5 ms·

That doesn't explain how they were able to find the server hosting the hidden service by July the 23rd. The complaint relies on a lot of circumstantial evidence

by A1kmm 13y ago

That doesn't explain how they were able to find the server hosting the hidden service by July the 23rd. The complaint relies on a lot of circumstantial evidence to tie the server to the person, and that evidence wouldn't easily have allowed them to find the server (e.g. that someone accessed a VPN that in turn accessed the Silk Road server from an Internet cafe close to where Ross Ulbricht lived). If there is stronger evidence that they could have followed from the person to the server, they would probably have put that in the complaint as it would be more direct and therefore more incriminating. Therefore, it seems likely that they didn't find the server by following it from the person. There are several possibilities here: 1. Perhaps the NSA helped with finding the server by traffic analysis to follow the circuit back to the hidden service IP? 2. Perhaps the server was rented from / on the advice of an informant and setup only shortly before it was imaged. Reading between the lines, redandwhite was a law enforcement plant on Silk Road (possibly Canadian, given that is what the article claims) that DPR trusted to some extent and possibly took advice about how to get a host for the server. The complaint conceals where the server was found - perhaps for this reason. 3. Perhaps a foreign government surveillance programme routinely searches virtual servers, and this resulted in the server being found.

honzzz 13y ago
1. could you please try to briefly explain how would such traffic analysis work? People with deeper knowledge of networking always mention traffic analysis without further explanation... but to us curious amateurs this does not really explain anything. The fact that they had the server image related to specific date - July 23rd - does this say anything about how they obtained the image? Can we infer that they did not locate or hack the real server (because they would continue to have access after that date) and that maybe somehow they got hands on some backup image or something? Can we infer anything else?
- A1kmm 13y ago
  To understand how a traffic analysis attach works, you first need to understand how hidden services work. The way Tor hidden services work is that the hidden service builds a route (called a circuit) through the network of Tor nodes through to a node which it calls a 'rendezvous point' (RP). It then repeats this process to establish multiple circuits, one to each RP. The IPs of the RPs are public information, but no node (not even the RP) except the hidden service knows the route the circuit takes to the RP - only how to get to the next hop. End-users build their own circuit with Tor to the RP, so the RP or the hidden service also don't know the identity of the end-user. An attacker wants to find out the route a circuit takes from an RP to the private node, to find the private node. Tor does not send masking traffic - it only sends data when someone is actually asking something. So when someone sends data through the RP, the RP receives that data, unwraps one layer of the 'onion' packet and sends the rest along the circuit. The next node does the same. Therefore, this creates a pattern that is observable to someone who is sniffing the networks. An attacker with access to all the networks between the nodes cannot see the contents of the packets, since it is encrypted, but they can look for the pattern in the traffic to see where the traffic is flowing. If no one was using Tor at all except for one packet being sent along one circuit, it would be trivial to see the path a packet follows, since you would see the RP sending the packet, then a slightly smaller packet going to the next node, and so on to the destination. In practice, lots of people are using Tor, so you need to do statistical analysis and build up confidence over time about a circuit. If there is an unusual amount of data traveling over the circuit you care about (e.g. due to a DDOS), this again makes it easier - just look for all the most active nodes. If you can send a pulse of exceptionally high traffic, you can watch the time evolution of the pulse through the system and see where it ends up. Even without a high traffic pulse, you can compute probabilities that observed traffic outputs from a node were caused by a given input (based on the timing, size, etc...) and over time, combine a lot of individual points of weak evidence to get strong evidence about a circuit. The complaint says that the 23rd was when they asked a foreign government to assist them by imaging the server - so they know where it is physically, and who owns the datacentre.

by A1kmm 13y ago

honzzz 13y ago

1. could you please try to briefly explain how would such traffic analysis work? People with deeper knowledge of networking always mention traffic analysis without further explanation... but to us curious amateurs this does not really explain anything. The fact that they had the server image related to specific date - July 23rd - does this say anything about how they obtained the image? Can we infer that they did not locate or hack the real server (because they would continue to have access after that date) and that maybe somehow they got hands on some backup image or something? Can we infer anything else?

A1kmm 13y ago
To understand how a traffic analysis attach works, you first need to understand how hidden services work. The way Tor hidden services work is that the hidden service builds a route (called a circuit) through the network of Tor nodes through to a node which it calls a 'rendezvous point' (RP). It then repeats this process to establish multiple circuits, one to each RP. The IPs of the RPs are public information, but no node (not even the RP) except the hidden service knows the route the circuit takes to the RP - only how to get to the next hop. End-users build their own circuit with Tor to the RP, so the RP or the hidden service also don't know the identity of the end-user. An attacker wants to find out the route a circuit takes from an RP to the private node, to find the private node. Tor does not send masking traffic - it only sends data when someone is actually asking something. So when someone sends data through the RP, the RP receives that data, unwraps one layer of the 'onion' packet and sends the rest along the circuit. The next node does the same. Therefore, this creates a pattern that is observable to someone who is sniffing the networks. An attacker with access to all the networks between the nodes cannot see the contents of the packets, since it is encrypted, but they can look for the pattern in the traffic to see where the traffic is flowing. If no one was using Tor at all except for one packet being sent along one circuit, it would be trivial to see the path a packet follows, since you would see the RP sending the packet, then a slightly smaller packet going to the next node, and so on to the destination. In practice, lots of people are using Tor, so you need to do statistical analysis and build up confidence over time about a circuit. If there is an unusual amount of data traveling over the circuit you care about (e.g. due to a DDOS), this again makes it easier - just look for all the most active nodes. If you can send a pulse of exceptionally high traffic, you can watch the time evolution of the pulse through the system and see where it ends up. Even without a high traffic pulse, you can compute probabilities that observed traffic outputs from a node were caused by a given input (based on the timing, size, etc...) and over time, combine a lot of individual points of weak evidence to get strong evidence about a circuit. The complaint says that the 23rd was when they asked a foreign government to assist them by imaging the server - so they know where it is physically, and who owns the datacentre.