15 ms·

The theory I posted last year on Stack Exchange [0]: > The above environment variables were being dumped in the source of the login page on Silk Road. They con

by nikcub 12y ago

The theory I posted last year on Stack Exchange [0]: > The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server. notbad.gif. Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. edit: To add a third point: If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. Clients/users should be doing the same as well as it protects against the malware attacks (even better freeze a VM snapshot and restore it each time you need it). Whonix[1] does this - although it is easy to setup yourself (I use OpenBSD as the gateway, much slimmer than Whonix and a whole lot less going on) [0] http://security.stackexchange.com/a/43280 http://security.stackexchange.com/a/43280 [1] http://www.whonix.org http://www.whonix.org

spinlock 12y ago
I was just thinking about the second point you bring up. Isn't this still an illegal search because they purposefully circumvented digital security?
- tedunangst 12y ago
  Wouldn't circumvention be more accurate if they had successfully brute forced a login? Clicking "View Source" on the error page doesn't sound like circumvention.
  - fleitz 12y ago
    The question is whether the usage was authorized not whether it was successful.
    - XorNot 12y ago
      This seems like a poor defense choice. In Australia, a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them. This was ultimately to prevent stuff like burglars falling through skylights, then suing the owner of the house they were burgling in civil court while facing criminal prosecution. I'd be staggered if it was possible to make a relatively weak "authorization" claim stick, seeing as how the police do have the right to investigate things left "in plain view" which you could argue a web server page which you accidentally sent compromising fuzz data too could fall under. A court would also have little trouble allowing such a thing, since it's a narrow interpretation that doesn't legalize it for the ordinary citizen (though IMO I think it probably should be).
      - ptwiggens 12y ago
        "a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them." That doesn't make sense to me. You haven't "committed a crime" until you've been convicted. You seem to be saying that you lose the rights merely by being suspected of a crime. If that is the case, those rights don't actually exist in the first place. In the US, they have successfully prosecuted people for "fiddling" just like the FBI did here.
        tedunangst 12y ago
        Example of somebody prosecuted strictly for fiddling? To answer my own question, I guess you could say weev, but I think his troubles really began when he made the pivot from fiddling to mass scraping. I think it's harder to argue the FBI's access was unauthorized when what they were looking at was the "access is denied" page.
        XorNot 12y ago
        If you've been charged with a criminal crime, you can't press a civil suit against the victim, essentially. The point here is somewhat similar: trying to sue the FBI for unauthorized access to a server would hinge on the relative standing of that law compared to much more serious offences (i.e. conspiracy to murder being the big one) - since the case would have to come from DPR against the FBI, and would thus be subject I suspect to similar tests of standing. Other people have made the wider point more thoroughly as well - you'd really struggle to prove wrongdoing when all that was acquired was an IP address.
- asdfaoeu 12y ago
  Well warrants let them bypass physical security why would digital security be exempt?
  - canjobear 12y ago
    The claim is that they did this before getting a warrant.
    - deleted 12y ago
      [deleted]
    - mpyne 12y ago
      Which they could easily claim as being incidental to gathering the evidence needed to obtain the probable cause that is mandatory for a warrant. CFAA talks about "unauthorized access", not about any "unwanted" interaction with a computer. Though I think FBI will simply claims that the steps used at that stage of the investigation were implicitly permitted by the fact that it was conducted for a lawful government purpose (there's some fancy legal term for this, but I forget what it is), and wasn't otherwise forbidden to the government since it didn't involve a search or seizure. If accepted, that would mean that J. Random Hacker doesn't get to mess around with websites just because the FBI got to, even in situations short of CFAA violations.
      - maxerickson 12y ago
        I can't imagine there was anything between the FBI and site that established a context for them to be attempting to access a user on the system that they had not created. So I hope they are relying on some investigative authority and not some hairsplitting definition of unauthorized. edit: I guess they could have been providing incorrect passwords for an account that they created. I agree that is easier to call unwanted.
        mpyne 12y ago
        Reading the Krebs story on this same topic (http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...), it occurs to me that FBI may not have needed to try to authenticate at all. Basically all the analyst said he did was to load the SR website far enough until the captcha popped up, and notice in the wireshark (or equivalent) logs that a non-Tor IP address was reached from the SR website. If the analyst tooled around on the website after that, then even if the court were to call foul on that subsequent access, the public IP address wasn't derived from tooling around so it (and the evidence derived from that) wouldn't be at risk either.
- nikcub 12y ago
  Most people replying here will be as sarcastic as I was - but there is a serious question here which i'm certain Ulbricht's defense will ask and challenge. The motions filed leading up to this FBI filing have all been about cornering the FBI into revealing this information specifically so they could challenge it (knowing the information wasn't obtained with a warrant). On that note it seems like his lawyers are performing well, they have challenged absolutely everything in pre-trial motions and there have been some interesting rulings (they've lost almost all of them). Warrantless surveillance of foreign servers plus the domestic "general warrants"[0], "bitcoin isn't money"[1], his hacking charge under the CFAA[2] and now a likely challenge to the server evidence that was found by "manipulating inputs" (which is interesting to contrast to Ulbricht's own hacking charge). Both the motion to dismiss and the judges ruling are interesting reads: http://www.scribd.com/doc/215745393/USA-v-Ulbricht-motion-to-dismiss-charges http://www.scribd.com/doc/215745393/USA-v-Ulbricht-motion-to... http://www.scribd.com/doc/233234104/Forrest-Denial-of-Defense-Motion-in-Silk-Road-Case http://www.scribd.com/doc/233234104/Forrest-Denial-of-Defens... I'd be interested to know what an experience lawyer or trial specialist thinks of how it has been going so far. I have yet to find a good opinion piece on the topic. [0] http://freeross.org/feds-silk-road-investigation-broke-privacy-laws-defendant-tells-court/ http://freeross.org/feds-silk-road-investigation-broke-priva... [1] http://www.wired.com/2014/07/silkroad-bitcoin-isnt-money/ http://www.wired.com/2014/07/silkroad-bitcoin-isnt-money/ [2] http://arstechnica.com/tech-policy/2014/07/judge-denies-silk-roads-demands-to-dismiss-criminal-prosecution/ http://arstechnica.com/tech-policy/2014/07/judge-denies-silk...
  - at-fates-hands 12y ago
    I have several criminal defense attorneys I speak with on a regular basis and they always have interesting takes on high profile cases. They basically said his attorneys are doing the right thing by going after the warrant stuff. It's pretty standard in legal circles. Go at the base of their argument. If you can get the original warrant through out, it all goes. The only problem is they suspect this is the only real strategy his defense team has right now. Once the judge rules on this - which my attorney friends believe will be on the FBI's side, his defense team won't have much to pivot on. All the evidence is now compounded and will stick. Which as the article pointed out, is pretty bad for him. It will also confirm his identity as 'Dread Pirate' which a lot of the case hinges on. Once the FBI get that point nailed down, the rest is pretty academic. The only thing that would make this interesting is if the judge rules against the FBI and hence forth a majority of the FBI's case is destroyed. Both of my friends figured the FBI will drop that case and simply let the federal case on conspiracy to commit murder and hiring a hitman run its course. Also, keep in mind there are still three other admins that have been indicted. If they get any of those guys to give them more information about Albrecht, it's all down hill from there. They might not even need most of the stuff they entered as evidence if they can get one of these three to roll over on Albrecht. Pretty much any way you slice it - he's screwed.
void-star 12y ago
As to the second point. This "fiddling" with "miscellaneous" input characters could also be interpreted cover brute-forcing login attempts. I'm not sure that's a good precedent...
- nmjohn 12y ago
  If there is an external server that is vulnerable to a brute force attack, it is trivial to exploit it anonymously. People who get caught trying to brute force servers (do people even get caught for this???) are the lowest hanging fruit and are the ones least harmful to society. My point is precedent doesn't really matter, because realistically, you won't have anyone to actually prosecute except for the 13 year old "hacker" who had no idea what they were doing.
- cesarb 12y ago
  If it was "miscellaneous" input characters, it probably wasn't brute-forcing login attempts. Brute-forcing logins would use mostly alphanumeric input characters, not "miscellaneous" input characters. The word "miscellaneous" to me implies things like quotes, backticks, and similar non-alphanumeric characters. "Fiddling" with them would be attempting to find somewhere that didn't quote an input value correctly: they were attempting to find something like an SQL injection.
  - tedunangst 12y ago
    My understanding is that they attempted a login a few times. User: dpr. Password: ababa, dada, bobo, etc. This in turn triggers the web app to display a captcha after too many failures. The img src for the captcha revealed the IP. It wasn't much of a "brute force" attack, it wasn't SQL injection (though it's possible they were poking at that too), but just the simple question, what happens if we try to login five times with "miscellaneous" passwords? Hey, look, a captcha! I wonder what server the image comes from...
    - DINKDINK 12y ago
      What would cause the captcha's image to leak the ip but a regular image on the tor website not?
meowface 12y ago
> If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. While this is good advice and will help you in the event of your server accidentally leaking debugging/config information, it won't help if someone is able to get the hidden service to make a network request. For example, if they can get it to send an email or check if a page is online, then that email will obviously go through the gateway. And obviously if someone gains arbitrary code execution, they can just Google "my IP" and see the externally facing IP. Some other useful advice: if you're setting up a Tor hidden service, make sure the HTTP server only accepts requests from the Tor network. The FBI claims that when they put the $_SERVER['SERVER_ADDR'] IP in their browser they got the SR home page right on port 80, which is extremely poor security on SR's part. Someone running a distributed scan of all web servers on the Internet could have found it on their own within a few weeks or less. And in fact, this is becoming more common as a technique to identify origin servers hidden behind reverse proxies and CDNs.
- fleitz 12y ago
  You egress filter everything that isn't tor, allowing any outbound connections other than tor will cause leaks.
- nikcub 12y ago
  That is why you have it segmented: > Put it behind a gateway that acts as an isolating proxy. You don't NAT - you forward the port required through the gateway machine and to the virtual machine. Either terminate Tor on the gateway and forward the web port, or terminate Tor on the web server and forward the Tor traffic on the gateway. In that case nothing can request out from the web server. If your server needs to make requests, such as getting the latest bitcoin price - you do that on another server and run a queue that will pull the data over.
  - atmosx 12y ago
    That's correct. Most of these guys are getting cauought because they didn't believe that will have to eventually face an enemy with so many resources (FBI/NSA). I believe that avoiding detection online can be done if you are very strict about your policies. I don't believe DRP had the knowledge to understand and the how's and why's of a setup you're describe unlike skilled engineers[1] who design multi-layered approaches. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb...
willvarfar 12y ago
Do you know if torbrowserbundle or tails etc uses any kind of virtualization to isolate things? Its an off hand observation I've made before e.g. https://github.com/paulczar/docker-torbrowser/issues/2 https://github.com/paulczar/docker-torbrowser/issues/2 Tor should run in a VM or container, and the browser should run in a container that can only talk to the tor, and the only other way out is a dumb screen scraping display for the browser. Make sense?
- Homunculiheaded 12y ago
  Tails answers this question on their site [0] Their general opinion is that this makes Tails less secure as now you have to trust both the host and the visualization software. Provided that you trust Tails itself. The expected way to run it is off of a live cd. This way the trusted OS is only ever in ram, and if you use a non-rewritable disk you can also be assured that the Tails disk itself cannot be modified after its creation. Tails handles the 'only talking to Tor' via iptables. Unless I am mistaken Tails' firewall will not allow clearnet connections. [0] https://tails.boum.org/doc/advanced_topics/virtualization/index.en.html https://tails.boum.org/doc/advanced_topics/virtualization/in...
  - willvarfar 12y ago
    This is not the same question. The question is, inside the tails itself, should apps like the browser and your mail and chat programs be isolated from each other i.e. placed in "jails", "containers", "zones" or whatever? Security in depth.
  - dobbsbob 12y ago
    Tails has an 'unsafe browser' so you can log into wifi gateways then start the regular browser. If I'm a federal agent in need to decloak Tails users I would probably target that script that disables the firewall that any unprivileged user can run. If you don't need the script probably a good idea to build Tails without it
- alexanderh 12y ago
  > Tor should run in a VM or container Tails: https://tails.boum.org/ https://tails.boum.org/
dobbsbob 12y ago
Isn't there a major PRNG state issue with freezing and reusing snapshots?
- nikcub 12y ago
  Yes there is, I ignore it on the desktop (which isn't good)[0] and run a script to reseed, but on the server/gateway I'd completely avoid freezing. To make it worse, I never install the VM tools on any machine because i've always felt they are all crappy and insecure (and make VM detection easy). Most of the VM drivers try and fix this problem, but it would be best fixed with either virtualization hooks where commends are run in the client by the host whenever you freeze/unfreeze. [0] this understanding the pros/cons of each approach and weighing them up. i'd rather have a good known snapshot to start off with each time I use it (and deal with side effects such as time sync, rng seed, handling updates, etc.) than have a long-running machine.
  - devicenull 12y ago
    Does the VirtIO-RNG functionality provided by qemu help here? Linux will use it as a hardware RNG.
Zuider 12y ago
>it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. Unless Ulbricht's lawyers successfully argue that fuzzing constitutes an illegal search. The law respects precedent, and there is more precedent which finds that fuzzing leads to illegal access.
downandout 12y ago
>Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. I was wondering about this as well. If this kind of thing is not done pursuant to a search warrant and is in violation of the site's TOS, is it legal for them to do? What happens if I put a blanket ban in the TOS on use of the site by anyone acting as an agent of any law enforcement agency? Certainly with a warrant, it would hold up , but without one, it may not. Interesting legal question, I guess only time will tell.
- dominicmauro 12y ago
  > What happens if I put a blanket ban in the TOS on use of the site by anyone acting as an agent of any law enforcement agency? Certainly with a warrant, it would hold up , but without one, it may not. Actually, I'm not so sure you don't have that backwards. If a police officer shows up at your door without a warrant, you can tell him "hey, no cops allowed in my house!" and make him leave. But he or she has a warrant, you can deny them all you want, but they're legally entitled to come in and look for stuff. With a login page, it would work roughly the same way. "No cops allowed" might work, but not once a judge gives the police a right to be where you don't particularly want them.
  - psykovsky 12y ago
    I think the point is: all that was one WITHOUT a warrant...

by nikcub 12y ago

spinlock 12y ago

I was just thinking about the second point you bring up. Isn't this still an illegal search because they purposefully circumvented digital security?

tedunangst 12y ago
Wouldn't circumvention be more accurate if they had successfully brute forced a login? Clicking "View Source" on the error page doesn't sound like circumvention.
- fleitz 12y ago
  The question is whether the usage was authorized not whether it was successful.
  - XorNot 12y ago
    This seems like a poor defense choice. In Australia, a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them. This was ultimately to prevent stuff like burglars falling through skylights, then suing the owner of the house they were burgling in civil court while facing criminal prosecution. I'd be staggered if it was possible to make a relatively weak "authorization" claim stick, seeing as how the police do have the right to investigate things left "in plain view" which you could argue a web server page which you accidentally sent compromising fuzz data too could fall under. A court would also have little trouble allowing such a thing, since it's a narrow interpretation that doesn't legalize it for the ordinary citizen (though IMO I think it probably should be).
    - ptwiggens 12y ago
      "a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them." That doesn't make sense to me. You haven't "committed a crime" until you've been convicted. You seem to be saying that you lose the rights merely by being suspected of a crime. If that is the case, those rights don't actually exist in the first place. In the US, they have successfully prosecuted people for "fiddling" just like the FBI did here.
      - tedunangst 12y ago
        Example of somebody prosecuted strictly for fiddling? To answer my own question, I guess you could say weev, but I think his troubles really began when he made the pivot from fiddling to mass scraping. I think it's harder to argue the FBI's access was unauthorized when what they were looking at was the "access is denied" page.
      - XorNot 12y ago
        If you've been charged with a criminal crime, you can't press a civil suit against the victim, essentially. The point here is somewhat similar: trying to sue the FBI for unauthorized access to a server would hinge on the relative standing of that law compared to much more serious offences (i.e. conspiracy to murder being the big one) - since the case would have to come from DPR against the FBI, and would thus be subject I suspect to similar tests of standing. Other people have made the wider point more thoroughly as well - you'd really struggle to prove wrongdoing when all that was acquired was an IP address.
asdfaoeu 12y ago
Well warrants let them bypass physical security why would digital security be exempt?
- canjobear 12y ago
  The claim is that they did this before getting a warrant.
  - deleted 12y ago
    [deleted]
  - mpyne 12y ago
    Which they could easily claim as being incidental to gathering the evidence needed to obtain the probable cause that is mandatory for a warrant. CFAA talks about "unauthorized access", not about any "unwanted" interaction with a computer. Though I think FBI will simply claims that the steps used at that stage of the investigation were implicitly permitted by the fact that it was conducted for a lawful government purpose (there's some fancy legal term for this, but I forget what it is), and wasn't otherwise forbidden to the government since it didn't involve a search or seizure. If accepted, that would mean that J. Random Hacker doesn't get to mess around with websites just because the FBI got to, even in situations short of CFAA violations.
    - maxerickson 12y ago
      I can't imagine there was anything between the FBI and site that established a context for them to be attempting to access a user on the system that they had not created. So I hope they are relying on some investigative authority and not some hairsplitting definition of unauthorized. edit: I guess they could have been providing incorrect passwords for an account that they created. I agree that is easier to call unwanted.
      - mpyne 12y ago
        Reading the Krebs story on this same topic (http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...), it occurs to me that FBI may not have needed to try to authenticate at all. Basically all the analyst said he did was to load the SR website far enough until the captcha popped up, and notice in the wireshark (or equivalent) logs that a non-Tor IP address was reached from the SR website. If the analyst tooled around on the website after that, then even if the court were to call foul on that subsequent access, the public IP address wasn't derived from tooling around so it (and the evidence derived from that) wouldn't be at risk either.
nikcub 12y ago
Most people replying here will be as sarcastic as I was - but there is a serious question here which i'm certain Ulbricht's defense will ask and challenge. The motions filed leading up to this FBI filing have all been about cornering the FBI into revealing this information specifically so they could challenge it (knowing the information wasn't obtained with a warrant). On that note it seems like his lawyers are performing well, they have challenged absolutely everything in pre-trial motions and there have been some interesting rulings (they've lost almost all of them). Warrantless surveillance of foreign servers plus the domestic "general warrants"[0], "bitcoin isn't money"[1], his hacking charge under the CFAA[2] and now a likely challenge to the server evidence that was found by "manipulating inputs" (which is interesting to contrast to Ulbricht's own hacking charge). Both the motion to dismiss and the judges ruling are interesting reads: http://www.scribd.com/doc/215745393/USA-v-Ulbricht-motion-to-dismiss-charges http://www.scribd.com/doc/215745393/USA-v-Ulbricht-motion-to... http://www.scribd.com/doc/233234104/Forrest-Denial-of-Defense-Motion-in-Silk-Road-Case http://www.scribd.com/doc/233234104/Forrest-Denial-of-Defens... I'd be interested to know what an experience lawyer or trial specialist thinks of how it has been going so far. I have yet to find a good opinion piece on the topic. [0] http://freeross.org/feds-silk-road-investigation-broke-privacy-laws-defendant-tells-court/ http://freeross.org/feds-silk-road-investigation-broke-priva... [1] http://www.wired.com/2014/07/silkroad-bitcoin-isnt-money/ http://www.wired.com/2014/07/silkroad-bitcoin-isnt-money/ [2] http://arstechnica.com/tech-policy/2014/07/judge-denies-silk-roads-demands-to-dismiss-criminal-prosecution/ http://arstechnica.com/tech-policy/2014/07/judge-denies-silk...
- at-fates-hands 12y ago
  I have several criminal defense attorneys I speak with on a regular basis and they always have interesting takes on high profile cases. They basically said his attorneys are doing the right thing by going after the warrant stuff. It's pretty standard in legal circles. Go at the base of their argument. If you can get the original warrant through out, it all goes. The only problem is they suspect this is the only real strategy his defense team has right now. Once the judge rules on this - which my attorney friends believe will be on the FBI's side, his defense team won't have much to pivot on. All the evidence is now compounded and will stick. Which as the article pointed out, is pretty bad for him. It will also confirm his identity as 'Dread Pirate' which a lot of the case hinges on. Once the FBI get that point nailed down, the rest is pretty academic. The only thing that would make this interesting is if the judge rules against the FBI and hence forth a majority of the FBI's case is destroyed. Both of my friends figured the FBI will drop that case and simply let the federal case on conspiracy to commit murder and hiring a hitman run its course. Also, keep in mind there are still three other admins that have been indicted. If they get any of those guys to give them more information about Albrecht, it's all down hill from there. They might not even need most of the stuff they entered as evidence if they can get one of these three to roll over on Albrecht. Pretty much any way you slice it - he's screwed.

void-star 12y ago

As to the second point. This "fiddling" with "miscellaneous" input characters could also be interpreted cover brute-forcing login attempts. I'm not sure that's a good precedent...

nmjohn 12y ago
If there is an external server that is vulnerable to a brute force attack, it is trivial to exploit it anonymously. People who get caught trying to brute force servers (do people even get caught for this???) are the lowest hanging fruit and are the ones least harmful to society. My point is precedent doesn't really matter, because realistically, you won't have anyone to actually prosecute except for the 13 year old "hacker" who had no idea what they were doing.
cesarb 12y ago
If it was "miscellaneous" input characters, it probably wasn't brute-forcing login attempts. Brute-forcing logins would use mostly alphanumeric input characters, not "miscellaneous" input characters. The word "miscellaneous" to me implies things like quotes, backticks, and similar non-alphanumeric characters. "Fiddling" with them would be attempting to find somewhere that didn't quote an input value correctly: they were attempting to find something like an SQL injection.
- tedunangst 12y ago
  My understanding is that they attempted a login a few times. User: dpr. Password: ababa, dada, bobo, etc. This in turn triggers the web app to display a captcha after too many failures. The img src for the captcha revealed the IP. It wasn't much of a "brute force" attack, it wasn't SQL injection (though it's possible they were poking at that too), but just the simple question, what happens if we try to login five times with "miscellaneous" passwords? Hey, look, a captcha! I wonder what server the image comes from...
  - DINKDINK 12y ago
    What would cause the captcha's image to leak the ip but a regular image on the tor website not?

meowface 12y ago

> If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. While this is good advice and will help you in the event of your server accidentally leaking debugging/config information, it won't help if someone is able to get the hidden service to make a network request. For example, if they can get it to send an email or check if a page is online, then that email will obviously go through the gateway. And obviously if someone gains arbitrary code execution, they can just Google "my IP" and see the externally facing IP. Some other useful advice: if you're setting up a Tor hidden service, make sure the HTTP server only accepts requests from the Tor network. The FBI claims that when they put the $_SERVER['SERVER_ADDR'] IP in their browser they got the SR home page right on port 80, which is extremely poor security on SR's part. Someone running a distributed scan of all web servers on the Internet could have found it on their own within a few weeks or less. And in fact, this is becoming more common as a technique to identify origin servers hidden behind reverse proxies and CDNs.

fleitz 12y ago
You egress filter everything that isn't tor, allowing any outbound connections other than tor will cause leaks.
nikcub 12y ago
That is why you have it segmented: > Put it behind a gateway that acts as an isolating proxy. You don't NAT - you forward the port required through the gateway machine and to the virtual machine. Either terminate Tor on the gateway and forward the web port, or terminate Tor on the web server and forward the Tor traffic on the gateway. In that case nothing can request out from the web server. If your server needs to make requests, such as getting the latest bitcoin price - you do that on another server and run a queue that will pull the data over.
- atmosx 12y ago
  That's correct. Most of these guys are getting cauought because they didn't believe that will have to eventually face an enemy with so many resources (FBI/NSA). I believe that avoiding detection online can be done if you are very strict about your policies. I don't believe DRP had the knowledge to understand and the how's and why's of a setup you're describe unlike skilled engineers[1] who design multi-layered approaches. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb...

willvarfar 12y ago

Do you know if torbrowserbundle or tails etc uses any kind of virtualization to isolate things? Its an off hand observation I've made before e.g. https://github.com/paulczar/docker-torbrowser/issues/2 https://github.com/paulczar/docker-torbrowser/issues/2 Tor should run in a VM or container, and the browser should run in a container that can only talk to the tor, and the only other way out is a dumb screen scraping display for the browser. Make sense?

Homunculiheaded 12y ago
Tails answers this question on their site [0] Their general opinion is that this makes Tails less secure as now you have to trust both the host and the visualization software. Provided that you trust Tails itself. The expected way to run it is off of a live cd. This way the trusted OS is only ever in ram, and if you use a non-rewritable disk you can also be assured that the Tails disk itself cannot be modified after its creation. Tails handles the 'only talking to Tor' via iptables. Unless I am mistaken Tails' firewall will not allow clearnet connections. [0] https://tails.boum.org/doc/advanced_topics/virtualization/index.en.html https://tails.boum.org/doc/advanced_topics/virtualization/in...
- willvarfar 12y ago
  This is not the same question. The question is, inside the tails itself, should apps like the browser and your mail and chat programs be isolated from each other i.e. placed in "jails", "containers", "zones" or whatever? Security in depth.
- dobbsbob 12y ago
  Tails has an 'unsafe browser' so you can log into wifi gateways then start the regular browser. If I'm a federal agent in need to decloak Tails users I would probably target that script that disables the firewall that any unprivileged user can run. If you don't need the script probably a good idea to build Tails without it
alexanderh 12y ago
> Tor should run in a VM or container Tails: https://tails.boum.org/ https://tails.boum.org/

dobbsbob 12y ago

Isn't there a major PRNG state issue with freezing and reusing snapshots?

nikcub 12y ago
Yes there is, I ignore it on the desktop (which isn't good)[0] and run a script to reseed, but on the server/gateway I'd completely avoid freezing. To make it worse, I never install the VM tools on any machine because i've always felt they are all crappy and insecure (and make VM detection easy). Most of the VM drivers try and fix this problem, but it would be best fixed with either virtualization hooks where commends are run in the client by the host whenever you freeze/unfreeze. [0] this understanding the pros/cons of each approach and weighing them up. i'd rather have a good known snapshot to start off with each time I use it (and deal with side effects such as time sync, rng seed, handling updates, etc.) than have a long-running machine.
- devicenull 12y ago
  Does the VirtIO-RNG functionality provided by qemu help here? Linux will use it as a hardware RNG.

Zuider 12y ago

>it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. Unless Ulbricht's lawyers successfully argue that fuzzing constitutes an illegal search. The law respects precedent, and there is more precedent which finds that fuzzing leads to illegal access.

downandout 12y ago

>Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite. I was wondering about this as well. If this kind of thing is not done pursuant to a search warrant and is in violation of the site's TOS, is it legal for them to do? What happens if I put a blanket ban in the TOS on use of the site by anyone acting as an agent of any law enforcement agency? Certainly with a warrant, it would hold up , but without one, it may not. Interesting legal question, I guess only time will tell.

dominicmauro 12y ago
> What happens if I put a blanket ban in the TOS on use of the site by anyone acting as an agent of any law enforcement agency? Certainly with a warrant, it would hold up , but without one, it may not. Actually, I'm not so sure you don't have that backwards. If a police officer shows up at your door without a warrant, you can tell him "hey, no cops allowed in my house!" and make him leave. But he or she has a warrant, you can deny them all you want, but they're legally entitled to come in and look for stuff. With a login page, it would work roughly the same way. "No cops allowed" might work, but not once a judge gives the police a right to be where you don't particularly want them.
- psykovsky 12y ago
  I think the point is: all that was one WITHOUT a warrant...