13 ms·

The FBI Says How It ‘Legally’ Pinpointed Silk Road’s Server

226 points by nikcub 12y ago

philip1209 12y ago
If the site was accessible through an IP, could scanning ports and looking for a particular item on the homepage have identified it?
- jagger27 12y ago
  The web server probably wasn't visible on the public internet, but apparently the machine itself was.
  - philip1209 12y ago
    "And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared, the garbled-letter image designed to prevent spam bots from entering the site."
    - scintill76 12y ago
      Ouch. In retrospect, seems like they could have almost brute-forced it, if they had a narrow enough block of IP addresses they thought it was in. Fetch the root page on all the IP addresses looking for something that looks like SR.
      - TheLoneWolfling 12y ago
        You could probably do that for the entire internet, assuming you had their levels of resources.
        spiritplumber 12y ago
        Isn't that what the NSA does?
        CJefferson 12y ago
        You could do that in the comfort of your own home, with a decent Internet connection (for example with https://zmap.io/ https://zmap.io/)
    - jagger27 12y ago
      Woops, missed that line.
- MichaelGG 12y ago
  Yep! Sounds like a pretty big problem. With 10,000 scanning processes taking 5/sec per IP, it'd take less than a month to scan all IPs. It should be easy for a powerful adversary to scale this up and finish in a day or two. It'd take more work if all ports need to be scanned, but restricting to just known hosting blocks could shave a bit off. As could eliminating well-known good sites from a first pass. It would surprise me if the FBI isn't already doing this for all known onion sites, just to have the info around. At any rate, sounds like a real basic Opsec101 failure on The Silk Road. Not that hidden services are that safe in the first place. The Tor folks have written about how hidden services are quite vulnerable to some attacks. Not something I'd want to rely on to save me from a 30 year sentence. Edit: If someone had to run a hidden service, it might make sense to setup another onion site (on another Tor instance) and expose that on port 80, as part of misinformation tactic. Reading several incidents, it seems attackers will use circumstancial evidence to help narrow down the possibilities. By intentionally leaking things (like offhand comments about the weather, using reports from another city) one might be able to gain a few more bits of anonymity back. Of course someone doing such a thing wouldn't setup their illegal site on a public IP in the first place.
  - dllthomas 12y ago
    It's my understanding that most OpSec failures are real basic OpSec 101 failures. Not because, faced with the question, it's hard to get it right - but because faced with so many questions it is hard to get all of them right, and screwing one up is frequently enough.
- gvb 12y ago
  Yes but no. All you would have had was a captcha image, you have no way of knowing it was the Silk Road captcha image. If you scan the internet, you will find millions of captcha images. The FBI went the other way: they had the SR login page with an an unknown non-TOR IP address and asked "what is at this IP address?" Since it was a captcha image, and captcha images have to be sourced by the web site that is doing the captcha verification, it strongly implied the IP address was the SR server. As it turned out, it was. As a co-worker said, "When you live in an egg shell, small cracks are deadly."
nikcub 12y ago
The theory I posted last year on Stack Exchange [0]: > The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server. notbad.gif. Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. edit: To add a third point: If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. Clients/users should be doing the same as well as it protects against the malware attacks (even better freeze a VM snapshot and restore it each time you need it). Whonix[1] does this - although it is easy to setup yourself (I use OpenBSD as the gateway, much slimmer than Whonix and a whole lot less going on) [0] http://security.stackexchange.com/a/43280 http://security.stackexchange.com/a/43280 [1] http://www.whonix.org http://www.whonix.org
- spinlock 12y ago
  I was just thinking about the second point you bring up. Isn't this still an illegal search because they purposefully circumvented digital security?
  - tedunangst 12y ago
    Wouldn't circumvention be more accurate if they had successfully brute forced a login? Clicking "View Source" on the error page doesn't sound like circumvention.
    - fleitz 12y ago
      The question is whether the usage was authorized not whether it was successful.
      - XorNot 12y ago
        This seems like a poor defense choice. In Australia, a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them. This was ultimately to prevent stuff like burglars falling through skylights, then suing the owner of the house they were burgling in civil court while facing criminal prosecution. I'd be staggered if it was possible to make a relatively weak "authorization" claim stick, seeing as how the police do have the right to investigate things left "in plain view" which you could argue a web server page which you accidentally sent compromising fuzz data too could fall under. A court would also have little trouble allowing such a thing, since it's a narrow interpretation that doesn't legalize it for the ordinary citizen (though IMO I think it probably should be).
themgt 12y ago
This strongly suggests that anything hosted on Tor should be done through some sort of (ideally plug-n-play, hardened) NAT+hypervisor/container system such that the service itself can never, ever know its real external IP. Such a system could potentially also act as a legal defense in a situation such as this.
- techdragon 12y ago
  Correct! A system can only reveal information it knows, so to defend against this "attack vector" when building a secure system, you must ensure that the software knows as little about the system as possible. There are various ways that don't require NAT, it's more a matter of ensuring the software doesn't need the information it shouldn't know. And both FreeBSD and Linux have tools to lock down a process so it can't find these out (Capsicum and/or SELinux).
- ingenium 12y ago
  That's the premise behind Whonix (https://www.whonix.org https://www.whonix.org). It adds a little overhead running 2 VMs, but it's worth the extra 256MB of memory for the piece of mind.
- dthunt 12y ago
  It seems really unlikely to me that they would have set up this system the incredibly dumb way.
  - fabulist 12y ago
    Ross Ulbricht was an economist who knew some PHP, not a super-hacker.
- kyboren 12y ago
  While this is certainly better than not doing so, if one is going to run such a hidden service in flagrant violation of the law, it seems prudent to take all feasible precautions--and maybe some unfeasible ones, too. 1) Run the HTTP server in a guest VM to reduce likelihood of hardware identifier leakage (hardware MACs, HD serials, DMI data, CPUID, etc.) 2) Physically separate HTTP server and Tor client, and restrict communication between them to a simple packetized high-speed serial interface. 2a) Consider an inline filter on this link that watches for private keys, etc. and kills communication upon detection, and adds random latency to packets to reduce bandwidth of timing channels. 2b) Physically isolate these systems as much as possible: power line filters, electro-optical couplers for the comm link, etc. 3) Stub out all Tor crypto operations to an HSM; keep the onion key and do all operations on the onion key on that HSM. 4) Make friends in the criminal underground, becasue you're probably going to prison eventually, anyway ;).
abutt 12y ago
> they typed “miscellaneous” strings of characters into the login page’s entry fields So this is legal when the FBI does it, but when someone else does essentially the same thing on an AT&T server it's identity fraud and conspiracy to access a computer without authorization
- rasz_pl 12y ago
  Yes, just like hitting people with your car while texting, or shooting them in the back while they are on the ground handcuffed.
- kazinator 12y ago
  Well, there is a general principle that police can do things that ordinary citizens cannot. But, subject to rules, not indiscriminately. For instance, they can enter a property if they have a warrant, whereas if someone else does this, it is break and enter. If the FBI established "probable cause" that the server is used for crime, they could have gotten a warrant. I can't imagine it would have been difficult, so why wouldn't they have taken the legal precaution.
  - hugogee 12y ago
    >so why wouldn't they have taken the legal precaution. That seems to be the golden question here.
- meowface 12y ago
  Assuming the FBI had a warrant, they had a right to do whatever they wanted to SR's server, no? I think weev's sentence was utter bullshit, but you can't equate the two things. SR was a drug marketplace, AT&T is not. This is like arguing police shouldn't be able to pick the lock of your drug safehouse door because you aren't allowed to pick other people's locks.
  - nickodell 12y ago
    That's the thing - the FBI didn't have a warrant. They're trying to argue that they should be allowed to use the information anyway, because it wasn't 'hacking,' it was 'entering miscellaneous strings.' On a related note, why the hell didn't they get a warrant? I doubt it would have taken long.
bradleyjg 12y ago
Even if true it could be a parallel construction.
- virtue3 12y ago
  I don't think anyone here is even remotely doubting that this is anything BUT parallel construction.
  - deleted 12y ago
    [deleted]
  - psykovsky 12y ago
    Maybe the IP leaked because the "lawful hackers" made it leak...
  - spacemanmatt 12y ago
    I was looking for this sentiment before I made my own post. There is absolutely no reason to think the FBI did their work the difficult-but-legal way when they already get rich feeds from NSA. This is parallel construction all the way. I hope the defense figures out how to make a giant stink about that.
  - xorcist 12y ago
    While that may or may not be true (which is completely in the spirit of parallel construction, and it fscks with your mind), we ARE talking about the guy who registered an account to advertise his illegal drug marketplace using his personal email address. That part is fully visible and timestamped, and can not in any plausible way have been planted. With someone so full of himself, pretty much anything is possible.
deleted 12y ago
[deleted]
- mpyne 12y ago
  His accuser signed his name to the criminal complaint already, if you'd read the indictment.
thinkcomp 12y ago
The full docket of the USA v. Ulbricht case is available at: http://www.plainsite.org/dockets/20nlzy0uz/new-york-southern-district-court/usa-v-ulbricht/ http://www.plainsite.org/dockets/20nlzy0uz/new-york-southern...
blueking 12y ago
Bullshit.
ChuckMcM 12y ago
Curious why they didn't include this description in the original indictment. I don't read a lot of indictment documents but pretty much all that I have laid out the steps law enforcement took to ascertain that a crime had taken place and that the person they were indicting was the person they believe committed that crime. I could them requesting that the description remain under seal to foil other poor server maintainers from protecting their identity but that isn't what happened here.
- jacques_chester 12y ago
  It wasn't an issue until it was raised by the defence.
  - ChuckMcM 12y ago
    Hmm refreshing my memory here, this [1] is the search warrant for SABU (of Anonymous) and the claim is that the FBI didn't need a warrant for Ulbricht (which is where this stuff would have been outlined). At least I can't find such a warrant with basic searching techniques. So I'm guessing had they gotten a warrant (does Iceland need such things?), they would have presumably said all of this in the warrant. [1] http://www.scribd.com/doc/197510285/a http://www.scribd.com/doc/197510285/a
tedchs 12y ago
Article says the FBI located the server by entering "miscellaneous" input into the Silk Road login page, which at some point disclosed an IP address. I wonder if they got the Web server to throw a 500 or similar error, that rendered some debug output?
maxk42 12y ago
This is just the cover-story.
- voltagex_ 12y ago
  Prove it.
  - programmarchy 12y ago
    Sorry citizen, that's classified.
cyphunk 12y ago
"fiddling" with "miscellaneous" input characters could be confirmed with server logs. i wondering if the defence will pursue this.
seansoutpost 12y ago
Parallel Construction
- techdragon 12y ago
  You know, its quite likely. It feels pretty kinda flimsy but without more evidence from the other side yet, it could have been that easy.
  - Alupis 12y ago
    It seems fabricated at best. SR was up for a long time... and I'm sure made a lot of enemies... not to mention bots trying to pound on it... So it seems very unlikely that something as basic as not escaping user input strings would bring them down...
- andy_ppp 12y ago
  Does the Tor Browser allow you to access things on the Internet, because surely it shouldn't, therefore the Captcha should have failed to load for a high percentage of Internet users?
  - duskwuff 12y ago
    The Tor Browser will let you access things on the Internet... using Tor.
logn 12y ago
I think that given the revelations of parallel reconstruction in general, the burden should be on the prosecution to prove that the NSA et al. were not involved. An illegal search/seizure could very well have been what gave the FBI the idea to find the IP address in this way. Given that the NSA is able to collect most internet traffic, and they've been sharing info with other agencies, I would think that most evidence against any defendant could be thrown out. Yes, that would be ludicrous, and that's exactly why the NSA needs to be reformed.
- RachelF 12y ago
  The hard thing with parallel constructed evidence is to prove that this is how it is done. I doubt whether a judge will throw out evidence unless you can prove that it is a parallel construction, and that this was illegal.
- hahainternet 12y ago
  > the burden should be on the prosecution to prove that the NSA et al. were not involved You can't prove a negative.
  - spacemanmatt 12y ago
    They should be obligated to testify to the truth under oath. It's not proof but gets their position into court records.
    - tedunangst 12y ago
      And they will. The trial isn't over. Somebody will get on the stand, be sworn in, and then explain the actions he took to reveal the server's IP.
xnull2guest 12y ago
Hmm... http://www.ehackingnews.com/2013/08/almost-half-of-tor-sites-compromised-by.html http://www.ehackingnews.com/2013/08/almost-half-of-tor-sites... http://www.wired.com/2013/09/freedom-hosting-fbi/ http://www.wired.com/2013/09/freedom-hosting-fbi/ Somehow "fiddling with inputs" and "noticing an IP", while innocently phrased, sounds unlikely. It's just so hard to know whether this is parallel construction. The FBI's history with false testimony (i.e. COINTELPRO) is more than damning. The 'not in the US, not subject to US law' is a common trick, and also a way both that the NSA skirts laws about monitoring US citizens (Snowden's leaked documents repeated showed how partners with the NSA regularly traded bulk information on US communications for their own), how the CIA and FBI are able to stop Americans and journalists abroad and how intelligence agencies can propagandize its own citizens while retaining plausible deniability. The CIA is authorized to, and in fact in the past decade and a half heavily decided to, plant stories to international media wire drops that US journalists subscribe and use as a source of information. The CIA also works with partners overseas and private enterprises to engineer foreign stories that the US media will also follow and use for reports (Lincohn Group, Zarqawi PsyOp, etc). Inevitably some of the material released to the Voice of America and other international propaganda outlets make it back to the US Media. Furthermore information is now able to be targeted in very sophisticated ways (i.e. MINERVA, USAID Cuba Twitter program) for the spread of ideas and support (or dissidence) via 'social contagions', all without ever having to directly propagandize any citizens. These sorts of programs are the ultimate and extreme irony of the Soft Power philosophy. I find it unfortunate that the Constitution grants rights restricting search and seizure (and others) but that our representation does not recognize these rights, broadly 'de facto' recognize, as rights worth enforcing outside a strictly domestic interpretation. Are these "rights" or "Rights" if our representation allows and even encourages others to infringe on them?
scotty79 12y ago
So fiddling with a website to obtain information not intended for you is legal now? Because if that's so then awesome. Tell Weev's lawyers.
- psykovsky 12y ago
  I don't think laws apply retroactively.
  - scotty79 12y ago
    That's not a new law. Just incosistent application.
sktrdie 12y ago
I know a lot of "software" solutions are being discussed in this thread for greater anonymity, but I would personally simply opt for a more secure physical solution. Such as hosting the server somewhere that doesn't require you to give away any of your information. I know this may sound silly, but there's tons of USB stick sized linux machines that you can plug virtually anywhere. I'm thinking of public spaces such as public wifis. The ToR address can be relayed to other locations if it ever gets breached. And ToR hidden services work great even if you're behind a firewall. This seems a lot more sensitive than opting for a system where your name is somehow attached to a server.
- mattmanser 12y ago
  How could you run a popular website via the upload pipe supplied by a public wifi? There's no way that's practical.
yutah 12y ago
Was that "Parallel construction" from the FBI to hide it's NSA source (intelligence laundering)? https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intelligence-laundering https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
maximumoverload 12y ago
From /r/darknetmarkets (so grain of salt is needed): > yeah it was about 6-9 months before it shut down if I remember correctly, it was pretty highly upvoted and a lot of chatter about it on the SR forums. though I think there were at least a few bugs that they had to shut down for once they realized that their asses were on the line. http://www.reddit.com/r/DarkNetMarkets/comments/2flnlp/fbi_says_sr1_server_ip_located_via_errors_in/ckakq1v http://www.reddit.com/r/DarkNetMarkets/comments/2flnlp/fbi_s... So yeah, apparently this was an actual bug.
- tedunangst 12y ago
  But, but, but... "Even a rookie would know better, and DPR is no rookie." http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_be_worried_showing_on_login_page/c9s11v8 http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_b...
  - xorcist 12y ago
    Literally everything about DPR screams rookie. From the fact that he had to ask around on public web forums to get Tor set up, to his PHP skillz. I know this is in hindsight, but you had to be pretty deep in the reality distorsion field not to see this coming.

226 points by nikcub 12y ago

If the site was accessible through an IP, could scanning ports and looking for a particular item on the homepage have identified it?

jagger27 12y ago
The web server probably wasn't visible on the public internet, but apparently the machine itself was.
- philip1209 12y ago
  "And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared, the garbled-letter image designed to prevent spam bots from entering the site."
  - scintill76 12y ago
    Ouch. In retrospect, seems like they could have almost brute-forced it, if they had a narrow enough block of IP addresses they thought it was in. Fetch the root page on all the IP addresses looking for something that looks like SR.
    - TheLoneWolfling 12y ago
      You could probably do that for the entire internet, assuming you had their levels of resources.
      - spiritplumber 12y ago
        Isn't that what the NSA does?
      - CJefferson 12y ago
        You could do that in the comfort of your own home, with a decent Internet connection (for example with https://zmap.io/ https://zmap.io/)
  - jagger27 12y ago
    Woops, missed that line.
MichaelGG 12y ago
Yep! Sounds like a pretty big problem. With 10,000 scanning processes taking 5/sec per IP, it'd take less than a month to scan all IPs. It should be easy for a powerful adversary to scale this up and finish in a day or two. It'd take more work if all ports need to be scanned, but restricting to just known hosting blocks could shave a bit off. As could eliminating well-known good sites from a first pass. It would surprise me if the FBI isn't already doing this for all known onion sites, just to have the info around. At any rate, sounds like a real basic Opsec101 failure on The Silk Road. Not that hidden services are that safe in the first place. The Tor folks have written about how hidden services are quite vulnerable to some attacks. Not something I'd want to rely on to save me from a 30 year sentence. Edit: If someone had to run a hidden service, it might make sense to setup another onion site (on another Tor instance) and expose that on port 80, as part of misinformation tactic. Reading several incidents, it seems attackers will use circumstancial evidence to help narrow down the possibilities. By intentionally leaking things (like offhand comments about the weather, using reports from another city) one might be able to gain a few more bits of anonymity back. Of course someone doing such a thing wouldn't setup their illegal site on a public IP in the first place.
- dllthomas 12y ago
  It's my understanding that most OpSec failures are real basic OpSec 101 failures. Not because, faced with the question, it's hard to get it right - but because faced with so many questions it is hard to get all of them right, and screwing one up is frequently enough.
gvb 12y ago
Yes but no. All you would have had was a captcha image, you have no way of knowing it was the Silk Road captcha image. If you scan the internet, you will find millions of captcha images. The FBI went the other way: they had the SR login page with an an unknown non-TOR IP address and asked "what is at this IP address?" Since it was a captcha image, and captcha images have to be sourced by the web site that is doing the captcha verification, it strongly implied the IP address was the SR server. As it turned out, it was. As a co-worker said, "When you live in an egg shell, small cracks are deadly."

nikcub 12y ago

The theory I posted last year on Stack Exchange [0]: > The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server. notbad.gif. Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. edit: To add a third point: If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. Clients/users should be doing the same as well as it protects against the malware attacks (even better freeze a VM snapshot and restore it each time you need it). Whonix[1] does this - although it is easy to setup yourself (I use OpenBSD as the gateway, much slimmer than Whonix and a whole lot less going on) [0] http://security.stackexchange.com/a/43280 http://security.stackexchange.com/a/43280 [1] http://www.whonix.org http://www.whonix.org

spinlock 12y ago
I was just thinking about the second point you bring up. Isn't this still an illegal search because they purposefully circumvented digital security?
- tedunangst 12y ago
  Wouldn't circumvention be more accurate if they had successfully brute forced a login? Clicking "View Source" on the error page doesn't sound like circumvention.
  - fleitz 12y ago
    The question is whether the usage was authorized not whether it was successful.
    - XorNot 12y ago
      This seems like a poor defense choice. In Australia, a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them. This was ultimately to prevent stuff like burglars falling through skylights, then suing the owner of the house they were burgling in civil court while facing criminal prosecution. I'd be staggered if it was possible to make a relatively weak "authorization" claim stick, seeing as how the police do have the right to investigate things left "in plain view" which you could argue a web server page which you accidentally sent compromising fuzz data too could fall under. A court would also have little trouble allowing such a thing, since it's a narrow interpretation that doesn't legalize it for the ordinary citizen (though IMO I think it probably should be).

themgt 12y ago

This strongly suggests that anything hosted on Tor should be done through some sort of (ideally plug-n-play, hardened) NAT+hypervisor/container system such that the service itself can never, ever know its real external IP. Such a system could potentially also act as a legal defense in a situation such as this.

techdragon 12y ago
Correct! A system can only reveal information it knows, so to defend against this "attack vector" when building a secure system, you must ensure that the software knows as little about the system as possible. There are various ways that don't require NAT, it's more a matter of ensuring the software doesn't need the information it shouldn't know. And both FreeBSD and Linux have tools to lock down a process so it can't find these out (Capsicum and/or SELinux).
ingenium 12y ago
That's the premise behind Whonix (https://www.whonix.org https://www.whonix.org). It adds a little overhead running 2 VMs, but it's worth the extra 256MB of memory for the piece of mind.
dthunt 12y ago
It seems really unlikely to me that they would have set up this system the incredibly dumb way.
- fabulist 12y ago
  Ross Ulbricht was an economist who knew some PHP, not a super-hacker.
kyboren 12y ago
While this is certainly better than not doing so, if one is going to run such a hidden service in flagrant violation of the law, it seems prudent to take all feasible precautions--and maybe some unfeasible ones, too. 1) Run the HTTP server in a guest VM to reduce likelihood of hardware identifier leakage (hardware MACs, HD serials, DMI data, CPUID, etc.) 2) Physically separate HTTP server and Tor client, and restrict communication between them to a simple packetized high-speed serial interface. 2a) Consider an inline filter on this link that watches for private keys, etc. and kills communication upon detection, and adds random latency to packets to reduce bandwidth of timing channels. 2b) Physically isolate these systems as much as possible: power line filters, electro-optical couplers for the comm link, etc. 3) Stub out all Tor crypto operations to an HSM; keep the onion key and do all operations on the onion key on that HSM. 4) Make friends in the criminal underground, becasue you're probably going to prison eventually, anyway ;).

abutt 12y ago

> they typed “miscellaneous” strings of characters into the login page’s entry fields So this is legal when the FBI does it, but when someone else does essentially the same thing on an AT&T server it's identity fraud and conspiracy to access a computer without authorization

rasz_pl 12y ago
Yes, just like hitting people with your car while texting, or shooting them in the back while they are on the ground handcuffed.
kazinator 12y ago
Well, there is a general principle that police can do things that ordinary citizens cannot. But, subject to rules, not indiscriminately. For instance, they can enter a property if they have a warrant, whereas if someone else does this, it is break and enter. If the FBI established "probable cause" that the server is used for crime, they could have gotten a warrant. I can't imagine it would have been difficult, so why wouldn't they have taken the legal precaution.
- hugogee 12y ago
  >so why wouldn't they have taken the legal precaution. That seems to be the golden question here.
meowface 12y ago
Assuming the FBI had a warrant, they had a right to do whatever they wanted to SR's server, no? I think weev's sentence was utter bullshit, but you can't equate the two things. SR was a drug marketplace, AT&T is not. This is like arguing police shouldn't be able to pick the lock of your drug safehouse door because you aren't allowed to pick other people's locks.
- nickodell 12y ago
  That's the thing - the FBI didn't have a warrant. They're trying to argue that they should be allowed to use the information anyway, because it wasn't 'hacking,' it was 'entering miscellaneous strings.' On a related note, why the hell didn't they get a warrant? I doubt it would have taken long.

bradleyjg 12y ago

Even if true it could be a parallel construction.

virtue3 12y ago
I don't think anyone here is even remotely doubting that this is anything BUT parallel construction.
- deleted 12y ago
  [deleted]
- psykovsky 12y ago
  Maybe the IP leaked because the "lawful hackers" made it leak...
- spacemanmatt 12y ago
  I was looking for this sentiment before I made my own post. There is absolutely no reason to think the FBI did their work the difficult-but-legal way when they already get rich feeds from NSA. This is parallel construction all the way. I hope the defense figures out how to make a giant stink about that.
- xorcist 12y ago
  While that may or may not be true (which is completely in the spirit of parallel construction, and it fscks with your mind), we ARE talking about the guy who registered an account to advertise his illegal drug marketplace using his personal email address. That part is fully visible and timestamped, and can not in any plausible way have been planted. With someone so full of himself, pretty much anything is possible.

deleted 12y ago

[deleted]

mpyne 12y ago
His accuser signed his name to the criminal complaint already, if you'd read the indictment.

thinkcomp 12y ago

The full docket of the USA v. Ulbricht case is available at: http://www.plainsite.org/dockets/20nlzy0uz/new-york-southern-district-court/usa-v-ulbricht/ http://www.plainsite.org/dockets/20nlzy0uz/new-york-southern...

blueking 12y ago

Bullshit.

ChuckMcM 12y ago

Curious why they didn't include this description in the original indictment. I don't read a lot of indictment documents but pretty much all that I have laid out the steps law enforcement took to ascertain that a crime had taken place and that the person they were indicting was the person they believe committed that crime. I could them requesting that the description remain under seal to foil other poor server maintainers from protecting their identity but that isn't what happened here.

jacques_chester 12y ago
It wasn't an issue until it was raised by the defence.
- ChuckMcM 12y ago
  Hmm refreshing my memory here, this [1] is the search warrant for SABU (of Anonymous) and the claim is that the FBI didn't need a warrant for Ulbricht (which is where this stuff would have been outlined). At least I can't find such a warrant with basic searching techniques. So I'm guessing had they gotten a warrant (does Iceland need such things?), they would have presumably said all of this in the warrant. [1] http://www.scribd.com/doc/197510285/a http://www.scribd.com/doc/197510285/a

tedchs 12y ago

Article says the FBI located the server by entering "miscellaneous" input into the Silk Road login page, which at some point disclosed an IP address. I wonder if they got the Web server to throw a 500 or similar error, that rendered some debug output?

maxk42 12y ago

This is just the cover-story.

voltagex_ 12y ago
Prove it.
- programmarchy 12y ago
  Sorry citizen, that's classified.

cyphunk 12y ago

"fiddling" with "miscellaneous" input characters could be confirmed with server logs. i wondering if the defence will pursue this.

seansoutpost 12y ago

Parallel Construction

techdragon 12y ago
You know, its quite likely. It feels pretty kinda flimsy but without more evidence from the other side yet, it could have been that easy.
- Alupis 12y ago
  It seems fabricated at best. SR was up for a long time... and I'm sure made a lot of enemies... not to mention bots trying to pound on it... So it seems very unlikely that something as basic as not escaping user input strings would bring them down...
andy_ppp 12y ago
Does the Tor Browser allow you to access things on the Internet, because surely it shouldn't, therefore the Captcha should have failed to load for a high percentage of Internet users?
- duskwuff 12y ago
  The Tor Browser will let you access things on the Internet... using Tor.

logn 12y ago

I think that given the revelations of parallel reconstruction in general, the burden should be on the prosecution to prove that the NSA et al. were not involved. An illegal search/seizure could very well have been what gave the FBI the idea to find the IP address in this way. Given that the NSA is able to collect most internet traffic, and they've been sharing info with other agencies, I would think that most evidence against any defendant could be thrown out. Yes, that would be ludicrous, and that's exactly why the NSA needs to be reformed.

RachelF 12y ago
The hard thing with parallel constructed evidence is to prove that this is how it is done. I doubt whether a judge will throw out evidence unless you can prove that it is a parallel construction, and that this was illegal.
hahainternet 12y ago
> the burden should be on the prosecution to prove that the NSA et al. were not involved You can't prove a negative.
- spacemanmatt 12y ago
  They should be obligated to testify to the truth under oath. It's not proof but gets their position into court records.
  - tedunangst 12y ago
    And they will. The trial isn't over. Somebody will get on the stand, be sworn in, and then explain the actions he took to reveal the server's IP.

xnull2guest 12y ago

Hmm... http://www.ehackingnews.com/2013/08/almost-half-of-tor-sites-compromised-by.html http://www.ehackingnews.com/2013/08/almost-half-of-tor-sites... http://www.wired.com/2013/09/freedom-hosting-fbi/ http://www.wired.com/2013/09/freedom-hosting-fbi/ Somehow "fiddling with inputs" and "noticing an IP", while innocently phrased, sounds unlikely. It's just so hard to know whether this is parallel construction. The FBI's history with false testimony (i.e. COINTELPRO) is more than damning. The 'not in the US, not subject to US law' is a common trick, and also a way both that the NSA skirts laws about monitoring US citizens (Snowden's leaked documents repeated showed how partners with the NSA regularly traded bulk information on US communications for their own), how the CIA and FBI are able to stop Americans and journalists abroad and how intelligence agencies can propagandize its own citizens while retaining plausible deniability. The CIA is authorized to, and in fact in the past decade and a half heavily decided to, plant stories to international media wire drops that US journalists subscribe and use as a source of information. The CIA also works with partners overseas and private enterprises to engineer foreign stories that the US media will also follow and use for reports (Lincohn Group, Zarqawi PsyOp, etc). Inevitably some of the material released to the Voice of America and other international propaganda outlets make it back to the US Media. Furthermore information is now able to be targeted in very sophisticated ways (i.e. MINERVA, USAID Cuba Twitter program) for the spread of ideas and support (or dissidence) via 'social contagions', all without ever having to directly propagandize any citizens. These sorts of programs are the ultimate and extreme irony of the Soft Power philosophy. I find it unfortunate that the Constitution grants rights restricting search and seizure (and others) but that our representation does not recognize these rights, broadly 'de facto' recognize, as rights worth enforcing outside a strictly domestic interpretation. Are these "rights" or "Rights" if our representation allows and even encourages others to infringe on them?

scotty79 12y ago

So fiddling with a website to obtain information not intended for you is legal now? Because if that's so then awesome. Tell Weev's lawyers.

psykovsky 12y ago
I don't think laws apply retroactively.
- scotty79 12y ago
  That's not a new law. Just incosistent application.

sktrdie 12y ago

I know a lot of "software" solutions are being discussed in this thread for greater anonymity, but I would personally simply opt for a more secure physical solution. Such as hosting the server somewhere that doesn't require you to give away any of your information. I know this may sound silly, but there's tons of USB stick sized linux machines that you can plug virtually anywhere. I'm thinking of public spaces such as public wifis. The ToR address can be relayed to other locations if it ever gets breached. And ToR hidden services work great even if you're behind a firewall. This seems a lot more sensitive than opting for a system where your name is somehow attached to a server.

mattmanser 12y ago
How could you run a popular website via the upload pipe supplied by a public wifi? There's no way that's practical.

yutah 12y ago

Was that "Parallel construction" from the FBI to hide it's NSA source (intelligence laundering)? https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intelligence-laundering https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...

maximumoverload 12y ago

From /r/darknetmarkets (so grain of salt is needed): > yeah it was about 6-9 months before it shut down if I remember correctly, it was pretty highly upvoted and a lot of chatter about it on the SR forums. though I think there were at least a few bugs that they had to shut down for once they realized that their asses were on the line. http://www.reddit.com/r/DarkNetMarkets/comments/2flnlp/fbi_says_sr1_server_ip_located_via_errors_in/ckakq1v http://www.reddit.com/r/DarkNetMarkets/comments/2flnlp/fbi_s... So yeah, apparently this was an actual bug.

tedunangst 12y ago
But, but, but... "Even a rookie would know better, and DPR is no rookie." http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_be_worried_showing_on_login_page/c9s11v8 http://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_b...
- xorcist 12y ago
  Literally everything about DPR screams rookie. From the fact that he had to ask around on public web forums to get Tor set up, to his PHP skillz. I know this is in hindsight, but you had to be pretty deep in the reality distorsion field not to see this coming.