4 ms·

Does this really work in the case of the Silk Road? Communication is completely asynchronous, the people sending and receiving packages never make a direct conn

by Cushman 14y ago

Does this really work in the case of the Silk Road? Communication is completely asynchronous, the people sending and receiving packages never make a direct connection. You would need to find a geographic area for the server itself, which is presumably a closely guarded secret.

betterunix 14y ago
The researcher's original work was meant to crack down on child pornography distribution, where the covert channel would be embedded in the download of a video or large file of some sort. In the case of the Silk road, the police would probably need to direct the target to another website, and somehow convince the target to leave that website open. Harder, yes, although probably not impossible -- one might, for example, claim to be directing the target to a website where a PGP key is being distributed, and then use Javascript to open a window in the background (one of the many reasons why one should disable Javascript whenever they use Tor). It is generally considered to be good advice not to follow off-site links for something like Silk Road, but the reality is that most people who go there are not experts on computer security and do not understand how Tor might be attacked (consider, for example, this case: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ ). The police may not be world-class cryptanalysts, but they are pretty good at tricking people.
- Cushman 14y ago
  The challenge isn't locating or identifying average users, though, since they'll gladly send you their name and address. The challenge is finding the distributors, who are (presumably) more careful to follow the rules. It sounds like this technique can't really do that in the general case.
  - betterunix 14y ago
    Even distributors probably do not know all the ways that Tor can be attacked. Look at the Hushmail/DEA case: you had a reasonably big steroids distributor using Hushmail, sending mountains of incriminating evidence through that system apparently unaware that there was a major security problem. Is it really so hard to believe that the police might be able to get a Silk Road distributor to follow an off-site link?
    - Cushman 14y ago
      A distributor, sure. Some people are that dumb. But enough to make a dent? I doubt it. There are site rules and best practices and distributors are ranked (among other factors) on how well they keep to those. The rules say (among other things) to only communicate through the site, to PGP encrypt any sensitive information, and never to store any information longer than necessary to complete the transaction. I'm not saying there are no possible attacks against that surface, but I don't think the one you've described gets there. Anyone who breaks those rules puts themselves and their customers at risk. If a distributor got busted because they clicked an off-site link, I imagine the community would say good riddance. And keep trading drugs.

by Cushman 14y ago

betterunix 14y ago

The researcher's original work was meant to crack down on child pornography distribution, where the covert channel would be embedded in the download of a video or large file of some sort. In the case of the Silk road, the police would probably need to direct the target to another website, and somehow convince the target to leave that website open. Harder, yes, although probably not impossible -- one might, for example, claim to be directing the target to a website where a PGP key is being distributed, and then use Javascript to open a window in the background (one of the many reasons why one should disable Javascript whenever they use Tor). It is generally considered to be good advice not to follow off-site links for something like Silk Road, but the reality is that most people who go there are not experts on computer security and do not understand how Tor might be attacked (consider, for example, this case: http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/ ). The police may not be world-class cryptanalysts, but they are pretty good at tricking people.

Cushman 14y ago
The challenge isn't locating or identifying average users, though, since they'll gladly send you their name and address. The challenge is finding the distributors, who are (presumably) more careful to follow the rules. It sounds like this technique can't really do that in the general case.
- betterunix 14y ago
  Even distributors probably do not know all the ways that Tor can be attacked. Look at the Hushmail/DEA case: you had a reasonably big steroids distributor using Hushmail, sending mountains of incriminating evidence through that system apparently unaware that there was a major security problem. Is it really so hard to believe that the police might be able to get a Silk Road distributor to follow an off-site link?
  - Cushman 14y ago
    A distributor, sure. Some people are that dumb. But enough to make a dent? I doubt it. There are site rules and best practices and distributors are ranked (among other factors) on how well they keep to those. The rules say (among other things) to only communicate through the site, to PGP encrypt any sensitive information, and never to store any information longer than necessary to complete the transaction. I'm not saying there are no possible attacks against that surface, but I don't think the one you've described gets there. Anyone who breaks those rules puts themselves and their customers at risk. If a distributor got busted because they clicked an off-site link, I imagine the community would say good riddance. And keep trading drugs.