3 ms·

"So, do police agencies have people who know enough about the mistakes people make with Tor and Bitcoin?" I met a researcher who did some work on attacking Tor

"So, do police agencies have people who know enough about the mistakes people make with Tor and Bitcoin?" I met a researcher who did some work on attacking Tor, the results of which were given to law enforcement agencies. He was a bit light on details, but the basic idea of his approach was this: 1. You narrow down the geographic location of your target. Not hard in the case of the Silk Road, since there is a physical package being shipped. 2. You connect to your target's system, and modulate the latency of packets that you send. This is a covert channel. 3. You have a van rolling around the geographic region you believe the target to be in, and listen on wifi frequencies. When the covert channel is detected, you home in until you have located the target computer. Obviously you can defend against this sort of attack by just not using wifi, although similar attacks at the ISP level are possible. Cover traffic helps with this, assuming the covert channel has low tolerance to noise (this may not be true; again, few details were given). It is also wise to avoid connecting from your house, if possible, and to use a public location where you can quickly shut down your laptop when you see the cops. Or, you know, you could not sell large quantities of illegal drugs over the Internet, since it is basically asking for trouble.

sliverstorm 14y ago
Clever. Good to know they aren't totally clueless.
- dr_doom 14y ago
  Yes they are. He said a researcher shared that information with police officers, not that they did anything but say "thanks a lot, this will help". I'm willing to bet no officer on the drug enforcement team even read the paper. No law local enforcement agency will known how to even begin step 2, and none will waste the time and resources for step 3.
Cushman 14y ago
Does this really work in the case of the Silk Road? Communication is completely asynchronous, the people sending and receiving packages never make a direct connection. You would need to find a geographic area for the server itself, which is presumably a closely guarded secret.
- betterunix 14y ago
  The researcher's original work was meant to crack down on child pornography distribution, where the covert channel would be embedded in the download of a video or large file of some sort. In the case of the Silk road, the police would probably need to direct the target to another website, and somehow convince the target to leave that website open. Harder, yes, although probably not impossible -- one might, for example, claim to be directing the target to a website where a PGP key is being distributed, and then use Javascript to open a window in the background (one of the many reasons why one should disable Javascript whenever they use Tor). It is generally considered to be good advice not to follow off-site links for something like Silk Road, but the reality is that most people who go there are not experts on computer security and do not understand how Tor might be attacked (consider, for example, this case: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ ). The police may not be world-class cryptanalysts, but they are pretty good at tricking people.
  - Cushman 14y ago
    The challenge isn't locating or identifying average users, though, since they'll gladly send you their name and address. The challenge is finding the distributors, who are (presumably) more careful to follow the rules. It sounds like this technique can't really do that in the general case.
    - betterunix 14y ago
      Even distributors probably do not know all the ways that Tor can be attacked. Look at the Hushmail/DEA case: you had a reasonably big steroids distributor using Hushmail, sending mountains of incriminating evidence through that system apparently unaware that there was a major security problem. Is it really so hard to believe that the police might be able to get a Silk Road distributor to follow an off-site link?
      - Cushman 14y ago
        A distributor, sure. Some people are that dumb. But enough to make a dent? I doubt it. There are site rules and best practices and distributors are ranked (among other factors) on how well they keep to those. The rules say (among other things) to only communicate through the site, to PGP encrypt any sensitive information, and never to store any information longer than necessary to complete the transaction. I'm not saying there are no possible attacks against that surface, but I don't think the one you've described gets there. Anyone who breaks those rules puts themselves and their customers at risk. If a distributor got busted because they clicked an off-site link, I imagine the community would say good riddance. And keep trading drugs.

sliverstorm 14y ago

Clever. Good to know they aren't totally clueless.

dr_doom 14y ago
Yes they are. He said a researcher shared that information with police officers, not that they did anything but say "thanks a lot, this will help". I'm willing to bet no officer on the drug enforcement team even read the paper. No law local enforcement agency will known how to even begin step 2, and none will waste the time and resources for step 3.

Cushman 14y ago

Does this really work in the case of the Silk Road? Communication is completely asynchronous, the people sending and receiving packages never make a direct connection. You would need to find a geographic area for the server itself, which is presumably a closely guarded secret.

betterunix 14y ago
The researcher's original work was meant to crack down on child pornography distribution, where the covert channel would be embedded in the download of a video or large file of some sort. In the case of the Silk road, the police would probably need to direct the target to another website, and somehow convince the target to leave that website open. Harder, yes, although probably not impossible -- one might, for example, claim to be directing the target to a website where a PGP key is being distributed, and then use Javascript to open a window in the background (one of the many reasons why one should disable Javascript whenever they use Tor). It is generally considered to be good advice not to follow off-site links for something like Silk Road, but the reality is that most people who go there are not experts on computer security and do not understand how Tor might be attacked (consider, for example, this case: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ ). The police may not be world-class cryptanalysts, but they are pretty good at tricking people.
- Cushman 14y ago
  The challenge isn't locating or identifying average users, though, since they'll gladly send you their name and address. The challenge is finding the distributors, who are (presumably) more careful to follow the rules. It sounds like this technique can't really do that in the general case.
  - betterunix 14y ago
    Even distributors probably do not know all the ways that Tor can be attacked. Look at the Hushmail/DEA case: you had a reasonably big steroids distributor using Hushmail, sending mountains of incriminating evidence through that system apparently unaware that there was a major security problem. Is it really so hard to believe that the police might be able to get a Silk Road distributor to follow an off-site link?
    - Cushman 14y ago
      A distributor, sure. Some people are that dumb. But enough to make a dent? I doubt it. There are site rules and best practices and distributors are ranked (among other factors) on how well they keep to those. The rules say (among other things) to only communicate through the site, to PGP encrypt any sensitive information, and never to store any information longer than necessary to complete the transaction. I'm not saying there are no possible attacks against that surface, but I don't think the one you've described gets there. Anyone who breaks those rules puts themselves and their customers at risk. If a distributor got busted because they clicked an off-site link, I imagine the community would say good riddance. And keep trading drugs.