5 ms·

The central premise of the article is that there is no disclosure regarding the vulnerability used, suggesting the existence of some unknown zero-day exploit..

by jascii 7y ago

The central premise of the article is that there is no disclosure regarding the vulnerability used, suggesting the existence of some unknown zero-day exploit.. Various well documented analysis have linked this incident to "EgotisticalGiraffe", a well known -- and since fixed vulnerability. FUD or lazy journalism? I mean, at least read the subjects Wikipedia page before publishing something..

Miner49er 7y ago
EgotisticalGiraffe was the JS embedded in Freedom Hosting's web pages, which is mentioned by the article. Are you saying they hacked the site and inserted the JS? I assumed that was inserted after de-anonymizing the server and seizing it. A Wired article on it: https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ Slides: https://web.archive.org/web/20140413004837/http://cryptome.org/2013/10/nsa-egotisticalgiraffe.pdf https://web.archive.org/web/20140413004837/http://cryptome.o... A breakdown of the malware: https://web.archive.org/web/20140417081750/http://ghowen.me/fbi-tor-malware-analysis/ https://web.archive.org/web/20140417081750/http://ghowen.me/...
searcher1 7y ago
The article explicitly does mention "EgotisticalGiraffe" (the Firefox TBB exploit). But the point is that the exploit was dropped on all websites that Freedom Hosting was running, which raises the question that the article is really about, "how did they know where the hidden services were?"
- deleted 7y ago
  [deleted]
- jascii 7y ago
  I have searched and reread the article to find this "explicit mention" and have come up empty. Can you be more specific?
  - iffyspectrum 7y ago
    Ctrl+F Firefox in the article, there are a few paragraphs on that vulnerability and its role in the article. But that exploit, as I understand it, is not responsible for the first unmasking of Freedom Hosting which is the central question here.
    - jascii 7y ago
      Found it, thanks!
- hooch 7y ago
  Could they not purchase some “Freedom hosting” and upload a website with backdoor?
  - noident 7y ago
    This seems like the easiest way to do it, so I would speculate that this is how it was done. All you have to do is put a website up and make the server phone home, revealing the hidden IP address. Some more speculation: the government is hiding this fact in order to deter criminal use of Tor. Of course, I would still assume that other ways of discovering the location of hidden services have been found. I'm not convinced that onions can be hidden from an adversary with the resources of a US government agency, particularly in light of some of the posts that appeared on Hacker Factor recently.
  - freedrock87 7y ago
    How would they FBI know to purchase "Freedom hosting"?
seanthegeek 7y ago
The concern seems to be more of a legal one than a technical one. Law enforcement in theory should always disclose how they collect evidence.
- jascii 7y ago
  Should they? I know of no such law or theory. They have a burden of proof regarding the correctness of evidence and the defence can question the legality of collection methods if the evidence gets used in court. As far as I know, that's about it.
  - bredren 7y ago
    Does chain of custody have anything to do with this? I know in some computer forensics work it is important to be able to prove evidence has not been tampered with. So for example, cracking hashes instead of working with encrypted data can create safe space for non-leo to work without undermining an investigation. For example, a case of illegal doping, the accused Pearson’s samples must be able to be shown to not have been tampered with. It seems being able to prove the source of evidence would be the first step of this process.
    - jascii 7y ago
      Chain of custody is one tool used to satisfy part of the burden of proof regarding correctness of the evidence. There are others like sworn testimony or corroborating evidence. This only is meaningful in a courtroom situation, a lot of "evidence" never sees the courtroom and is merely used as information to help the investigation.
  - AlexCoventry 7y ago
    It's crucial to prevent the police from using illegal means to gather evidence. There's a rather famous legal doctrine about it. https://en.m.wikipedia.org/wiki/Fruit_of_the_poisonous_tree https://en.m.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

by jascii 7y ago

Miner49er 7y ago

EgotisticalGiraffe was the JS embedded in Freedom Hosting's web pages, which is mentioned by the article. Are you saying they hacked the site and inserted the JS? I assumed that was inserted after de-anonymizing the server and seizing it. A Wired article on it: https://www.wired.com/2013/09/freedom-hosting-fbi/ https://www.wired.com/2013/09/freedom-hosting-fbi/ Slides: https://web.archive.org/web/20140413004837/http://cryptome.org/2013/10/nsa-egotisticalgiraffe.pdf https://web.archive.org/web/20140413004837/http://cryptome.o... A breakdown of the malware: https://web.archive.org/web/20140417081750/http://ghowen.me/fbi-tor-malware-analysis/ https://web.archive.org/web/20140417081750/http://ghowen.me/...

searcher1 7y ago

The article explicitly does mention "EgotisticalGiraffe" (the Firefox TBB exploit). But the point is that the exploit was dropped on all websites that Freedom Hosting was running, which raises the question that the article is really about, "how did they know where the hidden services were?"

deleted 7y ago
[deleted]
jascii 7y ago
I have searched and reread the article to find this "explicit mention" and have come up empty. Can you be more specific?
- iffyspectrum 7y ago
  Ctrl+F Firefox in the article, there are a few paragraphs on that vulnerability and its role in the article. But that exploit, as I understand it, is not responsible for the first unmasking of Freedom Hosting which is the central question here.
  - jascii 7y ago
    Found it, thanks!
hooch 7y ago
Could they not purchase some “Freedom hosting” and upload a website with backdoor?
- noident 7y ago
  This seems like the easiest way to do it, so I would speculate that this is how it was done. All you have to do is put a website up and make the server phone home, revealing the hidden IP address. Some more speculation: the government is hiding this fact in order to deter criminal use of Tor. Of course, I would still assume that other ways of discovering the location of hidden services have been found. I'm not convinced that onions can be hidden from an adversary with the resources of a US government agency, particularly in light of some of the posts that appeared on Hacker Factor recently.
- freedrock87 7y ago
  How would they FBI know to purchase "Freedom hosting"?

seanthegeek 7y ago

The concern seems to be more of a legal one than a technical one. Law enforcement in theory should always disclose how they collect evidence.

jascii 7y ago
Should they? I know of no such law or theory. They have a burden of proof regarding the correctness of evidence and the defence can question the legality of collection methods if the evidence gets used in court. As far as I know, that's about it.
- bredren 7y ago
  Does chain of custody have anything to do with this? I know in some computer forensics work it is important to be able to prove evidence has not been tampered with. So for example, cracking hashes instead of working with encrypted data can create safe space for non-leo to work without undermining an investigation. For example, a case of illegal doping, the accused Pearson’s samples must be able to be shown to not have been tampered with. It seems being able to prove the source of evidence would be the first step of this process.
  - jascii 7y ago
    Chain of custody is one tool used to satisfy part of the burden of proof regarding correctness of the evidence. There are others like sworn testimony or corroborating evidence. This only is meaningful in a courtroom situation, a lot of "evidence" never sees the courtroom and is merely used as information to help the investigation.
- AlexCoventry 7y ago
  It's crucial to prevent the police from using illegal means to gather evidence. There's a rather famous legal doctrine about it. https://en.m.wikipedia.org/wiki/Fruit_of_the_poisonous_tree https://en.m.wikipedia.org/wiki/Fruit_of_the_poisonous_tree