3 ms·

Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show th

Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show that the then-in-place configuration made it impossible for the FBI agent to do what he claims, that is, connect to the back-end by using the server's IP address (the allow/deny settings forbade this). The log files on the servers lack entries to support FBI claims. Furthermore, FBI agents describe using other techniques to obtain information, e.g., fuzzing and packet sniffing. Not only do server logs NOT contain any evidence of this, but the agents did not preserve any evidence of their packet sniffing activities, despite having training in forensic investigation techniques and claiming expertise in these areas. While it is possible that there were bugs in either the Ubuntu 12.04 hosts or the nginx servers themselves that would have allowed these activities to occur, unlogged, I suspect it would now be up to the prosecution to establish reasonable grounds for believing this to be the case. Likewise, while it is possible that the handful of lines of log pertaining to FBI activities might have been removed from the several million (yes, you read that correctly) lines of log later captured in forensic image, that does strain credulity; again I suspect the prosecution would have to establish that, somehow. I've no particular interest in this case or in Silk Road, but I cannot help but conclude that the lawyer filing this brief just seriously schooled the FBI.

plorg 12y ago
> Without identification by the Government, it was impossible to pinpoint the 19 lines in the access logs showing the date and time of law enforcement access to the .49 server. Unless I missed something, this is the only point in the document where the defense suggests that they couldn't find the log lines provided by the FBI. It seems like a weak claim, since they could have said "could not locate" or "could not find", and suggests that there could have been multiple non-.onion or non-frontend accesses to the frontend and backend servers respectively. Surely the expert would know to 'grep -v', and that should make it easy to determine any access that came from other than the prescribed addresses. This suggests that the logs contradict the claims of inaccessibility.
- cyphunk 12y ago
  The defence will do well leaning more on the incompetence of the prosecution and holding their cards close. In general the system should work where the burden of proof is on the state. What they have done now is show that the configuration of the server as recorded by the FBI makes the access description of the FBI impossible. Yes they could go further to grep -v out localhost and the front-end's IP addr but they can save this to further humiliate the FBI when convenient. Imagine the prosecution now counters with some other detail they forgot to mention but the proof the defence held back humiliates them again. Do this several times and the judge will, rightfully, be disturbed at the state not disclosing the full detail of their case.
300bps 12y ago
...with the implication being that the U.S. Government discovered the identity of the operator of Silk Road through means that would either not be admissible in court or that would anger the public. They then engaged in acts of "parallel construction" to contrive lawful means that they discovered his identity using the foreknowledge of who he was via unlawful means. http://freeross.org/ulbricht-defense-calls-for-evidentiary-hearing-re-server/ http://freeross.org/ulbricht-defense-calls-for-evidentiary-h...
fru2013 12y ago
The nginx conf for the .49 server[1] has a bug. The location entries are exclusive[2]. [1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-6.pdf http://krebsonsecurity.com/wp-content/uploads/2014/10/70-6.p... [2] http://nginx.org/en/docs/http/request_processing.html#simple_php_site_configuration http://nginx.org/en/docs/http/request_processing.html#simple...

plorg 12y ago

> Without identification by the Government, it was impossible to pinpoint the 19 lines in the access logs showing the date and time of law enforcement access to the .49 server. Unless I missed something, this is the only point in the document where the defense suggests that they couldn't find the log lines provided by the FBI. It seems like a weak claim, since they could have said "could not locate" or "could not find", and suggests that there could have been multiple non-.onion or non-frontend accesses to the frontend and backend servers respectively. Surely the expert would know to 'grep -v', and that should make it easy to determine any access that came from other than the prescribed addresses. This suggests that the logs contradict the claims of inaccessibility.

cyphunk 12y ago
The defence will do well leaning more on the incompetence of the prosecution and holding their cards close. In general the system should work where the burden of proof is on the state. What they have done now is show that the configuration of the server as recorded by the FBI makes the access description of the FBI impossible. Yes they could go further to grep -v out localhost and the front-end's IP addr but they can save this to further humiliate the FBI when convenient. Imagine the prosecution now counters with some other detail they forgot to mention but the proof the defence held back humiliates them again. Do this several times and the judge will, rightfully, be disturbed at the state not disclosing the full detail of their case.

300bps 12y ago

...with the implication being that the U.S. Government discovered the identity of the operator of Silk Road through means that would either not be admissible in court or that would anger the public. They then engaged in acts of "parallel construction" to contrive lawful means that they discovered his identity using the foreknowledge of who he was via unlawful means. http://freeross.org/ulbricht-defense-calls-for-evidentiary-hearing-re-server/ http://freeross.org/ulbricht-defense-calls-for-evidentiary-h...

fru2013 12y ago

The nginx conf for the .49 server[1] has a bug. The location entries are exclusive[2]. [1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-6.pdf http://krebsonsecurity.com/wp-content/uploads/2014/10/70-6.p... [2] http://nginx.org/en/docs/http/request_processing.html#simple_php_site_configuration http://nginx.org/en/docs/http/request_processing.html#simple...