7 ms·

FBI Special Agent visit Thursday August 8th

95 points by GuiA 13y ago

jmh42 13y ago
I may be completely wrong here, but I thought TOR doesn't work in China. Something about them blocking the relays or their traffic only supporting TCP and no UDP... (Sorry for lack of support here.)
rdl 13y ago
I wonder if you get more interesting government contacts for running a Tor exit node vs. a mixmaster mail anonymizer now. I certainly got a lot of interesting contacts when running a remailer. It was awesome being able to talk to them as a relative peer (since I was doing defense contracting), and explain calmly why remailers are good, what level of monitoring is possible, what security assumptions the whole network operates under, how you would defeat it, and why it wouldn't be worth the effort.
dmix 13y ago
Non-broken PDF links: http://intelreport.mandiant.com/ http://intelreport.mandiant.com/ For anyone not aware Noisebridge runs TOR exit nodes out of SF. https://www.noisebridge.net/ https://www.noisebridge.net/ I'm curious if their FBI policy is to say "I don't know anyone who runs Tor nodes".
- Garthex 13y ago
  That link just goes to their homepage. Here's the pdf: http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
- simoncion 13y ago
  It's not. See: https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI
- deadfall 13y ago
  I found this thread about someone getting raided and 20 computer taken for running a TOR exit node. http://yro.slashdot.org/story/12/11/30/1521208/raided-for-running-a-tor-exit-node http://yro.slashdot.org/story/12/11/30/1521208/raided-for-ru...
- woah 13y ago
  It may be that the person did not, in fact, know anyone who runs TOR nodes.
- gcb0 13y ago
  > mandiant thing sounds like the kind of think the chinese would release to get the other governments to waste their resources making their firewall more efficient.
- mct 13y ago
  For anyone not aware Noisebridge runs TOR exit nodes out of SF Noisebridge is based in SF, but the Tor exit node we run is a colo box in LA.
dictum 13y ago
>I tensed up as he began to tell me that the Chinese have been utilizing the Noisebridge TOR exit node. He made it seem as if it was a very real threat >“There are times when they slip back into Cold War thinking and Cold War mentality,” Obama said on air Tuesday evening. “What I continually say to them and to President Putin, that’s the past.” http://www.washingtonpost.com/blogs/post-politics/wp/2013/08/06/obama-frustrated-by-russias-decision-to-grant-snowden-asylum/ http://www.washingtonpost.com/blogs/post-politics/wp/2013/08...
simoncion 13y ago
BTW, this visit isn't a special or unique thing. The Feds periodically stop by, asking about traffic that came through Noisetor. There's even a procedure in place for handling the situation: https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI
- deleted 13y ago
  [deleted]
teawithcarl 13y ago
Why do our taxes in part support this invasion of privacy by NSA/FBI on American citizens ?
- cinquemb 13y ago
  Because they'll stick guns at us and throw us in prison if we don't pay them off?
  - gsibble 13y ago
    Careful, up-voting this comment will put you on an NSA list.
    - javert 13y ago
      As I often tell my Mom in phone conversations: The things I'm saying probably have gotten me reviewed by some government agent. The good news is that if they listen, they'll realize I'm not a terrorist and put me in their "Just a Patriotic American, no problem here" file with 100,000 other people. If somebody extremely dastardly gets elected who might use that file for harm, I'll just have to flee.
      - otakucode 13y ago
        Oh, you missed the statements be the ex-head of the NSA just a couple days ago I take it. He said that government transparency groups are 'the next terrorists.' Besides, it's not a human you have to fear. It's their automated systems. They'll set up a system to analyze and profile communications, and it will just spit out names. They'll declare those people terrorists and round them up and not charge them with anything. And as long as no individual NSA agent actually reads your communications, everyone will apparently be happy. Well, except for the people getting waterboarded by CIA agents who just KNOW you MUST have done something terrible, because the information they got about you is called "intelligence" and therefore can not be incorrect.
      - cenhyperion 13y ago
deleted 13y ago
[deleted]
gcb0 13y ago
Isn't the top reason people do run TOR exit nodes to help people behind gov firewalls? So the "chinese" using it would be one of the purposes, wouldn't it? Why instead the FBI don't do their work and say which sites that exit node should deny access to and be done with?
- otakucode 13y ago
  Given my understanding of how Tor operates (please correct me if I'm wrong, I've never actually used Tor, though the recent government hardon against it has me tempted), it would not be possible to block specific people from using your exit node. Or are you referring to, say, blocking all people coming from that exit node from connecting to some site on the regular Internet? I suppose that should be possible, though justifying it would be hard and the traffic should just route through a different exit node, right? I'd want to know what makes the FBI think they've identified someone coming through the Tor network. And how.
tzs 13y ago
> I tensed up as he began to tell me that the Chinese have been utilizing the Noisebridge TOR exit node I don't know if there is anything sneaky going on in China to justify FBI interest, but I HAVE seen some pretty weird traffic from China. I wonder if anyone else here has noticed anything similar. Here's what I've been seeing. The products we sell where I work that are available for download are only sold to US and European markets (we have nothing against the rest of the world--we just don't have the resources to support more regions or to handle payments from other regions). The product is not very useful if you do not have a subscription to the accompanying service. The product is also not very well known (I doubt we are even in the top 100 in our market), and there aren't many links out their pointing to our download page. So, when I check the logs of downloads, what I expect to see is mostly US addresses, and a few European addresses (most of our customers are in the US). For downloads that complete in one HTTP requests, what I see is 69% from the US, 12% from China, 14% from the rest of the world, and 5% unknown. So already China is higher than I would expect. It gets even weirder when I look at partial downloads. First of all, 3 times as many IP addresses hit our site in a given time period and do partial downloads than do complete downloads. Of the IP addresses doing partial downloads, 85% are from China, 7% from the US, 6% from the rest of the world (and most of those are Asian countries), and 2% unknown. 92% of those Chinese IP addresses doing partial downloads do not download enough total data from all the requests from that IP address to have received the full download. Overall, if I don't distinguish between partial and full downloads, and count an IP address has having downloaded if it has received a total number of bytes large enough to contain our file, what I have is this: 59% of the IP addresses are Chinese addresses that do not download enough, 20% are US that do download enough, 8% are Chinese that do download enough, 5% are from the rest of the world and download enough. None of these things identify themselves as bots. They all identify as a normal looking mix of Windows and Mac browsers. I've looked at a few of the Chinese addresses to see what is nearby, and many seem to be in class C blocks that belong to hosting providers, not end user ISPs, and when I've been able to find some host names mapping to those blocks, they have tended to be things like allshemales.net or dirtyracialporn.com (not sure I remembered the exact names--the general idea is right). In contrast, when I do the same for a few randomly chosen US downloaders, I get blocks that seem to clearly be consumer ISP ranges they use for their customers. Some of the access patterns are interesting. I saw one that would come, do two concurrent requests, get 60 KB, and go away for exactly 3600 seconds. It did this until it grabbed the whole download (or at least enough data for it to have the whole download). I might guess some kind of download manager, but I've never seen one that is so slow. So, what the devil is going on? I can't even come up with a plausible sounding theory that would explain this much Chinese activity on our site, let along explain why so much of it is just partial downloads, and why it seems to be coming from sites at data centers (which I assume indicates some kind of commercial source). Anyone else seeing this kind of thing? I have no reason to suspect anything sinister is going on. I just can't figure out any reason at ALL for this to be going on.

95 points by GuiA 13y ago

jmh42 13y ago

I may be completely wrong here, but I thought TOR doesn't work in China. Something about them blocking the relays or their traffic only supporting TCP and no UDP... (Sorry for lack of support here.)

rdl 13y ago

I wonder if you get more interesting government contacts for running a Tor exit node vs. a mixmaster mail anonymizer now. I certainly got a lot of interesting contacts when running a remailer. It was awesome being able to talk to them as a relative peer (since I was doing defense contracting), and explain calmly why remailers are good, what level of monitoring is possible, what security assumptions the whole network operates under, how you would defeat it, and why it wouldn't be worth the effort.

dmix 13y ago

Non-broken PDF links: http://intelreport.mandiant.com/ http://intelreport.mandiant.com/ For anyone not aware Noisebridge runs TOR exit nodes out of SF. https://www.noisebridge.net/ https://www.noisebridge.net/ I'm curious if their FBI policy is to say "I don't know anyone who runs Tor nodes".

Garthex 13y ago
That link just goes to their homepage. Here's the pdf: http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
simoncion 13y ago
It's not. See: https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI
deadfall 13y ago
I found this thread about someone getting raided and 20 computer taken for running a TOR exit node. http://yro.slashdot.org/story/12/11/30/1521208/raided-for-running-a-tor-exit-node http://yro.slashdot.org/story/12/11/30/1521208/raided-for-ru...
woah 13y ago
It may be that the person did not, in fact, know anyone who runs TOR nodes.
gcb0 13y ago
> mandiant thing sounds like the kind of think the chinese would release to get the other governments to waste their resources making their firewall more efficient.
mct 13y ago
For anyone not aware Noisebridge runs TOR exit nodes out of SF Noisebridge is based in SF, but the Tor exit node we run is a colo box in LA.

dictum 13y ago

>I tensed up as he began to tell me that the Chinese have been utilizing the Noisebridge TOR exit node. He made it seem as if it was a very real threat >“There are times when they slip back into Cold War thinking and Cold War mentality,” Obama said on air Tuesday evening. “What I continually say to them and to President Putin, that’s the past.” http://www.washingtonpost.com/blogs/post-politics/wp/2013/08/06/obama-frustrated-by-russias-decision-to-grant-snowden-asylum/ http://www.washingtonpost.com/blogs/post-politics/wp/2013/08...

simoncion 13y ago

BTW, this visit isn't a special or unique thing. The Feds periodically stop by, asking about traffic that came through Noisetor. There's even a procedure in place for handling the situation: https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI https://www.noisebridge.net/wiki/Noisebridge_Tor/FBI

deleted 13y ago
[deleted]

teawithcarl 13y ago

Why do our taxes in part support this invasion of privacy by NSA/FBI on American citizens ?

cinquemb 13y ago
Because they'll stick guns at us and throw us in prison if we don't pay them off?
- gsibble 13y ago
  Careful, up-voting this comment will put you on an NSA list.
  - javert 13y ago
    As I often tell my Mom in phone conversations: The things I'm saying probably have gotten me reviewed by some government agent. The good news is that if they listen, they'll realize I'm not a terrorist and put me in their "Just a Patriotic American, no problem here" file with 100,000 other people. If somebody extremely dastardly gets elected who might use that file for harm, I'll just have to flee.
    - otakucode 13y ago
      Oh, you missed the statements be the ex-head of the NSA just a couple days ago I take it. He said that government transparency groups are 'the next terrorists.' Besides, it's not a human you have to fear. It's their automated systems. They'll set up a system to analyze and profile communications, and it will just spit out names. They'll declare those people terrorists and round them up and not charge them with anything. And as long as no individual NSA agent actually reads your communications, everyone will apparently be happy. Well, except for the people getting waterboarded by CIA agents who just KNOW you MUST have done something terrible, because the information they got about you is called "intelligence" and therefore can not be incorrect.
    - cenhyperion 13y ago

deleted 13y ago

[deleted]

gcb0 13y ago

Isn't the top reason people do run TOR exit nodes to help people behind gov firewalls? So the "chinese" using it would be one of the purposes, wouldn't it? Why instead the FBI don't do their work and say which sites that exit node should deny access to and be done with?

otakucode 13y ago
Given my understanding of how Tor operates (please correct me if I'm wrong, I've never actually used Tor, though the recent government hardon against it has me tempted), it would not be possible to block specific people from using your exit node. Or are you referring to, say, blocking all people coming from that exit node from connecting to some site on the regular Internet? I suppose that should be possible, though justifying it would be hard and the traffic should just route through a different exit node, right? I'd want to know what makes the FBI think they've identified someone coming through the Tor network. And how.

tzs 13y ago

> I tensed up as he began to tell me that the Chinese have been utilizing the Noisebridge TOR exit node I don't know if there is anything sneaky going on in China to justify FBI interest, but I HAVE seen some pretty weird traffic from China. I wonder if anyone else here has noticed anything similar. Here's what I've been seeing. The products we sell where I work that are available for download are only sold to US and European markets (we have nothing against the rest of the world--we just don't have the resources to support more regions or to handle payments from other regions). The product is not very useful if you do not have a subscription to the accompanying service. The product is also not very well known (I doubt we are even in the top 100 in our market), and there aren't many links out their pointing to our download page. So, when I check the logs of downloads, what I expect to see is mostly US addresses, and a few European addresses (most of our customers are in the US). For downloads that complete in one HTTP requests, what I see is 69% from the US, 12% from China, 14% from the rest of the world, and 5% unknown. So already China is higher than I would expect. It gets even weirder when I look at partial downloads. First of all, 3 times as many IP addresses hit our site in a given time period and do partial downloads than do complete downloads. Of the IP addresses doing partial downloads, 85% are from China, 7% from the US, 6% from the rest of the world (and most of those are Asian countries), and 2% unknown. 92% of those Chinese IP addresses doing partial downloads do not download enough total data from all the requests from that IP address to have received the full download. Overall, if I don't distinguish between partial and full downloads, and count an IP address has having downloaded if it has received a total number of bytes large enough to contain our file, what I have is this: 59% of the IP addresses are Chinese addresses that do not download enough, 20% are US that do download enough, 8% are Chinese that do download enough, 5% are from the rest of the world and download enough. None of these things identify themselves as bots. They all identify as a normal looking mix of Windows and Mac browsers. I've looked at a few of the Chinese addresses to see what is nearby, and many seem to be in class C blocks that belong to hosting providers, not end user ISPs, and when I've been able to find some host names mapping to those blocks, they have tended to be things like allshemales.net or dirtyracialporn.com (not sure I remembered the exact names--the general idea is right). In contrast, when I do the same for a few randomly chosen US downloaders, I get blocks that seem to clearly be consumer ISP ranges they use for their customers. Some of the access patterns are interesting. I saw one that would come, do two concurrent requests, get 60 KB, and go away for exactly 3600 seconds. It did this until it grabbed the whole download (or at least enough data for it to have the whole download). I might guess some kind of download manager, but I've never seen one that is so slow. So, what the devil is going on? I can't even come up with a plausible sounding theory that would explain this much Chinese activity on our site, let along explain why so much of it is just partial downloads, and why it seems to be coming from sites at data centers (which I assume indicates some kind of commercial source). Anyone else seeing this kind of thing? I have no reason to suspect anything sinister is going on. I just can't figure out any reason at ALL for this to be going on.