4 ms·

If the site was accessible through an IP, could scanning ports and looking for a particular item on the homepage have identified it?

jagger27 12y ago
The web server probably wasn't visible on the public internet, but apparently the machine itself was.
- philip1209 12y ago
  "And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared, the garbled-letter image designed to prevent spam bots from entering the site."
  - scintill76 12y ago
    Ouch. In retrospect, seems like they could have almost brute-forced it, if they had a narrow enough block of IP addresses they thought it was in. Fetch the root page on all the IP addresses looking for something that looks like SR.
    - TheLoneWolfling 12y ago
      You could probably do that for the entire internet, assuming you had their levels of resources.
      - spiritplumber 12y ago
        Isn't that what the NSA does?
      - CJefferson 12y ago
        You could do that in the comfort of your own home, with a decent Internet connection (for example with https://zmap.io/ https://zmap.io/)
  - jagger27 12y ago
    Woops, missed that line.
MichaelGG 12y ago
Yep! Sounds like a pretty big problem. With 10,000 scanning processes taking 5/sec per IP, it'd take less than a month to scan all IPs. It should be easy for a powerful adversary to scale this up and finish in a day or two. It'd take more work if all ports need to be scanned, but restricting to just known hosting blocks could shave a bit off. As could eliminating well-known good sites from a first pass. It would surprise me if the FBI isn't already doing this for all known onion sites, just to have the info around. At any rate, sounds like a real basic Opsec101 failure on The Silk Road. Not that hidden services are that safe in the first place. The Tor folks have written about how hidden services are quite vulnerable to some attacks. Not something I'd want to rely on to save me from a 30 year sentence. Edit: If someone had to run a hidden service, it might make sense to setup another onion site (on another Tor instance) and expose that on port 80, as part of misinformation tactic. Reading several incidents, it seems attackers will use circumstancial evidence to help narrow down the possibilities. By intentionally leaking things (like offhand comments about the weather, using reports from another city) one might be able to gain a few more bits of anonymity back. Of course someone doing such a thing wouldn't setup their illegal site on a public IP in the first place.
- dllthomas 12y ago
  It's my understanding that most OpSec failures are real basic OpSec 101 failures. Not because, faced with the question, it's hard to get it right - but because faced with so many questions it is hard to get all of them right, and screwing one up is frequently enough.
gvb 12y ago
Yes but no. All you would have had was a captcha image, you have no way of knowing it was the Silk Road captcha image. If you scan the internet, you will find millions of captcha images. The FBI went the other way: they had the SR login page with an an unknown non-TOR IP address and asked "what is at this IP address?" Since it was a captcha image, and captcha images have to be sourced by the web site that is doing the captcha verification, it strongly implied the IP address was the SR server. As it turned out, it was. As a co-worker said, "When you live in an egg shell, small cracks are deadly."

jagger27 12y ago

The web server probably wasn't visible on the public internet, but apparently the machine itself was.

philip1209 12y ago
"And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared, the garbled-letter image designed to prevent spam bots from entering the site."
- scintill76 12y ago
  Ouch. In retrospect, seems like they could have almost brute-forced it, if they had a narrow enough block of IP addresses they thought it was in. Fetch the root page on all the IP addresses looking for something that looks like SR.
  - TheLoneWolfling 12y ago
    You could probably do that for the entire internet, assuming you had their levels of resources.
    - spiritplumber 12y ago
      Isn't that what the NSA does?
    - CJefferson 12y ago
      You could do that in the comfort of your own home, with a decent Internet connection (for example with https://zmap.io/ https://zmap.io/)
- jagger27 12y ago
  Woops, missed that line.

MichaelGG 12y ago

Yep! Sounds like a pretty big problem. With 10,000 scanning processes taking 5/sec per IP, it'd take less than a month to scan all IPs. It should be easy for a powerful adversary to scale this up and finish in a day or two. It'd take more work if all ports need to be scanned, but restricting to just known hosting blocks could shave a bit off. As could eliminating well-known good sites from a first pass. It would surprise me if the FBI isn't already doing this for all known onion sites, just to have the info around. At any rate, sounds like a real basic Opsec101 failure on The Silk Road. Not that hidden services are that safe in the first place. The Tor folks have written about how hidden services are quite vulnerable to some attacks. Not something I'd want to rely on to save me from a 30 year sentence. Edit: If someone had to run a hidden service, it might make sense to setup another onion site (on another Tor instance) and expose that on port 80, as part of misinformation tactic. Reading several incidents, it seems attackers will use circumstancial evidence to help narrow down the possibilities. By intentionally leaking things (like offhand comments about the weather, using reports from another city) one might be able to gain a few more bits of anonymity back. Of course someone doing such a thing wouldn't setup their illegal site on a public IP in the first place.

dllthomas 12y ago
It's my understanding that most OpSec failures are real basic OpSec 101 failures. Not because, faced with the question, it's hard to get it right - but because faced with so many questions it is hard to get all of them right, and screwing one up is frequently enough.

gvb 12y ago

Yes but no. All you would have had was a captcha image, you have no way of knowing it was the Silk Road captcha image. If you scan the internet, you will find millions of captcha images. The FBI went the other way: they had the SR login page with an an unknown non-TOR IP address and asked "what is at this IP address?" Since it was a captcha image, and captcha images have to be sourced by the web site that is doing the captcha verification, it strongly implied the IP address was the SR server. As it turned out, it was. As a co-worker said, "When you live in an egg shell, small cracks are deadly."