4 ms·
I think the easiest attack on SR would not be one of the attacks mentioned in the article (although similar to their second attack, but focused on legal implica
by A1kmm 14y ago
I think the easiest attack on SR would not be one of the attacks mentioned in the article (although similar to their second attack, but focused on legal implications instead of fraud), but rather:
a. Law enforcement creates a large number of vendor and customer accounts. Due to the pseudonymity, they can create as many as they like and they can't be linked (they may need to create them over time to avoid making the pattern too obvious).
b. The fake customer accounts buy from the fake vendor accounts and leave positive comments, building up a reputation for the fake vendors. This would give money to the operators of SR for fees, but aside from fees there would be no loss for the operators.
c. Eventually, the number of fake vendors could be sufficient that it makes up most of the volume of SR.
d. The fake customers buy from some real vendors and claim that the goods never arrived or that they got arrested and it looks like the vendor tipped the police off.
e. Any real customer who buys from a fake vendor gets their details sent to their local police.
f. Most vendors, real and fake, accumulate comments saying that they tipped people off to the police, with no way to tell which vendors are real vendors with mostly genuine good feedback and a few forged complaints of being police run, and which have a few real complaints of being police run and mostly forged good feedback.
g. Police forces issue press releases announcing how many people they have caught buying things on SR, and buying becomes a highly risky proposition.
- Cushman 14y agoThat's a pretty nice playbook, but it fails for the reason every attack against SR fails: It doesn't get you the vendors, and they're the only big fish there to catch. At best, you can spend time and money just treading water to keep them in check, but it will never shut them down.
- tomjen3 14y agoNo it removes the incentives to buy there -- the idea that SR is safe -- kills the customer base and so the sellers will leave.
- alexmat 14y agoIt'll just create demand for a stronger web of trust. When the price on reputation goes up, people will find better ways of appearing reputable. Also, vendors that have been around for a long time will be able to raise prices and/or take on more demand.
- jopola 14y agoA. Why does it matter that the police have your address? Addresses are public information. Anyone could have your address and send illegal material to it. B. Just stick with the reputable vendors before the whole police thing happened.
- dllthomas 14y agoRegarding B, it's a practical defense, but it also means it was something of an effective attack: undermine the efficiency of the marketplace by adding a barrier to entry.
- maxwellhansen 14y agoIt currently costs $505.90 to register an account as a vendor on Silk Road, so I do not think this is a financially feasible strategy.
- RobertHoudin 14y agoDo you seriously think that $505.90 per account is financially prohibitive to law enforcement?
- 1337biz 14y agoI don't want to know how much money the government is already blasting every day on the "war on drugs". If there is something where the government is willing to waste money on, then it is for things like these. You can already write the press release "undercover mission", "highly sophisticated system of professional drug dealers", "illegal money laundering", oh and how could I forget "financing terrorism".
- tirant 14y agoAnd you won't accomplish anything by shutting down Silk Road. Most of drugs that get in a country don't do it by packages sent by Silk Road. LE (Law enforcement) is already low on resources, so they better use them for bigger 'operators'.
- gordaco 14y agoEven more: if they happened to be able to close Silk Road, or make it impractical or unusable, another similar site would rise within weeks. If they don't understand this, they simply don't understand internet. This is another example of how useless does the so-called "war on drugs" get.
- malandrew 14y agoExactly. And the new site will learn the mistakes committed by the old site.
- saym 14y agoNot to be finicky , but why did you abbreviate law enforcement if you only used it once?
- bbrian 14y agoI, uh, think if you're on sites like Silk Road, LE is the typical way of writing it, so he was expanding LE rather than contracting Law Enforcement.
- adamnemecek 14y agoSR would have to be brain dead not to realize that this is an issue. As maxwellhansen, one has to purchase a token to become a seller which are quite expensive. Furthermore, there is a limited number of tokens and the only way to get a token is to buy it from someone (who will then lose said token). Therefore it is pretty hard to become a seller.
- celticninja 14y agothis is incorrect, the site does require you purchase a vendor account but this is from the site admin and not from another user. to become a seller/vendor on the site you just need money, about $500 USD I believe.
- adamnemecek 14y agoBut the number of tokens is still limited correct?
- celticninja 14y agono not at all, based on the fact that more sellers = more choice = better prices for consumers
- malandrew 14y agoThere is no requirement besides money? Seems like there should be some other act which law enforcement would not want to perform, but which a legitimate seller would.
- mburns 14y agolike what? Send sample product to a deaddrop location?
- celticninja 14y agono, if law enforcement paid for an account they could operate however as a new seller they would need to prove themselves by sending out product, something I am sure they could do but probably would not want to get involved in sending out grams of cocaine or heroin for 6 months just to build up a database of people who are buying a gram of drugs for personal use. There is no way to translate a seller account into information regarding the site or other sellers, therefore for law enforcement it is a waste of time and resources.
- Jabbles 14y agoI think some pretty basic clustering algorithms would reveal this self-serving subset of participants in SR. The fake vendors and fake buyers would have to interact with the real ones (and positively, with real drugs) in order to go unnoticed.
- malandrew 14y agoIs the data available to perform this clustering? Like with BitCoin, are all SR transactions recorded for posterity and accessible to every market participant?
- gwern 14y agoNot to users, I don't think. I also think this would run afoul of the (claimed) data retention policies that DPR has posted - after a while most information is gone.
- derefr 14y agoBasically, a http://en.wikipedia.org/wiki/Sybil_attack http://en.wikipedia.org/wiki/Sybil_attack aimed at networks of people, rather than networks of machines.