7 ms·

U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

79 points by cyphunk 12y ago

chatmasta 12y ago
Some researchers at Yale have been working on a project [1], due to be presented this weekend, that disables the FBI from gaining any meaningful information via Javascript exploits. The idea is to contain each "pseudonym" in its own virtual "nymbox", and only that one box. Read the paper for more, it's interesting. [1] http://arxiv.org/pdf/1312.3665.pdf http://arxiv.org/pdf/1312.3665.pdf
- sarciszewski 12y ago
  I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also be a mitigation for drive-by malware exploits and whatnot. (I emailed this to LiberationTech last year, no one took any interest in the idea.)
  - ultramancool 12y ago
    It's an interesting idea, but currently quite impractical as there's no infrastructure for it. The most secure way right now is to isloate your Tor browsing activities to a virtual machine which is only able to access the internet via Tor. Create a VM to act as a middle node with 2 NICs, the first of which will connect to the internet and the second of which will connect to the other VM. Disable any unnecessary services, expose only Tor's proxy to the second NIC. Create the other VM with 1 NIC in the virtual network with the Second NIC on the other VM. This enforces Tor-only access for the second VM. Any activity must go over Tor or it may not access the internet. Snapshot the VMs. Always restore the snapshots when beginning a new session. Setting this up takes some time, but nearly guarantees an exploit cannot escape. I also recommend disabling unnecessary services which may expose the host to attack (ie: file sharing and video and mouse acceleration) through the second VM. It may be more secure to use a low-level emulation (QEmu, VirtualBox or VMWare with hardware acceleration disabled) rather than a hypervisor-based VM solution for this.
    - deleted 12y ago
      [deleted]
    - undefined0 12y ago
      > It's an interesting idea, but currently quite impractical as there's no infrastructure for it. If TOR and Namecoin hooked up, Namecoin could provide a list of page hashes for a given onion address. Better still, interrogate Namecoin's DNS system into TOR and then make Hidden Services accessible via human readable domain names.
    - daveloyall 12y ago
      You mean some people use Tor differently than as you suggest? Why? I had assumed that everyone would be either on the 'net with their 'net computer or on tor with their tor computer. Doing both with one computer obviously defeats the purpose, doesn't it? ...Also, the chances of breaking out of a VM into the host are non-zero. Just sayin'.
  - eli 12y ago
    So you're going to fork the web?
    - sarciszewski 12y ago
      No more than NoScript forks the web.
      - eli 12y ago
        So if I hack a website what's stopping me from serving javascript with no signature or my own signature?
        sarciszewski 12y ago
        Ah, key management, the bane of any asymmetric crypto system! My draft specified TOFU; if a site was previously signed and no signature is attached, don't allow any JS. If the signature doesn't match the key cached in the browser, go full noscript.
        eli 12y ago
        Wouldn't I typically want my Tor Browser to not record any details about sites I have previously visited? Seems like a lot of work for modestly more security.
        sarciszewski 12y ago
        Disclaimer: This was an idea that nobody ever showed interest in and therefore I never put forth the effort to refine and flesh out. Feel free to take it and run with it if you have better ideas.
        onedognight 12y ago
        This was solved for the case of http/https with the "Strict-Transport-Security" header which says that all future communication (for a certain time) will always be over HTTPS. The browser could easily respond to similar "Strict-Signature-Security" header requiring all files to come with a Signature header in the future.
  - teraflop 12y ago
    How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?
    - icebraining 12y ago
      Not OP, but I think there's a big difference. HTTPS protects code in transit, but if you can hack the server, you can change the JS code. This proposal would cover that gap.
      - sarciszewski 12y ago
        That's exactly the issue. This is designed to work in conjunction with HTTPS/Tor such that if the server is compromised, unsigned JS payloads cannot compromise the user.
    - wahern 12y ago
      You could just make it an HTML meta tag which specifies trusted keys. And add an attribute to the script tag which contains the signature. Might need to disable inline JavaScript, though. And double-check that meta tags are only meaningful when located in their proper place in the head tag. I don't like the HTTP header idea, 'cause it precludes static content unless you modify the web server. And I don't like external files which are automatically read by the browser because then you run into namespace problems. Keeping everything in the HTML document provides tidy isolation.
      - sarciszewski 12y ago
        If you're pulling the public key from the document to use it to verify the document, you've already lost.
        wahern 12y ago
        You're using it to verify JavaScript code, not the document. Presuming you also disabled inline JavaScript, you've just shutdown cross-site scripting (XSS) attacks.
  - chatmasta 12y ago
    That's a cool idea, but it comes with a lot of overhead. Javascript files are one of the most heavily-cached on the web, and by signing them with PGP, you cripple your caching ability. Or am I missing something?
    - sarciszewski 12y ago
      The original idea I had was to have an index (think hybrid cache.manifest and Content-Security-Policy header) of relative URLs and their SHA3 hashes, then that file was signed. If anything fails to validate, it doesn't run.
    - Retric 12y ago
      Signing just prevents you from altering the files so you can cache them just fine.
    - martindale 12y ago
      You could also just sign the hash.
  - dobbsbob 12y ago
    None of the vendors have javascript enabled though, how to disable .js was in the vendor guide and all over their forums as a warning.
    - sarciszewski 12y ago
      This isn't just a "fight the man" anti-FBI idea, it's meant to stop the spread of drive-by malware on legitimate sites too. :)
TheCapn 12y ago
At this point I feel I'm missing something as we now have two legal documents going "Nuh uh!" - "Yuh huh!" FBI's Explanation[1] states (Page 4, Footnote #5) that the admin himself kept logs explaining that there were frequent IP leaks due to misconfiguration of the web server. At this point aren't we lead to believe that he showed multiple cases of mismanagement. From this can we not call bullshit on the very definitive declaration by the defense that the webserver was explicitly configured to deny external connections? [1] https://www.scribd.com/doc/238844570/FBI-Explanation-of-Silk-Road-vulnerability
- btouellette 12y ago
  Considering the FBI's explanation didn't make any sense to begin with this isn't that surprising. How were they getting non-Tor traffic out of the server at all? The IP leaks were never a result of Tor misconfiguration but were instead due to things like exploits allowing examination of PHP variables storing internal information. There is no reason to believe the FBI could have gotten the IP of any of the servers by looking at packet headers as they've claimed.
- nobodysfool 12y ago
  Well, that's the thing - they are not providing packet traces even though they were doing a forensic investigation, putting their methodology into doubt. Also, there are no logs indicating that they were successful in what they were trying to do. Even if they were successful, they said that "headers of some of the packets"..." as the source" contained the ip of the server. If it was coming from the TOR network, that would not be the case. Furthermore, since HTTP is a request and response protocol, a request would first have to have been made to the host. A reply would not come without first making the request. That being said, supposedly it was the captcha box. However, that server was only setup to reply to 127.0.0.1 and the backend server. There's no way they would have gotten access to it from the regular web without going through tor, by the methods they describe. You can see the last date the files were modified, and since the "investigator" told what time they accessed the server, we can see that the server was configured not to allow access except through tor. Since he had made a log of ip leaks, I'm pretty sure the guy was on top of security issues, as this is not something he'd overlook.
spectres_ 12y ago
the FBI lied? no way.
- eli 12y ago
  according to the defendant.
  - rhino369 12y ago
    It's very important to realize that declarations are almost always written by an attorney, even if they purport to be written by an expert. This doesn't even purport to be written by an expert. It's literally by the guys defense attorney. They didn't even bother getting an expert to sign off on it. It's very common to have two highly qualified expert declarations saying the exact opposite of each other.
opendais 12y ago
Well, fuck. Regardless of the rest, if the government's story changed in a factual way before vs. after the government acquired the Silk Road server ... well, further confirmation that parallel construction is in use and the "foreign tools" are being used in domestic cases. "the account by former Special Agent Tarbell in his Declaration differs in important respects from the government’s June 12, 2013, letter to Icelandic authorities. For example, that letter (which is Exhibit A to the government’s opposition papers) suggests the possibility of an alternative method for the government’s identifying and locating the Silk Road Server; " + "The Government’s response to Mr. Ulbricht’s omnibus motion filed September 5, 2014, contains a Declaration from former FBI Special Agent Christopher Tarbell, attached hereto as Exhibit 2 (Dkt #57). The Declaration contains a vague explanation of how the IP address of the Silk Road server was initially discovered. For instance, former SA Tarbell asserts that, “[w]hen I typed the Subject IP Address into an ordinary (non-Tor) web browser, a part of the Silk Road login screen (the CAPTCHA prompt) appeared.” Tarbell Decl. at ¶ 8. As explained below, based upon the Nginx server configuration files provided in discovery, that was not possible. "
- cryoshon 12y ago
  Agreed regarding the usage of parallel construction-- I am sure that somewhere in the government's internal guidelines on when to use parallel construction there is a catchall clause providing exemption for "exigent circumstances" which allows it to be abused domestically for any purpose. This case now reeks of heavy NSA involvement merely passed to the FBI for the actual enforcement side of things. I'm not sure if there's actually an angle here, but it would be extremely interesting if the defendants were able to impeach the FBI's evidence to such a degree so as to force an admittance of parallel construction. It's a no brainer that something fishy happened here.
  - btouellette 12y ago
    They'd drop the case before they admitted parallel construction. The old Silk Road is gone and if Ross Ulbricht isn't innocent he won't ever be trying anything like this again knowing that the NSA and the FBI are going to be surveilling him to the best of their ability so they only thing they lose is locking him up in prison.
PeterWhittaker 12y ago
Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show that the then-in-place configuration made it impossible for the FBI agent to do what he claims, that is, connect to the back-end by using the server's IP address (the allow/deny settings forbade this). The log files on the servers lack entries to support FBI claims. Furthermore, FBI agents describe using other techniques to obtain information, e.g., fuzzing and packet sniffing. Not only do server logs NOT contain any evidence of this, but the agents did not preserve any evidence of their packet sniffing activities, despite having training in forensic investigation techniques and claiming expertise in these areas. While it is possible that there were bugs in either the Ubuntu 12.04 hosts or the nginx servers themselves that would have allowed these activities to occur, unlogged, I suspect it would now be up to the prosecution to establish reasonable grounds for believing this to be the case. Likewise, while it is possible that the handful of lines of log pertaining to FBI activities might have been removed from the several million (yes, you read that correctly) lines of log later captured in forensic image, that does strain credulity; again I suspect the prosecution would have to establish that, somehow. I've no particular interest in this case or in Silk Road, but I cannot help but conclude that the lawyer filing this brief just seriously schooled the FBI.
- plorg 12y ago
  > Without identification by the Government, it was impossible to pinpoint the 19 lines in the access logs showing the date and time of law enforcement access to the .49 server. Unless I missed something, this is the only point in the document where the defense suggests that they couldn't find the log lines provided by the FBI. It seems like a weak claim, since they could have said "could not locate" or "could not find", and suggests that there could have been multiple non-.onion or non-frontend accesses to the frontend and backend servers respectively. Surely the expert would know to 'grep -v', and that should make it easy to determine any access that came from other than the prescribed addresses. This suggests that the logs contradict the claims of inaccessibility.
  - cyphunk 12y ago
    The defence will do well leaning more on the incompetence of the prosecution and holding their cards close. In general the system should work where the burden of proof is on the state. What they have done now is show that the configuration of the server as recorded by the FBI makes the access description of the FBI impossible. Yes they could go further to grep -v out localhost and the front-end's IP addr but they can save this to further humiliate the FBI when convenient. Imagine the prosecution now counters with some other detail they forgot to mention but the proof the defence held back humiliates them again. Do this several times and the judge will, rightfully, be disturbed at the state not disclosing the full detail of their case.
deskamess 12y ago
From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.
- btouellette 12y ago
  Since a warrant would otherwise involve violating the rights of the person being investigated you typically need to have some evidence that a crime is being committed. The ends do not justify the means in a court of law.
- freehunter 12y ago
  If the investigation is not performed in a forensically valid way, then there will always be a suspicion of evidence tampering. The law is like that for a reason. You have to prove that you captured the evidence exactly as it was, and not only you, but everyone who touched it made sure of that fact too. If you can't prove that, the evidence could be tampered with. Planting evidence, or even changing the circumstances under which existing evidence is seen can have a major impact on a trial.
- mabbo 12y ago
  Because you can't get a warrant without probable cause. That's why it's illegal for the police to just arbitrarily decide to get a warrant and search your house for drugs because you look like the kind of guy who might have drugs. And the police can't say "Well, we didn't have a warrant, but we were right so who cares" either. If they never had probable cause to get images of this server, what gave them the right to a warrant for it? More importantly, the world needs to know how the heck they did know, so that we all know what the government is capable of. Ulbricht is still an idiot, and it's not surprise he got caught eventually- but we can't let the police bullshit their way into convicting anyone, even idiots.
- AlyssaRowan 12y ago
  If they hacked the servers, they've tainted the evidence.
- 12y ago
btouellette 12y ago
It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic explanation.
- tomp 12y ago
  Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted. EDIT: I guess the biggest problem here is that the people responsible for actually perpetrating the crimes (e.g. the police officers lying in court) will most likely not be held responsible.
  - sp332 12y ago
    https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downturn https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downtur... Also, isn't there a new Silk Road already?
    - btouellette 12y ago
      And a new DPR to go along with it
    - celticninja 12y ago
      There is a new Silk Road and a plethora of successful alternatives. Far from shutting down darknet markets they really just gave them more publicity and now have 20 sites to go after instead of one.
  - deleted 12y ago
    [deleted]
- 12y ago
lorddoig 12y ago
A tarball is not a disk image and - in my view - is seriously shaky as evidence in a criminal trial. I had always imagined - apparently incorrectly - that evidence-gathering requirements in this area would have been more along the lines of imaging the disk bit-for-bit in a controlled, well documented procedure onto another disk which is immediately made read-only in hardware before being placed in the chain of custody. Copies provided in legal proceedings should be verifiably identical. EDIT: Also not only is it insane that they didn't save the sniffed packets but for a one-shot, unreproducible event like the one the FBI describes they really should have preserved the local environment too. Any number of unknown browser/extension/proxy/system behaviours could have caused that captcha to appear on the screen once. Hell, if they only saw it in the viewport and not, say, the DOM source, it could even be a bug in the system graphics renderer - massively unlikely, yes, but I've seen weirder.
- TehCorwiz 12y ago
  That was my concern as well. First thing I learned early on was that when you suspect that a server is compromised, or you you just deleted something super critical, is to dd it to an image and then mount it ro for forensics.
- opendais 12y ago
  All computer evidence is basically Law Enforcement's word that it is real. It is really scary because of how simple planting things are in the context of a tarball or a log file.
barce 12y ago
Section IV.A.18 shows an extremely technically versed lawyer that I hope one day becomes a judge. Joshua Horowitz was able to find a contradiction in the SAs testimony based on nginx's configuration.
wahern 12y ago
I'm not a lawyer, but AFAIU the defense has an affirmative burden to prove impropriety. Simply casting doubt isn't enough. They're unlikely to ever get this evidence suppressed on 4th Amendment grounds, so at best it's a tactical maneuver for negotiating a plea deal. In fact, it's probably not even enough if they prove something as shocking as the NSA helping them. The NSA could always say that they stumbled upon Silk Road in the course of their anti-terrorism operations. And then instructed the FBI to hide the origins of the tip. We know for a fact that this happens regularly, and AFAIK nobody has ever been punished. A court could technically toss the evidence as a way to punish the government for not playing fair, even if the law doesn't require it to be suppressed. That provides leverage for bargaining with the government. But evidence as central as this, in such a high-profile case where the defendant was clearly guilty, means that's unlikely. It's more likely for a smaller case where a court wants to rap the government on the knuckles without letting a really bad guy (from their perspective) go free.
daveloyall 12y ago
This is in response to various comments to the effect of "I can't believe they didn't log, image, etc properly". Every organization is made out of people. Each person grew up somewhere, had interests, went to school, etc before joining the organization. Some organizations attract some types of people more than other types of people. Do you think the FBI attracts the sort of people who stayed home in front of their computers on most Friday nights during the best years of their lives? ... Said differently: you're better at computers than you realize. Shh.
ac29 12y ago
I have limited experience with nginx, but I believe points 12+13 are technically incorrect -- sites/virtual hosts can be configured in the /etc/nginx/conf.d directory or directly in the main nginx.conf file, not only in the sites-available/sites-enabled directories, as is implied. This makes the conclusions of point 19 and others incorrect. I don't think it necessarily disproves the conclusions of the document, but it calls into question if the author knows nginx as well as he claims to. Id be happy to be corrected if I'm wrong.

79 points by cyphunk 12y ago

Some researchers at Yale have been working on a project [1], due to be presented this weekend, that disables the FBI from gaining any meaningful information via Javascript exploits. The idea is to contain each "pseudonym" in its own virtual "nymbox", and only that one box. Read the paper for more, it's interesting. [1] http://arxiv.org/pdf/1312.3665.pdf http://arxiv.org/pdf/1312.3665.pdf

sarciszewski 12y ago
I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also be a mitigation for drive-by malware exploits and whatnot. (I emailed this to LiberationTech last year, no one took any interest in the idea.)
- ultramancool 12y ago
  It's an interesting idea, but currently quite impractical as there's no infrastructure for it. The most secure way right now is to isloate your Tor browsing activities to a virtual machine which is only able to access the internet via Tor. Create a VM to act as a middle node with 2 NICs, the first of which will connect to the internet and the second of which will connect to the other VM. Disable any unnecessary services, expose only Tor's proxy to the second NIC. Create the other VM with 1 NIC in the virtual network with the Second NIC on the other VM. This enforces Tor-only access for the second VM. Any activity must go over Tor or it may not access the internet. Snapshot the VMs. Always restore the snapshots when beginning a new session. Setting this up takes some time, but nearly guarantees an exploit cannot escape. I also recommend disabling unnecessary services which may expose the host to attack (ie: file sharing and video and mouse acceleration) through the second VM. It may be more secure to use a low-level emulation (QEmu, VirtualBox or VMWare with hardware acceleration disabled) rather than a hypervisor-based VM solution for this.
  - deleted 12y ago
    [deleted]
  - undefined0 12y ago
    > It's an interesting idea, but currently quite impractical as there's no infrastructure for it. If TOR and Namecoin hooked up, Namecoin could provide a list of page hashes for a given onion address. Better still, interrogate Namecoin's DNS system into TOR and then make Hidden Services accessible via human readable domain names.
  - daveloyall 12y ago
    You mean some people use Tor differently than as you suggest? Why? I had assumed that everyone would be either on the 'net with their 'net computer or on tor with their tor computer. Doing both with one computer obviously defeats the purpose, doesn't it? ...Also, the chances of breaking out of a VM into the host are non-zero. Just sayin'.
- eli 12y ago
  So you're going to fork the web?
  - sarciszewski 12y ago
    No more than NoScript forks the web.
    - eli 12y ago
      So if I hack a website what's stopping me from serving javascript with no signature or my own signature?
      - sarciszewski 12y ago
        Ah, key management, the bane of any asymmetric crypto system! My draft specified TOFU; if a site was previously signed and no signature is attached, don't allow any JS. If the signature doesn't match the key cached in the browser, go full noscript.
        eli 12y ago
        Wouldn't I typically want my Tor Browser to not record any details about sites I have previously visited? Seems like a lot of work for modestly more security.
        sarciszewski 12y ago
        Disclaimer: This was an idea that nobody ever showed interest in and therefore I never put forth the effort to refine and flesh out. Feel free to take it and run with it if you have better ideas.
      - onedognight 12y ago
        This was solved for the case of http/https with the "Strict-Transport-Security" header which says that all future communication (for a certain time) will always be over HTTPS. The browser could easily respond to similar "Strict-Signature-Security" header requiring all files to come with a Signature header in the future.
- teraflop 12y ago
  How does the browser get the public key in order to verify the signature? And how is this any different from just serving scripts over HTTPS?
  - icebraining 12y ago
    Not OP, but I think there's a big difference. HTTPS protects code in transit, but if you can hack the server, you can change the JS code. This proposal would cover that gap.
    - sarciszewski 12y ago
      That's exactly the issue. This is designed to work in conjunction with HTTPS/Tor such that if the server is compromised, unsigned JS payloads cannot compromise the user.
  - wahern 12y ago
    You could just make it an HTML meta tag which specifies trusted keys. And add an attribute to the script tag which contains the signature. Might need to disable inline JavaScript, though. And double-check that meta tags are only meaningful when located in their proper place in the head tag. I don't like the HTTP header idea, 'cause it precludes static content unless you modify the web server. And I don't like external files which are automatically read by the browser because then you run into namespace problems. Keeping everything in the HTML document provides tidy isolation.
    - sarciszewski 12y ago
      If you're pulling the public key from the document to use it to verify the document, you've already lost.
      - wahern 12y ago
        You're using it to verify JavaScript code, not the document. Presuming you also disabled inline JavaScript, you've just shutdown cross-site scripting (XSS) attacks.
- chatmasta 12y ago
  That's a cool idea, but it comes with a lot of overhead. Javascript files are one of the most heavily-cached on the web, and by signing them with PGP, you cripple your caching ability. Or am I missing something?
  - sarciszewski 12y ago
    The original idea I had was to have an index (think hybrid cache.manifest and Content-Security-Policy header) of relative URLs and their SHA3 hashes, then that file was signed. If anything fails to validate, it doesn't run.
  - Retric 12y ago
    Signing just prevents you from altering the files so you can cache them just fine.
  - martindale 12y ago
    You could also just sign the hash.
- dobbsbob 12y ago
  None of the vendors have javascript enabled though, how to disable .js was in the vendor guide and all over their forums as a warning.
  - sarciszewski 12y ago
    This isn't just a "fight the man" anti-FBI idea, it's meant to stop the spread of drive-by malware on legitimate sites too. :)

TheCapn 12y ago

At this point I feel I'm missing something as we now have two legal documents going "Nuh uh!" - "Yuh huh!" FBI's Explanation[1] states (Page 4, Footnote #5) that the admin himself kept logs explaining that there were frequent IP leaks due to misconfiguration of the web server. At this point aren't we lead to believe that he showed multiple cases of mismanagement. From this can we not call bullshit on the very definitive declaration by the defense that the webserver was explicitly configured to deny external connections? [1] https://www.scribd.com/doc/238844570/FBI-Explanation-of-Silk-Road-vulnerability

btouellette 12y ago
Considering the FBI's explanation didn't make any sense to begin with this isn't that surprising. How were they getting non-Tor traffic out of the server at all? The IP leaks were never a result of Tor misconfiguration but were instead due to things like exploits allowing examination of PHP variables storing internal information. There is no reason to believe the FBI could have gotten the IP of any of the servers by looking at packet headers as they've claimed.
nobodysfool 12y ago
Well, that's the thing - they are not providing packet traces even though they were doing a forensic investigation, putting their methodology into doubt. Also, there are no logs indicating that they were successful in what they were trying to do. Even if they were successful, they said that "headers of some of the packets"..." as the source" contained the ip of the server. If it was coming from the TOR network, that would not be the case. Furthermore, since HTTP is a request and response protocol, a request would first have to have been made to the host. A reply would not come without first making the request. That being said, supposedly it was the captcha box. However, that server was only setup to reply to 127.0.0.1 and the backend server. There's no way they would have gotten access to it from the regular web without going through tor, by the methods they describe. You can see the last date the files were modified, and since the "investigator" told what time they accessed the server, we can see that the server was configured not to allow access except through tor. Since he had made a log of ip leaks, I'm pretty sure the guy was on top of security issues, as this is not something he'd overlook.

spectres_ 12y ago

the FBI lied? no way.

eli 12y ago
according to the defendant.
- rhino369 12y ago
  It's very important to realize that declarations are almost always written by an attorney, even if they purport to be written by an expert. This doesn't even purport to be written by an expert. It's literally by the guys defense attorney. They didn't even bother getting an expert to sign off on it. It's very common to have two highly qualified expert declarations saying the exact opposite of each other.

opendais 12y ago

Well, fuck. Regardless of the rest, if the government's story changed in a factual way before vs. after the government acquired the Silk Road server ... well, further confirmation that parallel construction is in use and the "foreign tools" are being used in domestic cases. "the account by former Special Agent Tarbell in his Declaration differs in important respects from the government’s June 12, 2013, letter to Icelandic authorities. For example, that letter (which is Exhibit A to the government’s opposition papers) suggests the possibility of an alternative method for the government’s identifying and locating the Silk Road Server; " + "The Government’s response to Mr. Ulbricht’s omnibus motion filed September 5, 2014, contains a Declaration from former FBI Special Agent Christopher Tarbell, attached hereto as Exhibit 2 (Dkt #57). The Declaration contains a vague explanation of how the IP address of the Silk Road server was initially discovered. For instance, former SA Tarbell asserts that, “[w]hen I typed the Subject IP Address into an ordinary (non-Tor) web browser, a part of the Silk Road login screen (the CAPTCHA prompt) appeared.” Tarbell Decl. at ¶ 8. As explained below, based upon the Nginx server configuration files provided in discovery, that was not possible. "

cryoshon 12y ago
Agreed regarding the usage of parallel construction-- I am sure that somewhere in the government's internal guidelines on when to use parallel construction there is a catchall clause providing exemption for "exigent circumstances" which allows it to be abused domestically for any purpose. This case now reeks of heavy NSA involvement merely passed to the FBI for the actual enforcement side of things. I'm not sure if there's actually an angle here, but it would be extremely interesting if the defendants were able to impeach the FBI's evidence to such a degree so as to force an admittance of parallel construction. It's a no brainer that something fishy happened here.
- btouellette 12y ago
  They'd drop the case before they admitted parallel construction. The old Silk Road is gone and if Ross Ulbricht isn't innocent he won't ever be trying anything like this again knowing that the NSA and the FBI are going to be surveilling him to the best of their ability so they only thing they lose is locking him up in prison.

PeterWhittaker 12y ago

Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show that the then-in-place configuration made it impossible for the FBI agent to do what he claims, that is, connect to the back-end by using the server's IP address (the allow/deny settings forbade this). The log files on the servers lack entries to support FBI claims. Furthermore, FBI agents describe using other techniques to obtain information, e.g., fuzzing and packet sniffing. Not only do server logs NOT contain any evidence of this, but the agents did not preserve any evidence of their packet sniffing activities, despite having training in forensic investigation techniques and claiming expertise in these areas. While it is possible that there were bugs in either the Ubuntu 12.04 hosts or the nginx servers themselves that would have allowed these activities to occur, unlogged, I suspect it would now be up to the prosecution to establish reasonable grounds for believing this to be the case. Likewise, while it is possible that the handful of lines of log pertaining to FBI activities might have been removed from the several million (yes, you read that correctly) lines of log later captured in forensic image, that does strain credulity; again I suspect the prosecution would have to establish that, somehow. I've no particular interest in this case or in Silk Road, but I cannot help but conclude that the lawyer filing this brief just seriously schooled the FBI.

plorg 12y ago
> Without identification by the Government, it was impossible to pinpoint the 19 lines in the access logs showing the date and time of law enforcement access to the .49 server. Unless I missed something, this is the only point in the document where the defense suggests that they couldn't find the log lines provided by the FBI. It seems like a weak claim, since they could have said "could not locate" or "could not find", and suggests that there could have been multiple non-.onion or non-frontend accesses to the frontend and backend servers respectively. Surely the expert would know to 'grep -v', and that should make it easy to determine any access that came from other than the prescribed addresses. This suggests that the logs contradict the claims of inaccessibility.
- cyphunk 12y ago
  The defence will do well leaning more on the incompetence of the prosecution and holding their cards close. In general the system should work where the burden of proof is on the state. What they have done now is show that the configuration of the server as recorded by the FBI makes the access description of the FBI impossible. Yes they could go further to grep -v out localhost and the front-end's IP addr but they can save this to further humiliate the FBI when convenient. Imagine the prosecution now counters with some other detail they forgot to mention but the proof the defence held back humiliates them again. Do this several times and the judge will, rightfully, be disturbed at the state not disclosing the full detail of their case.

deskamess 12y ago

From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.

btouellette 12y ago
Since a warrant would otherwise involve violating the rights of the person being investigated you typically need to have some evidence that a crime is being committed. The ends do not justify the means in a court of law.
freehunter 12y ago
If the investigation is not performed in a forensically valid way, then there will always be a suspicion of evidence tampering. The law is like that for a reason. You have to prove that you captured the evidence exactly as it was, and not only you, but everyone who touched it made sure of that fact too. If you can't prove that, the evidence could be tampered with. Planting evidence, or even changing the circumstances under which existing evidence is seen can have a major impact on a trial.
mabbo 12y ago
Because you can't get a warrant without probable cause. That's why it's illegal for the police to just arbitrarily decide to get a warrant and search your house for drugs because you look like the kind of guy who might have drugs. And the police can't say "Well, we didn't have a warrant, but we were right so who cares" either. If they never had probable cause to get images of this server, what gave them the right to a warrant for it? More importantly, the world needs to know how the heck they did know, so that we all know what the government is capable of. Ulbricht is still an idiot, and it's not surprise he got caught eventually- but we can't let the police bullshit their way into convicting anyone, even idiots.
AlyssaRowan 12y ago
If they hacked the servers, they've tainted the evidence.
12y ago

btouellette 12y ago

It was pretty obvious that the FBI was lying (or misrepresenting or whatever weasel word you want to use) in their original claims. The real question in my mind, which still remains unanswered, is why? The most optimistic explanation is that they just botched the investigation and then spectacularly confused the prosecution as they were preparing their claims. I'd rather not think too hard about the most pessimistic explanation.

tomp 12y ago
Isn't it obvious? They wanted him gone. This is just like what happened to Kim Dotcom - the US government/elite wanted him gone, so they used whatever methods they wanted, executed by the Law Enforcement, to try and remove him. Sure, they might lose in court now, but most of the damage is done - Megavideo is gone, Silk Road is gone - just what they wanted. EDIT: I guess the biggest problem here is that the people responsible for actually perpetrating the crimes (e.g. the police officers lying in court) will most likely not be held responsible.
- sp332 12y ago
  https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downturn https://en.wikipedia.org/wiki/DeLorean_Motor_Company#Downtur... Also, isn't there a new Silk Road already?
  - btouellette 12y ago
    And a new DPR to go along with it
  - celticninja 12y ago
    There is a new Silk Road and a plethora of successful alternatives. Far from shutting down darknet markets they really just gave them more publicity and now have 20 sites to go after instead of one.
- deleted 12y ago
  [deleted]
12y ago

lorddoig 12y ago

A tarball is not a disk image and - in my view - is seriously shaky as evidence in a criminal trial. I had always imagined - apparently incorrectly - that evidence-gathering requirements in this area would have been more along the lines of imaging the disk bit-for-bit in a controlled, well documented procedure onto another disk which is immediately made read-only in hardware before being placed in the chain of custody. Copies provided in legal proceedings should be verifiably identical. EDIT: Also not only is it insane that they didn't save the sniffed packets but for a one-shot, unreproducible event like the one the FBI describes they really should have preserved the local environment too. Any number of unknown browser/extension/proxy/system behaviours could have caused that captcha to appear on the screen once. Hell, if they only saw it in the viewport and not, say, the DOM source, it could even be a bug in the system graphics renderer - massively unlikely, yes, but I've seen weirder.

TehCorwiz 12y ago
That was my concern as well. First thing I learned early on was that when you suspect that a server is compromised, or you you just deleted something super critical, is to dd it to an image and then mount it ro for forensics.
opendais 12y ago
All computer evidence is basically Law Enforcement's word that it is real. It is really scary because of how simple planting things are in the context of a tarball or a log file.

barce 12y ago

Section IV.A.18 shows an extremely technically versed lawyer that I hope one day becomes a judge. Joshua Horowitz was able to find a contradiction in the SAs testimony based on nginx's configuration.

wahern 12y ago

I'm not a lawyer, but AFAIU the defense has an affirmative burden to prove impropriety. Simply casting doubt isn't enough. They're unlikely to ever get this evidence suppressed on 4th Amendment grounds, so at best it's a tactical maneuver for negotiating a plea deal. In fact, it's probably not even enough if they prove something as shocking as the NSA helping them. The NSA could always say that they stumbled upon Silk Road in the course of their anti-terrorism operations. And then instructed the FBI to hide the origins of the tip. We know for a fact that this happens regularly, and AFAIK nobody has ever been punished. A court could technically toss the evidence as a way to punish the government for not playing fair, even if the law doesn't require it to be suppressed. That provides leverage for bargaining with the government. But evidence as central as this, in such a high-profile case where the defendant was clearly guilty, means that's unlikely. It's more likely for a smaller case where a court wants to rap the government on the knuckles without letting a really bad guy (from their perspective) go free.

daveloyall 12y ago

This is in response to various comments to the effect of "I can't believe they didn't log, image, etc properly". Every organization is made out of people. Each person grew up somewhere, had interests, went to school, etc before joining the organization. Some organizations attract some types of people more than other types of people. Do you think the FBI attracts the sort of people who stayed home in front of their computers on most Friday nights during the best years of their lives? ... Said differently: you're better at computers than you realize. Shh.

ac29 12y ago

I have limited experience with nginx, but I believe points 12+13 are technically incorrect -- sites/virtual hosts can be configured in the /etc/nginx/conf.d directory or directly in the main nginx.conf file, not only in the sites-available/sites-enabled directories, as is implied. This makes the conclusions of point 19 and others incorrect. I don't think it necessarily disproves the conclusions of the document, but it calls into question if the author knows nginx as well as he claims to. Id be happy to be corrected if I'm wrong.