shows I didn't even let my piracy laptop touch my home network and I never used that machine for anything other than downloading.
- deleted 7y ago
  [deleted]
- jandrese 7y ago
  Or the only people who get caught doing illegal stuff on the internet are the ones who are sloppy and give themselves away.
- dmschulman 7y ago
  Confirmation bias. Imagine all of the criminals out there who are running operations so well oiled that they leave little exposure for being caught.
- thinkloop 7y ago
  Upvoted. Another perspective is that if you are smart enough to know, then you're smart enough to know it's an impossible mission against state actors given enough time and would never try it. Downloading a movie at a Starbucks is one thing, running a 24/7 hosting operation without every accidentally leaking a single piece of data is nigh impossible.
- tonyedgecombe 7y ago
  I expect they thought they were doing the right thing by using Tor.
- zelly 7y ago
  > drive to a Starbucks Didn't help Ross. It's a bad idea to do illegal stuff in public.
  - HideousKojima 7y ago
    Ross was dumb enough to get fake passports/ids shipped directly to his home address
    - not2b 7y ago
      He made lots of stupid mistakes. https://www.theguardian.com/technology/2013/oct/03/five-stupid-things-dread-pirate-roberts-did-to-get-arrested https://www.theguardian.com/technology/2013/oct/03/five-stup...
    - edm0nd 7y ago
      While Ross did do some bad things, I do not think it is enough to warrant a double life sentence plus forty years without the possibility of parole. El Chapo, an actual drug cartel member who is directly responsible for thousands of deaths, only got a single life sentence. Ross got screwed on his sentencing and it is totally unjustified. Free Ross!
      - saber6 7y ago
        You're insane. His site facilitated numerous drug deals for profit. He also paid bitcoin in what he thought was a hit-job (he was duped). This dumbass can rot in prison. Screw him.
        ieS7rpVU 7y ago
        There is nothing wrong with facilitating drug deals and there is not a shred of evidence to support the other allegation. An allegation from the US government means absolutely nothing to me. It's also quite ironic that an organization that has assassinated numerous people are attempting to destroy the reputation of one of their enemies by claiming that he attempted to assassinate somebody.
- jascii 7y ago
  I suspect that if you have a useful understanding of information security there are better/easier/less risky ways to make money then crime..
- gwbas1c 7y ago
  Where there's a will, there's a way. The internet is designed to send data from point A to point B. Keeping point A and point B truly anonymous means that the internet won't work. Tools like Tor don't really protect you, it's more like they make it hard enough to figure out who you are that only people with strong incentives will track you down.
  - pinkfoot 7y ago
    > Keeping point A and point B truly anonymous Read and write encrypted packets to alt.anon ?
    - gwbas1c 7y ago
      Single point of failure: all you have to do is compromise alt.anon.
- Analemma_ 7y ago
  > It's strange to me that people who make a habit of doing fantastically illegal things on the internet are always so sloppy about it. This is completely the wrong way to think about it. Remember the Defender's Dilemma: to run an illegal business like this, your opsec needs to be perfect: every single possible channel of information leakage (including the "unknown unknowns"), every minute, every hour, every day, forever. You need to be lucky every time, the feds only need to be lucky once. When you focus on the specific mistakes that people made and thus call them "sloppy", you're missing all the things they did right; you might not have made those mistakes if you were in their position, but you would've made different mistakes.
- agoristen 7y ago
  We don't actually know for sure that he was doing "illegal things". He was running a hosting company ("Ultra Host") on the public facing web and later launched Freedom Host as a side business, or perhaps better described as a charitable hosting service to contribute to the Tor network. Freedom Host offered FREE hosting to people on the Tor network. What liability does he have if other people use his host for illegal things? From what I understand he was never personally involved in any of these activities. One can argue that he had to know about it, perhaps so, but the way he's being portrayed by LE and media is as if he was the kingpin of child porn. That's far from the truth. Freedom host served half of the Tor network, including perfectly legitimate services like Tormail, wikis etc. I think his mistake in not cloaking the identity used to purchase servers can be explained this way: He was never planning to host CP starting out (or do anything else illegal for that matter). He probably thought universally recognized no-liability laws would apply to Freedom Host just as any other hosting business. Perhaps he later went down a darker path, but at that point it was too late. The fact that he now pleads guilty means absolutely nothing however. Remember, he was extradited from his country to USA, and while he should never have been sent there, he now have to adapt to the way the "justice system" works over there and it works kind of like this: 5000 years in jail or take a plea deal and get away with 15-30 years. Even if he is innocent, you need to realize that when you're facing a kangaroo court and subsequent rotting away in jail for life it might be better to pick the lesser evil.
  - hatmatrix 7y ago
    According to [1] > Freedom Hosting has long been notorious for allowing child porn to live on its servers. In 2011, the hactivist collective Anonymous singled out the service for denial-of-service attacks after allegedly finding the firm hosted 95 percent of the child porn hidden services on the Tor network. In the hearing yesterday, [FBI Agent] Donahue said the service hosted at least 100 child porn sites with thousands of users, and claimed Marques had visited some of the sites himself. [1] https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/
- alasdair_ 7y ago
  >or set up a long range antenna to connect to an open access point Sure, this works for torrenting TV shows. If you are the number one peddler of child porn on the planet however, this won't help you for very long. The FBI (or whatever national police force is trying to find you) will just go to the access point, realize you're connected remotely and triangulate your position with (essentially) some signal-strength meters in much the same way the FCC tracks down particularly disruptive unlicensed broadcasters.
casefields 7y ago
Mirror: https://outline.com/L8ebnZ https://outline.com/L8ebnZ
pier25 7y ago
OTOH if these techniques and vulnerabilities were made public it would benefit cybercriminals as they could defend themselves better.
- philpem 7y ago
  It would also benefit whistleblowers, investigative journalists and other groups who routinely use Tor...
  - loufe 7y ago
    Not to mention the American Military which commisioned the technology/service for their own use in the first place.
  - pier25 7y ago
    Good point
  - ChrisCinelli 7y ago
    Unfortunately most of the things can be used for good and for bad. Secret communication is definitely one of them. And since the negative potential is huge, there is always going to be a incredible incentive of those looking for the criminals to inspect any form of communication. I think the potential of misuse by the "bad guys" is a lot higher at the moment compare to "good guys" to be caught. So for the general public, if you are not doing anything bad you should not worry... Right? I am a little paranoid. For example that things may shift in a way that today the "good guys" do not expect or undervalue. What if in the future the good guys become the bad guys? Or what if the bad guys get in control of the systems the "good guys" have? And of course in some countries the majority may be the "bad guys"... And in other things may not be so black or white.
- whatshisface 7y ago
  Law enforcement watches criminals, the judicial system watches law enforcement, the public watches the judicial system. Break one link in the chain and criminals will run free everywhere.
- 7y ago
rahuldottech 7y ago
Hacker Factor has a series of articles about various attacks on Tor: https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html https://www.hackerfactor.com/blog/index.php?/archives/868-De... The tor daemon really needs to be re-written and audited. Apparently the codebase right now is a huge mess.
- kodablah 7y ago
  There is an ongoing "rust"-ification of the codebase. I agree it is easier to audit when the code is clearer, but the majority of deanon attacks seem to concern network or browser techniques.
- rendx 7y ago
  Can you point to any attack that can be attributed to errors in the Tor code, anything where a rewrite or audit would have helped? Most "attacks" seem to be based on well-known drawbacks of the design which are usually discussed prior to specification or implementation (but unavoidable).
- newnewpdro 7y ago
  Running a hosting service is sure to include far more exploitable surface area than the tor network itself. Just assume any one of their servers were vulnerable to RCE attacks, they hosted dynamic web sites on conventional web hosting stacks! These things leak deanonymizing information like a sieve.
- zelly 7y ago
  You can make a mistake in your code and end up causing someone to go to prison. What a time to be alive.
  - AlexCoventry 7y ago
    In the 80s,it was already possible to make a mistake in your code which would cause someone to die horribly. https://en.m.wikipedia.org/wiki/Therac-25 https://en.m.wikipedia.org/wiki/Therac-25
sarakayakomzin 7y ago
what's with the sensationalism? https://en.wikipedia.org/wiki/Freedom_Hosting https://en.wikipedia.org/wiki/Freedom_Hosting https://www.infoworld.com/article/2611636/tor-browser-bundle-for-windows-users-susceptible-to-info-stealing-attack.html https://www.infoworld.com/article/2611636/tor-browser-bundle...
Pigo 7y ago
The military needs, or needed, Tor to be functioning and anonymous for their own use, correct?
- Diederich 7y ago
  That was the purpose of the initial DARPA grants funding Tor.
- strictnein 7y ago
  Tor was created to help dissidents of other nations communicate. The military does not run on Tor.
  - cronix 7y ago
    > Tor was created to help dissidents of other nations communicate [1] Why would the US Navy develop something to help dissidents in other nations? [1] https://en.wikipedia.org/wiki/Tor_(anonymity_network)#History https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor... > The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997
    - ohithereyou 7y ago
      It's also designed for dissidents in countries that are either opponents or rivals of the US: Russia, China, Iran, North Korea, Brazil, and Venezuela. It allowed for pro-US dissidents and agents to stay unidentifiable to these nations while distributing pro-US messages.
    - dsl 7y ago
      > Why would the US Navy develop something to help dissidents in other nations? From their website: "The [Naval Research Laboratory] works closely with the National Security Agency (NSA), Space and Naval Warfare Systems Command (SPAWAR), Defense Advanced Research Projects Agency (DARPA), and Defense Information Systems Agency (DISA)."
jascii 7y ago
The central premise of the article is that there is no disclosure regarding the vulnerability used, suggesting the existence of some unknown zero-day exploit.. Various well documented analysis have linked this incident to "EgotisticalGiraffe", a well known -- and since fixed vulnerability. FUD or lazy journalism? I mean, at least read the subjects Wikipedia page before publishing something..
- Miner49er 7y ago
  EgotisticalGiraffe was the JS embedded in Freedom Hosting's web pages, which is mentioned by the article. Are you saying they hacked the site and inserted the JS? I assumed that was inserted after de-anonymizing the server and seizing it. A Wired article on it: https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ Slides: https://web.archive.org/web/20140413004837/http://cryptome.org/2013/10/nsa-egotisticalgiraffe.pdf https://web.archive.org/web/20140413004837/http://cryptome.o... A breakdown of the malware: https://web.archive.org/web/20140417081750/http://ghowen.me/fbi-tor-malware-analysis/ https://web.archive.org/web/20140417081750/http://ghowen.me/...
- searcher1 7y ago
  The article explicitly does mention "EgotisticalGiraffe" (the Firefox TBB exploit). But the point is that the exploit was dropped on all websites that Freedom Hosting was running, which raises the question that the article is really about, "how did they know where the hidden services were?"
  - deleted 7y ago
    [deleted]
  - jascii 7y ago
    I have searched and reread the article to find this "explicit mention" and have come up empty. Can you be more specific?
    - iffyspectrum 7y ago
agoristen 7y ago
This report came out only a few months before he was caught: https://www.reddit.com/r/onions/comments/1guiav/we_have_analyzed_tor_hidden_services_and_shown/ https://www.reddit.com/r/onions/comments/1guiav/we_have_anal... He was likely de-anonymized through this technique or similar. The issue was that he trusted the Tor network to keep him anonymous and paid for the servers with his real identity.
- deleted 7y ago
  [deleted]
- justaj 7y ago
  Just to be clear: The v3 onion services fix that weakness, right?
  - emayljames 7y ago
    I am merely give my opinion, but a service created by the US government/Military is going to have undocumented "issues". I would not trust it one shred.
    - bufferoverflow 7y ago
      Tor is open source: https://www.torproject.org/download/tor/ https://www.torproject.org/download/tor/ So, no undocumented issues.
      - ngcc_hk 7y ago
        Issues can be undocumented if it is found by the 3 letter one, as pointed out in the article.
      - jokoon 7y ago
        I believe tor was researched designed and developed by the government
        7y ago
searcher1 7y ago
If you're wondering why a web host, who could potentially be immune to prosecution under CDA 230, was charged with the distribution of child pornography, according to the warrant [1] an admin of one of the pedo sites claimed that Freedom Hosting had "full control" over the websites (well, he had root access to the servers, but so did OVH), was patching the websites, that the pedo site hosting was free, and that he assumed that Marques covered the hosting costs as a service to the "pedo community". Technically the prosecutors might have had to prove that he knew what the sites were hosting, but he did plead guilty. Hopefully the actual operators of the pedo sites are found and prosecuted, and not just this sysadmin. [1] https://www.courtlistener.com/recap/gov.uscourts.mdd.247657/gov.uscourts.mdd.247657.13.1.pdf https://www.courtlistener.com/recap/gov.uscourts.mdd.247657/...
- vilhelm_s 7y ago
  CDA 230 immunity doesn't apply to federal crimes, only to civil lawsuits and state crimes. This was prosecuted under federal laws against child pornography, so it would not help them anyway.
- freedrock87 7y ago
  "According to the warrant". Take that with a grain of salt.
  - rendall 7y ago
    "but he did plead guilty". Also take that with a grain of salt. Often plea deals create quite an incentive to plead guilt even when innocent. "Go to trial, risk 20 years in prison branded as a child porn purveyor. Or plead guilty, cooperate as a witness, we'll charge you with a lesser crime that will have you out of prison in 3 years"
ohmygodel 7y ago
Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here's why: 1. Each hidden service chooses a "guard" relay to serve as the first hop for all connections. 2. A server running multiple hidden services has a guard for each of them. Each new guard is another chance to choose a guard run by the adversary. 3. An adversary running a fraction p of the guards (by bandwidth) has a probability p of being chosen by a given hidden service. A hosting service with k hidden services is exposed to k guards and thus has ~kp probability of chosen an adversary's guard. With, say, 50 hidden services, an adversary with only 2% of guards has nearly 100% chance of being chosen by one of those 50 hidden services. 4. The adversary can tell when it is chosen as a guard by connecting to the hidden service as a client and looking for a circuit with the same pattern of communication as observed at the client. Bauer at el. [0] showed a long time ago this worked even using only the circuit construction times. 5. The adversary's guard can observe the hidden service's IP directly. The risk of deanonymization with onion services in general (i.e. even not using an onion hosting service) is significant against an adversary with some resources and time. Getting 1% of guard bandwidth probably costs <$500/month using IP transit providers (e.g. relay 8ac97a37 currently has 0.3% guard probability with only ~750Mbps [1]). And every month or so a new guard is chosen, yielding another chance to choose an adversarial guard. Not to mention the risk of choosing a guard that isn't inherently malicious but is subject to legal compulsion in a given jurisdiction (discovering the guard of a hidden service has always been and remains quite feasible with little time or money, as demonstrated by Øverlier and Syverson [2]). [0] "Low-Resource Routing Attacks Against Tor" by Kevin Bauer, Damon McCoy, Dirk Grunwald, Tadayoshi Kohno, and Douglas Sicker. In the Proceedings of the Workshop on Privacy in the Electronic Society (WPES 2007), Washington, DC, USA, October 2007. [1] <https://metrics.torproject.org/rs.html#details/014E24C0CD21D2B9829E841D5EC1D3C415F866BF> https://metrics.torproject.org/rs.html#details/014E24C0CD21D... [2] "Locating Hidden Servers" by Lasse Øverlier and Paul Syverson. In the Proceedings of the 2006 IEEE Symposium on Security and Privacy, May 2006.
- rolltiide 7y ago
  Wasn't this 2013?? Its 2020 now so much has to have changed. Tor sucked 7 years ago.
marta_morena 7y ago
This sounds fishy. He probably pleaded guilty as part of a plea deal, so law enforcement has a scapegoat and some meaningless "media success" in exchange for him getting a drastically reduced sentencing. They always do that, threaten people with insane penalties if they don't accept so shitty plea deal and if you are not super certain that you can win, you will likely accept that one, just because it seems "safer". There are a LOT of cases like this, just most of them don't gain this publicity. Actually, 95% of court cases never reach court because of this. Innocent people plead guilty because they don't have the wealth and resources to win in court. USA is a shithole when it comes to law enforcement. Medieval and sad. Land of the free (as long as you are rich, that is).
- deadEndDave 7y ago
  >> They always do that, threaten people with insane penalties if they don't accept so shitty plea deal and if you are not super certain that you can win, you will likely accept that one, just because it seems "safer". Actually they don't. What they do is tell you the maximum amount of jail time you can get for the crimes for which you are being charged with. If you're good and cooperate with them, then the DA tells the judge that and they work to get you a reduced sentence. Be a prick or attempt to impeded their investigation or fall on the sword for your "homies" and they have the authority to go after the stiffest sentence possible. Even then its up to the presiding judge to ultimately take into account what the DA has told them and what the defense presents for its part and decide sentencing along predefined guidelines. Your entire comment is completely false and shows a total lack of knowledge of the US criminal justice system. >> Innocent people plead guilty because they don't have the wealth and resources to win in court. USA is a shithole when it comes to law enforcement. Medieval and sad. Land of the free (as long as you are rich, that is). You have the opportunity to be represented by a court appointed lawyer if you can't afford one. Depending on your case, if you actually do your homework, its pretty easy to find an attorney who will take your case for free. I've seen many, many low income defendants retain a real defense lawyer to try their case. Also, you do not "win" in a criminal case, you are either found "guilty" or "not guilty".
- ChrisCinelli 7y ago
  As a side note: Promise (YC startup) was also saying that 70% of people in jails are waiting for judgement or are in for a technical violation (ex: did not show up to a hearing). And being in jails they end up losing their job, eventually they lose their house etc. This is a space with a lot of low hanging fruits. And minor fixes may end up doing a lot of good.
deleted 7y ago
[deleted]
jokoon 7y ago
Isn't it rather trivial to find who is accessing a website if you can manage to monitor tor nodes? Just do some heuristic, to see when traffic happens, and over time, narrow down users. If you're the FBI and have the authority to monitor the whole internet, isn't it trivial to catch any tor user? Tor is still secure, but of course if you are the government and have skilled engineers, time and admin access to the internet infrastructure (by legit or covert means, I'm pretty sure the US can monitor traffic outside his jurisdiction), tor is not safe. But tor is still safe from countries other than the US, unless the US government have a problem with what you're doing. I would still be curious to see if tor does counter this problem by passively sending traffic to avoid this. Anyway I stand that there are 2 kinds of security: security against small bad actors, and security against competent, resourceful, big actors. The latter is usually impossible to get because it becomes extremely fastidious and complicated.
- safety-third 7y ago
  This would be more NSA jurisdiction and they do. The problem is most people's assumption is that if one part of the government has it, then everyone gets it. This is wildly false. Even within the FBI itself, different departments and cases get different tiers of access. Even when the case agents get access, policy dictates what evidence is allowed to be taken to a public trial. Otherwise you get repeats of the FBI/4chan/8chan debacle. This is especially true for legal "grey areas" like mass surveillance. This means that agents will often get evidence they won't use in order to guide active surveillance using more legal means in order to collect evidence they feel comfortable admitting in public court.
  - meowface 7y ago
    What FBI/4chan/8chan debacle? Are you referring to when an agent's search warrant evidence revealed their own 8chan posts? (https://ceinquiry.wordpress.com/2019/06/17/fbi-8chan/ https://ceinquiry.wordpress.com/2019/06/17/fbi-8chan/)
  - anxman 7y ago
    This is not accurate. The NSA launders evidence that would otherwise violate the 4th amendment through its "special operations division" using "parallel construction".
SadWebDeveloper 7y ago
afaicr the bug used was the one reported as MFSA 2013-53 aka CVE-2013-1690[1] but someone correct me if m wrong. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2013-53/ https://www.mozilla.org/en-US/security/advisories/mfsa2013-5...
- AlexCoventry 7y ago
  No, that was used after they had seized the site, to unmask its users.
ropiwqefjnpoa 7y ago
I mean, it's not like he's just some TOR user they were after, he ran a huge dark web hosting service. There's so much traffic and data to work with, it was just a matter of time.
bookAlot 7y ago
I think I recall him deciding to actually handle one of the exchanges or trades himself, usually information for a market in some weird new tech and the guy gets pinned on some illegal service between a student in some University and his own girlfriend at the time. When he decided to stop struggling against them and call them up they detained him to make sure he could arrange a more quiet service, in case he was using the 70s equal "reality" gimmick communists had going to fight the video game frenzy of the 70s and 80s pc games (women needed to help Mao "release" them). When the reality dealing wasn't equal like it was then, even with his capture, they just forgot about him and they're using this gimmick to arrange a capture of someone equally notorious (so he arranges himself to work with that low life) but the guy, Marques, isn't really involved in any of it. Just might be something like the brains, a founder even (his name is what circulates but he may be a brand user so people follow and buy what he does, like pirate roberts), his actual crime is not under investigation. They are trying to get him to do some of his own counseling between them so they can take over it, but that's what's what. It isn't the FBI. It's the local PDs, local to Marques, and while most have convincingly removed themselves from the situation, so Marques should be released, the socialist republic running Ireland doesn't actually congratulate losers on their appeal, and his ex-girlfriend, some reporter somewhere, is attempting to use prostitution in court to single out the property rights of what is happening, intellectual property, so she can't be seen as guilty, but she is guilty so we have just to arrange her release and she'll turn herself in. He will then be released and the FCC and other regulatiry facilities will be asked to release a filing of his release and some funding for a Federal grant that would remove him from fault, for any double jeopardy scams coming further out of Ireland, but there aren't any PD coming out to release him since any arrest made was on them and so was all the paper work. Convincingly enough, he may still have his own journey in place and as a young man still he could live off the lamb the moment he's released, and he will be released, if he ever makes a start on something criminal they pretty much have him guaranteed a slot in the kingpin category and no one will look for him without a full Federal front. They accidentally made an attorney but they don"t really have to borrow his time, so he's essentially Franzese without any crime to him, and he can just afford to offer people help for now and he'll pay them back later. When he can't arrange his release, the FBI may look to activism with a surge in what is probably vigilanteism and it isn't fun to say that any killing that occurs there will be on local drug dealers assuming his name so he remains kingpin. This is probably why the surge in drug knowledge AGAINST cartel. There's a false judge/commissioner (he controls most of the phones, last time I was there, 3 weeks) in Compton courthouse, on floor 9 (Family Law and Civil Law) named Victor M Acevedo and he is literally known by like 90% of PD and all government agencies as a corrupt clerk that is planting himself in drugs to kingpin himself using Marques' wrongful imprisonment but no one can do anything about it because no one knows how to describe the situation without breaking laws and giving other cartel mark-up, as a punishment for overlooking it so long. It's a blank slate to Marques and just another way to point pistols at people on the street and get away with it for people like Acevedo (he has pointed his pistol, twice, at me, specifically, out of his white mini van on Rosecrans Ave. for not being willing to let him continue). No one likes him in the area and his kids, about 200 of them, are constantly the victims of physical retaliation and their realty is the target of many random shootings. So that they just learn to sit too. Crime isn't fun.

168 points by havella 7y ago

It's strange to me that people who make a habit of doing fantastically illegal things on the internet are always so sloppy about it. Even if they don't have the technical ability to break into their neighbor's wifi or set up a long range antenna to connect to an open access point they can still get a burner smartphone and drive to a Starbucks. Back when I used to torrent my TV shows I didn't even let my piracy laptop touch my home network and I never used that machine for anything other than downloading.

deleted 7y ago
[deleted]
jandrese 7y ago
Or the only people who get caught doing illegal stuff on the internet are the ones who are sloppy and give themselves away.
dmschulman 7y ago
Confirmation bias. Imagine all of the criminals out there who are running operations so well oiled that they leave little exposure for being caught.
thinkloop 7y ago
Upvoted. Another perspective is that if you are smart enough to know, then you're smart enough to know it's an impossible mission against state actors given enough time and would never try it. Downloading a movie at a Starbucks is one thing, running a 24/7 hosting operation without every accidentally leaking a single piece of data is nigh impossible.
tonyedgecombe 7y ago
I expect they thought they were doing the right thing by using Tor.
zelly 7y ago
> drive to a Starbucks Didn't help Ross. It's a bad idea to do illegal stuff in public.
- HideousKojima 7y ago
  Ross was dumb enough to get fake passports/ids shipped directly to his home address
  - not2b 7y ago
    He made lots of stupid mistakes. https://www.theguardian.com/technology/2013/oct/03/five-stupid-things-dread-pirate-roberts-did-to-get-arrested https://www.theguardian.com/technology/2013/oct/03/five-stup...
  - edm0nd 7y ago
    While Ross did do some bad things, I do not think it is enough to warrant a double life sentence plus forty years without the possibility of parole. El Chapo, an actual drug cartel member who is directly responsible for thousands of deaths, only got a single life sentence. Ross got screwed on his sentencing and it is totally unjustified. Free Ross!
    - saber6 7y ago
      You're insane. His site facilitated numerous drug deals for profit. He also paid bitcoin in what he thought was a hit-job (he was duped). This dumbass can rot in prison. Screw him.
      - ieS7rpVU 7y ago
        There is nothing wrong with facilitating drug deals and there is not a shred of evidence to support the other allegation. An allegation from the US government means absolutely nothing to me. It's also quite ironic that an organization that has assassinated numerous people are attempting to destroy the reputation of one of their enemies by claiming that he attempted to assassinate somebody.
jascii 7y ago
I suspect that if you have a useful understanding of information security there are better/easier/less risky ways to make money then crime..
gwbas1c 7y ago
Where there's a will, there's a way. The internet is designed to send data from point A to point B. Keeping point A and point B truly anonymous means that the internet won't work. Tools like Tor don't really protect you, it's more like they make it hard enough to figure out who you are that only people with strong incentives will track you down.
- pinkfoot 7y ago
  > Keeping point A and point B truly anonymous Read and write encrypted packets to alt.anon ?
  - gwbas1c 7y ago
    Single point of failure: all you have to do is compromise alt.anon.
Analemma_ 7y ago
> It's strange to me that people who make a habit of doing fantastically illegal things on the internet are always so sloppy about it. This is completely the wrong way to think about it. Remember the Defender's Dilemma: to run an illegal business like this, your opsec needs to be perfect: every single possible channel of information leakage (including the "unknown unknowns"), every minute, every hour, every day, forever. You need to be lucky every time, the feds only need to be lucky once. When you focus on the specific mistakes that people made and thus call them "sloppy", you're missing all the things they did right; you might not have made those mistakes if you were in their position, but you would've made different mistakes.
agoristen 7y ago
We don't actually know for sure that he was doing "illegal things". He was running a hosting company ("Ultra Host") on the public facing web and later launched Freedom Host as a side business, or perhaps better described as a charitable hosting service to contribute to the Tor network. Freedom Host offered FREE hosting to people on the Tor network. What liability does he have if other people use his host for illegal things? From what I understand he was never personally involved in any of these activities. One can argue that he had to know about it, perhaps so, but the way he's being portrayed by LE and media is as if he was the kingpin of child porn. That's far from the truth. Freedom host served half of the Tor network, including perfectly legitimate services like Tormail, wikis etc. I think his mistake in not cloaking the identity used to purchase servers can be explained this way: He was never planning to host CP starting out (or do anything else illegal for that matter). He probably thought universally recognized no-liability laws would apply to Freedom Host just as any other hosting business. Perhaps he later went down a darker path, but at that point it was too late. The fact that he now pleads guilty means absolutely nothing however. Remember, he was extradited from his country to USA, and while he should never have been sent there, he now have to adapt to the way the "justice system" works over there and it works kind of like this: 5000 years in jail or take a plea deal and get away with 15-30 years. Even if he is innocent, you need to realize that when you're facing a kangaroo court and subsequent rotting away in jail for life it might be better to pick the lesser evil.
- hatmatrix 7y ago
  According to [1] > Freedom Hosting has long been notorious for allowing child porn to live on its servers. In 2011, the hactivist collective Anonymous singled out the service for denial-of-service attacks after allegedly finding the firm hosted 95 percent of the child porn hidden services on the Tor network. In the hearing yesterday, [FBI Agent] Donahue said the service hosted at least 100 child porn sites with thousands of users, and claimed Marques had visited some of the sites himself. [1] https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/
alasdair_ 7y ago
>or set up a long range antenna to connect to an open access point Sure, this works for torrenting TV shows. If you are the number one peddler of child porn on the planet however, this won't help you for very long. The FBI (or whatever national police force is trying to find you) will just go to the access point, realize you're connected remotely and triangulate your position with (essentially) some signal-strength meters in much the same way the FCC tracks down particularly disruptive unlicensed broadcasters.

casefields 7y ago

Mirror: https://outline.com/L8ebnZ https://outline.com/L8ebnZ

pier25 7y ago

OTOH if these techniques and vulnerabilities were made public it would benefit cybercriminals as they could defend themselves better.

philpem 7y ago
It would also benefit whistleblowers, investigative journalists and other groups who routinely use Tor...
- loufe 7y ago
  Not to mention the American Military which commisioned the technology/service for their own use in the first place.
- pier25 7y ago
  Good point
- ChrisCinelli 7y ago
  Unfortunately most of the things can be used for good and for bad. Secret communication is definitely one of them. And since the negative potential is huge, there is always going to be a incredible incentive of those looking for the criminals to inspect any form of communication. I think the potential of misuse by the "bad guys" is a lot higher at the moment compare to "good guys" to be caught. So for the general public, if you are not doing anything bad you should not worry... Right? I am a little paranoid. For example that things may shift in a way that today the "good guys" do not expect or undervalue. What if in the future the good guys become the bad guys? Or what if the bad guys get in control of the systems the "good guys" have? And of course in some countries the majority may be the "bad guys"... And in other things may not be so black or white.
whatshisface 7y ago
Law enforcement watches criminals, the judicial system watches law enforcement, the public watches the judicial system. Break one link in the chain and criminals will run free everywhere.
7y ago

rahuldottech 7y ago

Hacker Factor has a series of articles about various attacks on Tor: https://www.hackerfactor.com/blog/index.php?/archives/868-Deanonymizing-Tor-Circuits.html https://www.hackerfactor.com/blog/index.php?/archives/868-De... The tor daemon really needs to be re-written and audited. Apparently the codebase right now is a huge mess.

kodablah 7y ago
There is an ongoing "rust"-ification of the codebase. I agree it is easier to audit when the code is clearer, but the majority of deanon attacks seem to concern network or browser techniques.
rendx 7y ago
Can you point to any attack that can be attributed to errors in the Tor code, anything where a rewrite or audit would have helped? Most "attacks" seem to be based on well-known drawbacks of the design which are usually discussed prior to specification or implementation (but unavoidable).
newnewpdro 7y ago
Running a hosting service is sure to include far more exploitable surface area than the tor network itself. Just assume any one of their servers were vulnerable to RCE attacks, they hosted dynamic web sites on conventional web hosting stacks! These things leak deanonymizing information like a sieve.
zelly 7y ago
You can make a mistake in your code and end up causing someone to go to prison. What a time to be alive.
- AlexCoventry 7y ago
  In the 80s,it was already possible to make a mistake in your code which would cause someone to die horribly. https://en.m.wikipedia.org/wiki/Therac-25 https://en.m.wikipedia.org/wiki/Therac-25

sarakayakomzin 7y ago

what's with the sensationalism? https://en.wikipedia.org/wiki/Freedom_Hosting https://en.wikipedia.org/wiki/Freedom_Hosting https://www.infoworld.com/article/2611636/tor-browser-bundle-for-windows-users-susceptible-to-info-stealing-attack.html https://www.infoworld.com/article/2611636/tor-browser-bundle...

Pigo 7y ago

The military needs, or needed, Tor to be functioning and anonymous for their own use, correct?

Diederich 7y ago
That was the purpose of the initial DARPA grants funding Tor.
strictnein 7y ago
Tor was created to help dissidents of other nations communicate. The military does not run on Tor.
- cronix 7y ago
  > Tor was created to help dissidents of other nations communicate [1] Why would the US Navy develop something to help dissidents in other nations? [1] https://en.wikipedia.org/wiki/Tor_(anonymity_network)#History https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor... > The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997
  - ohithereyou 7y ago
    It's also designed for dissidents in countries that are either opponents or rivals of the US: Russia, China, Iran, North Korea, Brazil, and Venezuela. It allowed for pro-US dissidents and agents to stay unidentifiable to these nations while distributing pro-US messages.
  - dsl 7y ago
    > Why would the US Navy develop something to help dissidents in other nations? From their website: "The [Naval Research Laboratory] works closely with the National Security Agency (NSA), Space and Naval Warfare Systems Command (SPAWAR), Defense Advanced Research Projects Agency (DARPA), and Defense Information Systems Agency (DISA)."

jascii 7y ago

The central premise of the article is that there is no disclosure regarding the vulnerability used, suggesting the existence of some unknown zero-day exploit.. Various well documented analysis have linked this incident to "EgotisticalGiraffe", a well known -- and since fixed vulnerability. FUD or lazy journalism? I mean, at least read the subjects Wikipedia page before publishing something..

Miner49er 7y ago
EgotisticalGiraffe was the JS embedded in Freedom Hosting's web pages, which is mentioned by the article. Are you saying they hacked the site and inserted the JS? I assumed that was inserted after de-anonymizing the server and seizing it. A Wired article on it: https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ Slides: https://web.archive.org/web/20140413004837/http://cryptome.org/2013/10/nsa-egotisticalgiraffe.pdf https://web.archive.org/web/20140413004837/http://cryptome.o... A breakdown of the malware: https://web.archive.org/web/20140417081750/http://ghowen.me/fbi-tor-malware-analysis/ https://web.archive.org/web/20140417081750/http://ghowen.me/...
searcher1 7y ago
The article explicitly does mention "EgotisticalGiraffe" (the Firefox TBB exploit). But the point is that the exploit was dropped on all websites that Freedom Hosting was running, which raises the question that the article is really about, "how did they know where the hidden services were?"
- deleted 7y ago
  [deleted]
- jascii 7y ago
  I have searched and reread the article to find this "explicit mention" and have come up empty. Can you be more specific?
  - iffyspectrum 7y ago

agoristen 7y ago

This report came out only a few months before he was caught: https://www.reddit.com/r/onions/comments/1guiav/we_have_analyzed_tor_hidden_services_and_shown/ https://www.reddit.com/r/onions/comments/1guiav/we_have_anal... He was likely de-anonymized through this technique or similar. The issue was that he trusted the Tor network to keep him anonymous and paid for the servers with his real identity.

deleted 7y ago
[deleted]
justaj 7y ago
Just to be clear: The v3 onion services fix that weakness, right?
- emayljames 7y ago
  I am merely give my opinion, but a service created by the US government/Military is going to have undocumented "issues". I would not trust it one shred.
  - bufferoverflow 7y ago
    Tor is open source: https://www.torproject.org/download/tor/ https://www.torproject.org/download/tor/ So, no undocumented issues.
    - ngcc_hk 7y ago
      Issues can be undocumented if it is found by the 3 letter one, as pointed out in the article.
    - jokoon 7y ago
      I believe tor was researched designed and developed by the government
      - 7y ago

searcher1 7y ago

If you're wondering why a web host, who could potentially be immune to prosecution under CDA 230, was charged with the distribution of child pornography, according to the warrant [1] an admin of one of the pedo sites claimed that Freedom Hosting had "full control" over the websites (well, he had root access to the servers, but so did OVH), was patching the websites, that the pedo site hosting was free, and that he assumed that Marques covered the hosting costs as a service to the "pedo community". Technically the prosecutors might have had to prove that he knew what the sites were hosting, but he did plead guilty. Hopefully the actual operators of the pedo sites are found and prosecuted, and not just this sysadmin. [1] https://www.courtlistener.com/recap/gov.uscourts.mdd.247657/gov.uscourts.mdd.247657.13.1.pdf https://www.courtlistener.com/recap/gov.uscourts.mdd.247657/...

vilhelm_s 7y ago
CDA 230 immunity doesn't apply to federal crimes, only to civil lawsuits and state crimes. This was prosecuted under federal laws against child pornography, so it would not help them anyway.
freedrock87 7y ago
"According to the warrant". Take that with a grain of salt.
- rendall 7y ago
  "but he did plead guilty". Also take that with a grain of salt. Often plea deals create quite an incentive to plead guilt even when innocent. "Go to trial, risk 20 years in prison branded as a child porn purveyor. Or plead guilty, cooperate as a witness, we'll charge you with a lesser crime that will have you out of prison in 3 years"

ohmygodel 7y ago

Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here's why: 1. Each hidden service chooses a "guard" relay to serve as the first hop for all connections. 2. A server running multiple hidden services has a guard for each of them. Each new guard is another chance to choose a guard run by the adversary. 3. An adversary running a fraction p of the guards (by bandwidth) has a probability p of being chosen by a given hidden service. A hosting service with k hidden services is exposed to k guards and thus has ~kp probability of chosen an adversary's guard. With, say, 50 hidden services, an adversary with only 2% of guards has nearly 100% chance of being chosen by one of those 50 hidden services. 4. The adversary can tell when it is chosen as a guard by connecting to the hidden service as a client and looking for a circuit with the same pattern of communication as observed at the client. Bauer at el. [0] showed a long time ago this worked even using only the circuit construction times. 5. The adversary's guard can observe the hidden service's IP directly. The risk of deanonymization with onion services in general (i.e. even not using an onion hosting service) is significant against an adversary with some resources and time. Getting 1% of guard bandwidth probably costs <$500/month using IP transit providers (e.g. relay 8ac97a37 currently has 0.3% guard probability with only ~750Mbps [1]). And every month or so a new guard is chosen, yielding another chance to choose an adversarial guard. Not to mention the risk of choosing a guard that isn't inherently malicious but is subject to legal compulsion in a given jurisdiction (discovering the guard of a hidden service has always been and remains quite feasible with little time or money, as demonstrated by Øverlier and Syverson [2]). [0] "Low-Resource Routing Attacks Against Tor" by Kevin Bauer, Damon McCoy, Dirk Grunwald, Tadayoshi Kohno, and Douglas Sicker. In the Proceedings of the Workshop on Privacy in the Electronic Society (WPES 2007), Washington, DC, USA, October 2007. [1] <https://metrics.torproject.org/rs.html#details/014E24C0CD21D2B9829E841D5EC1D3C415F866BF> https://metrics.torproject.org/rs.html#details/014E24C0CD21D... [2] "Locating Hidden Servers" by Lasse Øverlier and Paul Syverson. In the Proceedings of the 2006 IEEE Symposium on Security and Privacy, May 2006.

rolltiide 7y ago
Wasn't this 2013?? Its 2020 now so much has to have changed. Tor sucked 7 years ago.

marta_morena 7y ago

This sounds fishy. He probably pleaded guilty as part of a plea deal, so law enforcement has a scapegoat and some meaningless "media success" in exchange for him getting a drastically reduced sentencing. They always do that, threaten people with insane penalties if they don't accept so shitty plea deal and if you are not super certain that you can win, you will likely accept that one, just because it seems "safer". There are a LOT of cases like this, just most of them don't gain this publicity. Actually, 95% of court cases never reach court because of this. Innocent people plead guilty because they don't have the wealth and resources to win in court. USA is a shithole when it comes to law enforcement. Medieval and sad. Land of the free (as long as you are rich, that is).

deadEndDave 7y ago
>> They always do that, threaten people with insane penalties if they don't accept so shitty plea deal and if you are not super certain that you can win, you will likely accept that one, just because it seems "safer". Actually they don't. What they do is tell you the maximum amount of jail time you can get for the crimes for which you are being charged with. If you're good and cooperate with them, then the DA tells the judge that and they work to get you a reduced sentence. Be a prick or attempt to impeded their investigation or fall on the sword for your "homies" and they have the authority to go after the stiffest sentence possible. Even then its up to the presiding judge to ultimately take into account what the DA has told them and what the defense presents for its part and decide sentencing along predefined guidelines. Your entire comment is completely false and shows a total lack of knowledge of the US criminal justice system. >> Innocent people plead guilty because they don't have the wealth and resources to win in court. USA is a shithole when it comes to law enforcement. Medieval and sad. Land of the free (as long as you are rich, that is). You have the opportunity to be represented by a court appointed lawyer if you can't afford one. Depending on your case, if you actually do your homework, its pretty easy to find an attorney who will take your case for free. I've seen many, many low income defendants retain a real defense lawyer to try their case. Also, you do not "win" in a criminal case, you are either found "guilty" or "not guilty".
ChrisCinelli 7y ago
As a side note: Promise (YC startup) was also saying that 70% of people in jails are waiting for judgement or are in for a technical violation (ex: did not show up to a hearing). And being in jails they end up losing their job, eventually they lose their house etc. This is a space with a lot of low hanging fruits. And minor fixes may end up doing a lot of good.

deleted 7y ago

[deleted]

jokoon 7y ago

Isn't it rather trivial to find who is accessing a website if you can manage to monitor tor nodes? Just do some heuristic, to see when traffic happens, and over time, narrow down users. If you're the FBI and have the authority to monitor the whole internet, isn't it trivial to catch any tor user? Tor is still secure, but of course if you are the government and have skilled engineers, time and admin access to the internet infrastructure (by legit or covert means, I'm pretty sure the US can monitor traffic outside his jurisdiction), tor is not safe. But tor is still safe from countries other than the US, unless the US government have a problem with what you're doing. I would still be curious to see if tor does counter this problem by passively sending traffic to avoid this. Anyway I stand that there are 2 kinds of security: security against small bad actors, and security against competent, resourceful, big actors. The latter is usually impossible to get because it becomes extremely fastidious and complicated.

safety-third 7y ago
This would be more NSA jurisdiction and they do. The problem is most people's assumption is that if one part of the government has it, then everyone gets it. This is wildly false. Even within the FBI itself, different departments and cases get different tiers of access. Even when the case agents get access, policy dictates what evidence is allowed to be taken to a public trial. Otherwise you get repeats of the FBI/4chan/8chan debacle. This is especially true for legal "grey areas" like mass surveillance. This means that agents will often get evidence they won't use in order to guide active surveillance using more legal means in order to collect evidence they feel comfortable admitting in public court.
- meowface 7y ago
  What FBI/4chan/8chan debacle? Are you referring to when an agent's search warrant evidence revealed their own 8chan posts? (https://ceinquiry.wordpress.com/2019/06/17/fbi-8chan/ https://ceinquiry.wordpress.com/2019/06/17/fbi-8chan/)
- anxman 7y ago
  This is not accurate. The NSA launders evidence that would otherwise violate the 4th amendment through its "special operations division" using "parallel construction".

SadWebDeveloper 7y ago

afaicr the bug used was the one reported as MFSA 2013-53 aka CVE-2013-1690[1] but someone correct me if m wrong. [1] https://www.mozilla.org/en-US/security/advisories/mfsa2013-53/ https://www.mozilla.org/en-US/security/advisories/mfsa2013-5...

AlexCoventry 7y ago
No, that was used after they had seized the site, to unmask its users.

ropiwqefjnpoa 7y ago

I mean, it's not like he's just some TOR user they were after, he ran a huge dark web hosting service. There's so much traffic and data to work with, it was just a matter of time.

bookAlot 7y ago

I think I recall him deciding to actually handle one of the exchanges or trades himself, usually information for a market in some weird new tech and the guy gets pinned on some illegal service between a student in some University and his own girlfriend at the time. When he decided to stop struggling against them and call them up they detained him to make sure he could arrange a more quiet service, in case he was using the 70s equal "reality" gimmick communists had going to fight the video game frenzy of the 70s and 80s pc games (women needed to help Mao "release" them). When the reality dealing wasn't equal like it was then, even with his capture, they just forgot about him and they're using this gimmick to arrange a capture of someone equally notorious (so he arranges himself to work with that low life) but the guy, Marques, isn't really involved in any of it. Just might be something like the brains, a founder even (his name is what circulates but he may be a brand user so people follow and buy what he does, like pirate roberts), his actual crime is not under investigation. They are trying to get him to do some of his own counseling between them so they can take over it, but that's what's what. It isn't the FBI. It's the local PDs, local to Marques, and while most have convincingly removed themselves from the situation, so Marques should be released, the socialist republic running Ireland doesn't actually congratulate losers on their appeal, and his ex-girlfriend, some reporter somewhere, is attempting to use prostitution in court to single out the property rights of what is happening, intellectual property, so she can't be seen as guilty, but she is guilty so we have just to arrange her release and she'll turn herself in. He will then be released and the FCC and other regulatiry facilities will be asked to release a filing of his release and some funding for a Federal grant that would remove him from fault, for any double jeopardy scams coming further out of Ireland, but there aren't any PD coming out to release him since any arrest made was on them and so was all the paper work. Convincingly enough, he may still have his own journey in place and as a young man still he could live off the lamb the moment he's released, and he will be released, if he ever makes a start on something criminal they pretty much have him guaranteed a slot in the kingpin category and no one will look for him without a full Federal front. They accidentally made an attorney but they don"t really have to borrow his time, so he's essentially Franzese without any crime to him, and he can just afford to offer people help for now and he'll pay them back later. When he can't arrange his release, the FBI may look to activism with a surge in what is probably vigilanteism and it isn't fun to say that any killing that occurs there will be on local drug dealers assuming his name so he remains kingpin. This is probably why the surge in drug knowledge AGAINST cartel. There's a false judge/commissioner (he controls most of the phones, last time I was there, 3 weeks) in Compton courthouse, on floor 9 (Family Law and Civil Law) named Victor M Acevedo and he is literally known by like 90% of PD and all government agencies as a corrupt clerk that is planting himself in drugs to kingpin himself using Marques' wrongful imprisonment but no one can do anything about it because no one knows how to describe the situation without breaking laws and giving other cartel mark-up, as a punishment for overlooking it so long. It's a blank slate to Marques and just another way to point pistols at people on the street and get away with it for people like Acevedo (he has pointed his pistol, twice, at me, specifically, out of his white mini van on Rosecrans Ave. for not being willing to let him continue). No one likes him in the area and his kids, about 200 of them, are constantly the victims of physical retaliation and their realty is the target of many random shootings. So that they just learn to sit too. Crime isn't fun.