7 ms·
The Silk Road statement: Where are the packetlogs?
- datr 12y agoCouldn't the agent be referring to a http header, in which case it doesn't seem that improbable. I've worked on sites before where if you logged in as the admin it started attaching a header with the ip of the application server responsible for generating that page to help with debugging. It's not outside the realms of possibility that something like that could break and start leaking ips.
- revelation 12y agoWell, we should still ask for the evidence.
- Steko 12y agoIf by we, you mean Ulbricht's lawyers, I'm sure they're on it since illegal search is basically his only defense. We, the HN community, could probably find plenty of worthy people to advocate for that don't go around paying for assassinations.
- Hello71 12y agoWe, the HN community, could probably find plenty of worthy people to smear by accusing them of paying for assassinations.
- Steko 12y agoWell good luck with the Ross Ulbricht canonization effort, sir.
- rabite 12y agoProsecutors can write whatever fiction they want in a criminal complaint. The false criminal complaint I was once extradited on, for example, was based upon a fictitious claim that AT&T was headed in New Jersey, when a simple search of SEC Edgar or Wikipedia can verify that it is headquartered in Dallas, Texas. Federal agents have been caught lying multiple times to everyone from the public to Congress, and yet for some reason people still consistently take the garbage they say seriously.
- Steko 12y agoThe idea that because some Federal agents have lied therefore we should discount anything all of them say is farcial.
- phaus 12y agoI don't think that's what he's suggesting at all. We shouldn't automatically discount their statements, but we should start scrutinizing them very carefully before we make a call.
- mpyne 12y agoScrutiny is fine, but the "scrutiny" on display in this thread is quite fanciful indeed. It's almost as if people were hoping that FBI is, somehow, someway, wrong, instead of skeptically analyzing the data presented using critical analysis and then following where the evidence leads. E.g. the top comment right now claims that a footnote practically proves FBI employed parallel construction, based on no reasoned argument, and without examining even the possibility that there is a reasonable explanation on the FBI's behalf. So if scrutiny is the byword, let's practice scrutiny. But I'm just seeing advocacy.
- tveita 12y agoHe has. Conspiracy to Distribute a Controlled Substance; Attempted Witness Murder; Use of Interstate Commerce Facilities in Commission of Murder-for-Hire; Aiding and Abetting https://ia601904.us.archive.org/1/items/gov.uscourts.mdd.238311/gov.uscourts.mdd.238311.4.0.pdf https://ia601904.us.archive.org/1/items/gov.uscourts.mdd.238...
- tveita 12y ago(This was in response to a sentence that has now been edited out that claimed Ulbricht has never been charged for murder for hire.)
- woah 12y agoWhat does your estimation of Ulbricht's moral standing have to do with anything? The HN community is advocating for due process.
- Steko 12y agoFirst we're not a monolith. Second, I don't see people advocating for due process so much as I see outright advocacy and willful ignorance of the idea that it's possible for the FBI to indict someone without violating their due process.
- rabite 12y agoThe HTTP header is not in the packet header. It is in the data section of the TCP packet. If so, this calls the federal agent's capacity to serve as an expert witness in question.
- hahainternet 12y agoThe TCP packet is not in the 'packet header'. Both the Ethernet and IP frames precede it. How can you possibly suggest that a HTTP header doesn't count, but a TCP packet does? Weev you are disqualified due to your incorrect assertions from being an expert commentator :D
- rabite 12y agoTCP is a packet-switched protocol. HTTP is a socket-based protocol. HTTP as a protocol is a stream of bits that is carried within the data segments of a packet-based transit protocol. HTTP itself does not have a "packet header". TCP has a packet header, as one can simply verify by googling "TCP packet header". Go do some learnin', bro.
- hahainternet 12y agoWeev you know me, you also know I'm right. TCP as a protocol is a stream of bits carried within the data segments of a frame based transit protocol. Both TCP and HTTP have headers.
- rabite 12y agoHTTP does have a header, but what is carried within the data sections of TCP/IP packets created by the establishment of an HTTP socket are not packets. HTTP is not in itself a packet switched protocol. It forms a circuit. Seriously, your CCNA does not make you a networking expert.
- tveita 12y agoIt seems he was serving an embedded CAPTCHA from his real IP. http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak... Maybe he used a CAPTCHA library that generates absolute URLs using the server host name.
- mpyne 12y agoIf the agent's claim is true it wouldn't have come from an HTTP header anyways, but instead the IP address was leaked by the captcha part of the SR website, which the agent would have noticed on his wireshark-equivalent dumping TCP logs.
- deleted 12y ago[deleted]
- Nanzikambe 12y agoWhat I'd like to know is if anyone in the public domain has any packet logs from SR? I find it than incredible that, given SR's notoriety, nobody had ever used tcpdump, an interception proxy or a browser's inspector and noticed this IP before.
- mpyne 12y agoThen again, I found it incredible that HeartBleed hung out in OpenSSL for as long as it did, when you'd think there'd be at least a couple of people in every security group out there reviewing each patch for new vulns.
- pandatigox 12y agoOff topic, but I thought OP was still in prison? I can't seem to find any notes of his release on his blog, so could someone please elaborate?
- spindritf 12y agoHe's out on a technicality but unlikely to go back. https://en.wikipedia.org/wiki/Weev#Conviction_vacated https://en.wikipedia.org/wiki/Weev#Conviction_vacated
- meowface 12y agoIt's a bit unfair to say he was out on a technicality. The appeals judge ruled that the venue was improper, and venue can be extremely important. Not to mention the judge also saw several issues with the original charges.
- rms 12y agothe relevant search query was "weev conviction overturned" http://www.wired.com/2014/04/att-hacker-conviction-vacated/ http://www.wired.com/2014/04/att-hacker-conviction-vacated/
- deleted 12y ago[deleted]
- aburan28 12y agoThere was a VPN IP leaked in April-May 2013 for maybe a hour or two but then quickly corrected. That ip belonged to the VPN provider not the server host provider
- xorcist 12y agoThe underlying argument here seems to be that if the evindence was procured via unlawful means, then Ulbricht should go free even he is guilty of the crime. It seems to me as a quaint way to practice justice. What is the rationale behind this? Isn't it the court's job to establish guilt? This specific case might not be a great example to reason about, but if this was a rapist or killer that should be set free despite being screamingly obvious guilty, just because the cop was a crook too, how could that possibly be morally justified? Two wrongs does not make one right, if you ask me. Edit: An explanation would be nice, instead of the downvotes. Is it that questions about the justice system is off topic here?
- ghshephard 12y agoSee: http://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree http://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree
- xorcist 12y agoI understand how the principle works, in part because of this wikipedia article, but what I don't understand is why such a rule has been implemented.
- jiggy2011 12y agoBecause otherwise there would be little incentive for cops to follow the 4th amendment.
- xorcist 12y agoAre there really no other juridicial consequences for breaking what I understand to be a constitutional law? Perhaps there need to be. Perhaps consequences much more severe than letting a criminal walk free.
- jiggy2011 12y agoBut who would enforce those consequences? The same cops who benefit from the illegal evidence?
- Rapzid 12y agoI'm not sure they(FBI) are under any obligation to even make packet logs? Are there laws dictating this? I would think they would have just made note of the IP and the circumstances of uncovering it on paper with pen and then called it a day. Maybe save out a few raw packets. The IP address isn't the evidence against him, it was just their initial lead on the physical server...
- f3llowtraveler 12y agoI don't see how they could admit it into evidence without the packet logs. The defense would have no opportunity to examine the same evidence.
- ynniv 12y agoA footnote in the Agent's declaration even suggests Parallel Construction: After Ulbricht’s arrest, evidence was discovered on his computer reflecting that IP address leaks were a recurring problem for him. It continues on to specify specific instances of leaked IP information, which is completely irrelevant hearsay if the stated means of discovery were supported by properly documented evidence. Instead it provides circumstance in which it seems likely that the server could have been discovered through such a leak. If the server were discovered through illegal means, this information would have been useful in the construction of a technically plausible sounding alternative means. I'm not claiming that the discovery was illegal, but weev is spot on in his demand for evidence.
- Rapzid 12y agoIt's not really the Agent's job to make such legal determinations? If I was doing forensic analysis on a server under such circumstances I would have made note and reference to that as well. Again, the IP address leak isn't the real evidence anyway and I don't see how the FBI is on the hook to prove beyond a shadow of a doubt that they got the IP address the way they said they did. His attorneys are spinning a yarn and poking the FBI's story because it's their job, but I think we should not be suggesting the FBI is guilty of something and must be required to prove their innocence. If the FBI have the logs they should answer in kind, however I don't believe the absence of such logs is going to or should help his case any.
- ynniv 12y agoThat's a lot of different things. Perhaps you could focus on one and try again. If I was doing forensic analysis on a server under such circumstances I would have made note and reference to that as well. The footnote is not forensic, and not evidence, and there's no good reason for it to be there. I doubt you are a forensic investigator so it isn't relevant what you think you would have done, but if you were a good one I suspect you would have kept packet logs of everything you saw.
- Rapzid 12y ago
- yohanatan 12y ago> It is several orders of magnitude more difficult to fake packetlogs of network traffic which include a protocol as complex as Tor. I would be careful with that. It's not as difficult to fake as you might think. And a statement like this puts you entirely at the mercy of someone who is capable of faking it.
- rabite 12y agohonestly, there would be so many gaping flaws in a faked pcap. there are a thousand ways to go wrong. it is much harder than forging a document, but will still trust documented evidence in a court. here though, the FBI is basically saying "the document said this, but we don't have it anymore for some reason."
- Patrick_Devine 12y agoThis really reminds me of when Hans Reiser was on trial. I remember a lot of people in the tech community tried explaining away things like him removing the (presumably bloody) seat from his car, washing out the carpet of his car with a hose, buying books on how to commit a murder, and finding Nina's cel phone with the battery popped out in her abandoned car. Each of those things was explained away by the tech community. The seat was taken out and the floor was cleaned with a hose because Hans was broke and wanted to live in the car. He bought the books because he knew he was being followed and was curious about the process. The cel phone battery was popped out because of the real perp had done it, or maybe it was something Nina had done. The point is none of that shit matters. The finer points of TCP are going to be lost on a jury and debating the academic points of packetlogs is fruitless. I've served on a jury before where not even a single other member could parse the most basic of logical statements. Our judicial system is based on story telling; each side tells their story and the person with the best story wins. The feds do this shit all the time, so they're probably going to have a pretty damn good story.
- granfalloon 12y agoI wouldn't trust a jury on this stuff, either, but it's going to be a judge deciding these issues, and they usually at least TRY to get this stuff right (though some are much better at it than others).
- tedivm 12y agoThere's a major difference between this and the Reiser case. As you mentioned, with Reiser people were really practicing wishful thinking in order to save a hero of theirs. In this case people are trying to follow the case because there's a huge and reasonable chance that the FBI did not act above board in following US law. I don't think anyone things DPR is innocent, or that he's going to some how get away with this. However, people are concerned that the methods used to find him were not constitutional. This has more to do with keeping the government in check than it does with anything else.
- Patrick_Devine 12y agoThat's a fair point. I think you articulated better what I was feeling than I had expressed, which is that it felt like wishful thinking on the part of the OP. There does feel like there is hero worship going on with DPR "standing up to the man" though, regardless of whether people feel he's guilty or not. That's particularly so with people who feel services like the Silk Road only came about as a result of the prohibition of narcotics. Regardless though, the unsavoury nature of Ulbricht's actions unfortunately taint the constitutionality issue.
- lolwutf 12y agoMore importantly... weev still uses LiveJournal?!
- ageisp0lis 12y agoweev is right! https://blog.ageispolis.net/speculating-fbi-silk-road-unmasking-technique/ https://blog.ageispolis.net/speculating-fbi-silk-road-unmask...
- Bob1 12y agoOld joke in defense work: Q: What does the government call an illegal wiretap? A: "The anonymous informant". Whoever below pointed out that a jury of 12 morons will NOT be persuaded by some turgid debate over the minutiae of packets is 100% correct. You can always spot someone naive about how the legal system actually works based on just how loftily ideological their narratives and 'theories' are. Nevertheless, this is relevant from a procedure standpoint as if the defense can demonstrate malfeasance on the part of the FBI using computer forensics, they can have certain evidence dismissed.