13 ms·

Reading the Silk Road configuration

247 points by philip1209 12y ago

peteretep 12y ago
I don't know how the US legal system works - but is there any chance of the DPR actually walking away a free man if the FBI are lying?
- bruceb 12y ago
  Maybe. Though I don't know what other evidence they have. It might allow him to plead to lesser charges. Long but give an overview of this point: http://legal-dictionary.thefreedictionary.com/Fruit+of+a+poisonous+tree http://legal-dictionary.thefreedictionary.com/Fruit+of+a+poi...
- downandout 12y ago
  It would be a big step forward. The government would be unable to use anything that it obtained from the server in their prosecution. This may make it impossible to prove that he ran Silk Road. I think he has several other charges though, including multiple counts of solicitation to commit murder. Those may well involve evidence from outside the server that would be unaffected by this. Given this, the odds of DPR ever seeing the light of day, even if they win this suppression motion, are quite small. He is looking at multiple life sentences even without Silk Road specific charges. But his lawyers are going through piece by piece, hoping to convince prosecutors that it will be difficult enough to get convictions that they offer him a substantial, but less than life, prison sentence in exchange for a plea. Even then we're talking about decades in prison.
  - icebraining 12y ago
    I think he has several other charges though, including multiple counts of solicitation to commit murder. Nope, most were dropped before the indictment. Only one (in Maryland) remains: http://freeross.org/correction-of-our-report-on-the-indictment/ http://freeross.org/correction-of-our-report-on-the-indictme...
    - downandout 12y ago
      Still, one is probably enough for a decades-long or life sentence.
  - higherpurpose 12y ago
    This could also be a HUGE step for all anti-parallel construction cases out there. Not only will it embolden other lawyers to look for details in their cases that might point to parallel construction, therefore leading to more such discoveries, but the government should also freak out that their parallel-constructed cases (I assume they have at least hundreds we don't know about, possibly thousands) would get invalidated, and might actually stop getting information this way.
    - mindslight 12y ago
      > the government ... might actually stop getting information this [parallel construction] way lololol. They'll just smooth the practice over with some new laws which, like every other blatantly unconstitutional law currently in effect, won't be overturned by the courts because doing so would upset the status quo. The only way it'll ever stop is when the fuckers are finally bankrupt, both economically and socially.
- kapnobatairza 12y ago
  There is a very very very slim chance.... I wrote a bit about this last year when he was first arrested. http://msansnom.tumblr.com/post/63069733245/fruit-of-the-poisonous-tree http://msansnom.tumblr.com/post/63069733245/fruit-of-the-poi...
- NoMoreNicksLeft 12y ago
  No. It's federal, they seriously don't like him, he's never walking. At some point a judge will come up with a bullshit ruling that covers the feds' collective ass, and he'll die in a cage.
- logn 12y ago
  All evidence from the server, and anything obtained subsequently because of the server evidence, would be inadmissible (i.e., it could not be presented to the jury). The burden is on the prosecution to prove DPR guilty beyond a reasonable doubt, and so their job gets a lot harder. Probably before it gets to trial, the prosecution could be sufficiently concerned about their ability to convict that they let DPR plead guilty to some lesser charge.
BuildTheRobots 12y ago
Am I being extremely thick here? The evidence submitted by the FBI [1] shows the phpmyadmin page running on address 192.168.1.24. Are they claiming to have connected over the internet to a public facing RFC1918 address and it was routable? (Saying that, I'm now realising that I could knock up a similar screenshot showing me connecting to any "real-world" IP address anyway; it seems to prove nothing. [1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-8.pdf http://krebsonsecurity.com/wp-content/uploads/2014/10/70-8.p...
- pyre 12y ago
  Interesting that they are: 1) using IceWeasel and 2) searching the login page for "downloads."
  - skolor 12y ago
    Looks to me like they're just using Kali. Not that surprising, for someone doing that type of work.
- samcrawford 12y ago
  Just a guess, but I imagine that's a clone of the original server (using the server image they took) running on a local network.
  - BuildTheRobots 12y ago
    It's no longer a clone if they've made config changes... o_0
- skolor 12y ago
  The way I read that was that the phpmyadmin screenshot was not supplied by the FBI, rather it came from Krebs for the purpose of demonstration.
  - andrewjkerr 12y ago
    I don't think it came from Krebs. The pdf is labeled like the rest of the evidence submitted.
iaw 12y ago
I wish they'd have made the FBI's story a little more believable. I mean, it seems slightly more legitimate than what you see on TV and movies about hacking.
- junto 12y ago
  I have a feeling that they don't actually care. They know that judges and juries can't handle these kinds of technical details.
  - AlyssaRowan 12y ago
    That's what experts are for. I don't do forensics. But I am a reverse-engineer and I am familiar with the techniques: more familiar than Tarbell, it seems. (That's really his name? Tarballs from Tarbell? My goodness.) Tarbell's declaration reads to me more like a textbook demonstration of (bad) parallel construction in action. They could have done it legitimately, without compromising the server and potentially tainting the evidence any way they wanted: DPR indeed made a few rookie mistakes that would potentially provide for that. But the logs don't seem to actually have evidence supporting that, which is very unusual and at this time not explained? The declarations filed so far do not really seem to support that either, which is very odd and strongly suggests that we don't have the whole picture here: and we really should. (Of course, we don't have the whole image, so we don't have the whole picture here. BTW: They used tar, not dd or ddfldd? Boo.)
- nerdy 12y ago
  So, I had to indulge myself... http://www.collegehumor.com/video/6905757/the-worst-hacking-scenes-in-movies http://www.collegehumor.com/video/6905757/the-worst-hacking-... ...I've got to be honest, a few of those are better than the FBI story!
  - nerdy 12y ago
    Ouch on the downvotes, it's called sarcasm guys!
plumeria 12y ago
How much time would it take to browse all public IP addresses?
- adamnemecek 12y ago
  Depends on your definition of 'browse'. But possibly 45 minutes https://zmap.io https://zmap.io.
  - philip1209 12y ago
    This is strictly for IPv4 addresses
  - huuu 12y ago
    Note that in one of his talks Morgan Marquis-Boire said he had to change IP some times because he was blocked generating too much traffic while scanning. But he managed to map a lot of secret Trojan servers used by govs.
- chronid 12y ago
  Someone recently did this and posted screenshots of what was available on the public internet (including a control system for a water turbine, IIRC).
  - MrJagil 12y ago
    You have a link?
    - Shish2k 12y ago
      If you scroll down past all the photos of chilli peppers, this guy was posting interesting things he found during the VNC scan: https://twitter.com/viss/media https://twitter.com/viss/media (Would be nice if there was a gallery, as infinite scrolling uses a ton of browser memory, but I'm not aware of one...)
    - chronid 12y ago
dolzenko 12y ago
Fun, failing to count how many times he said "I am an expert", I assume thats the basic tactic to survival in security consultant space but still.
- wrboyce 12y ago
  I would say you assume incorrectly, and this guy is just a tool.
- rjaco31 12y ago
  Yeah, that pretty much undermined his speech..
- forgotAgain 12y ago
  I thought he pressed that point a little as well but assuming his lack of writing skills disqualifies his security opinion is a bit of a far jump to me.
- tvanantwerp 12y ago
  The original charges against Ulbricht, as well as his defense attorney's responses, both include this kind of "I am an expert" language. This is most likely a convention of legal writing, not technical writing.
  - dolzenko 12y ago
    Not quite, Silk Road document is using very neutral and "objective" kind of speech, c.f. "Based on my training and experience, Silk Road has emerged as the most sophisticated and extensive criminal marketplace on the Internet today." [0] [0] http://computersweden.idg.se/polopoly_fs/1.526338.1380735946!172773407-ulbricht-criminal-complaint-silk-road.pdf http://computersweden.idg.se/polopoly_fs/1.526338.1380735946...
- meowface 12y ago
  This is actually a legal convention, not arrogance. Look at criminal complaints for other computer crimes (child pornography, hacking, etc.) and the language is identical.
comex 12y ago
Talk about burying the lede! Even though he starts off by saying the data confirms the "parallel construction" theory, he proceeds to poke a hole in the defense's claim - that someone wouldn't have been able to access the login page (I am too tired to determine whether or not he's correct about this), and then proposes a possible mechanism (scanning the entire Internet for pages containing a term) which, although it would technically constitute "parallel construction" in that it wasn't mentioned by the prosecution, need not have anything to do with the NSA and could have been done (with enough time) by anyone. If he's right that the quoted configuration file doesn't do what the defense said it did as part of their accusations of lying, they've seriously messed up, no matter what the truth is.
thomaslutz 12y ago
"myphpadmin"? "200 error code"? "As an expert[...]" ... no comment.
wrboyce 12y ago
Why not link the original Krebs article? http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/ http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...
- dang 12y ago
  Ok, we changed to that from http://blog.erratasec.com/2014/10/reading-silk-road-configuration.html http://blog.erratasec.com/2014/10/reading-silk-road-configur..., which points to it.
  - cyphunk 12y ago
    oh HN, the articles are completely different with one general and the other technically detailed.
  - deleted 12y ago
    [deleted]
  - dchest 12y ago
    Please, change it back. These are completely different articles, and most of comments here are about the first one.
    - colinbartlett 12y ago
      Seriously how is this constructive? We let people up vote and comment on an article and then swap it out to something else leaving all the comments and up votes? HackerNews, you frustrate me.
    - tim333 12y ago
      Also the new one is not accessible due to server overload.
    - dang 12y ago
      Ok, done.
snowy 12y ago
I am a foremost Internet expert on this sort of thing..........As an expert in such topics as sniffing passwords.........As an expert, I know the Tarbell declaration is gibberish. As an expert reading the configuration and logs........ HA!
- Luc 12y ago
  It is somewhat comical, but he's not lying. At least he's not hiding the fact that he's arguing from authority (his own).
  - jessaustin 12y ago
    Arguments from authority might be a bad thing on internet fora where everyone is assumed to have infinite time (and ability) to dig into details. In society as a whole, and especially in the courts, however, these arguments are a useful short-cut.
  - chc 12y ago
    There is nothing inherently wrong with making judgments based on one's expertise. That's pretty much what expertise is good for.
- snowy 12y ago
  I was quoting from the original article http://blog.erratasec.com/2014/10/reading-silk-road-configuration.html#.VC5yZR_0-kB http://blog.erratasec.com/2014/10/reading-silk-road-configur... Which has since been changed to http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/ http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...
- dthunt 12y ago
  It may help to rewrite those in your head to, "as an experienced systems administrator who knows how these particular config files work" or perhaps "how config files work in general". These are all questions of basic fact and they are all easily testable. What do courts do when this situation comes up? Do they play warring experts, when (at least) one side definitely wants to perform a test, because they are confident that their interpretation is correct? (ed: 'questions of basic fact' like, whether a server with this configuration is hittable from non-allowed IPs)
nisa 12y ago
So - how to do it correctly? The onion server should not be able to access the internet directly and should never know it's own IP-address. So putting it inside a virtual machine/container and redirecting outgoing traffic through Tor (on another VM) should fix that. As for the backend servers - if all machines are connected through OpenVPN with TLS-Auth they can use private IP space and are not accessible from outside. The OpenVPN tunnels are configured outside of the onion VM and Tor VM and the backend machines are also in a VM that pipes all outgoing traffic (except OpenVPN traffic) to the internet through Tor. This setup should at least omit the problem of leaking public IP addresses on compromise or did I overlook something? Let's ignore VM outbreak exploits (ksplice/unattenend-upgrades should help here if it's not the NSA). With TLS-Auth and a default DROP firewall rule all machines should not even appear in scans on the internet. So any outside contact to any machines is only possible if you know the OpenVPN TLS-Key + Certificates. An intruder would only see local IP addresses even if he manages to compromise a backend server. All created outgoing traffic to find the machines would be routed through Tor. As the Tor onion VM is separate from the webserver only a Tor remote exploit or a VM outbreak exploit would be critical. Maybe encryption can help here. Another point is using dedicated hardware with Full Disk Encryption and just enter the passphrase via the provider console. There are cold boot attacks but VPS servers allow to dump a memory image while running - that's not so easy with dedicated hardware.
- waps 12y ago
  Just making a tiny point here : advising criminals on how to avoid law enforcement is obviously illegal and carries prison sentences. Please don't do it. If you must, start an unrelated article or something. But don't explicitly try to help other criminals avoid capture. Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations. This is not the FBI enforcing the letter of some stupid law, this is not some teenager getting in over his head, this guy needs to be punished.
  - bruceb 12y ago
    Explaining how something works is not illegal in the US. Not sure why you think it is. Most people don't feel sorry for the guy but we don't want the country to turn in to a lawless place where law enforcement doesn't have to follow the law.
denzil_correa 12y ago
Is it time to have special judges/jury who understand the technical details of such cases? I can't seem to even think as to how a judge/jury with no technical expertise would understand the fine print of the details being given out by the lawyers.
- Yardlink 12y ago
  I think expert witnesses serve that purpose. There have been complicated technical details in jury trials before the internet and this seems to be an adequate way to solve the problem.
  - spacemanmatt 12y ago
    The problem with expert witnesses is that the skill required to tell which expert is more credible is the same skill that each expert claims to represent best. And then you have the outright liars who have made their careers being expert liars in court, like Dr. Michael West, who are not backed up by the medical community, but by prosecutors.
- rayiner 12y ago
  It's interesting to parallel to medical cases. Ordinarily, a jury uses their own judgment to decide if someone was negligent measured against ordinary standards of care. But in a medical malpractice case, they decide instead whether someone failed to adhere to accepted medical practice. That gives the medical community a lot of power, because they get to set the standard of practice, and testimony about a specific doctor's actions is always filtered through a medical expert witness. To date, engineers have not been given similar consideration, probably because they're not independent and their employers would force them to abuse the privilege. E.g. automotive engineers would say "oh, it's totally acceptable to have that exploding gas tank" and software engineers would say "oh, it's totally okay for that to lose all your data." Barring special consideration like that, it comes down to the expert witnesses. The jury will decide based on which expert they find more credible / whose lawyers do the best job of presenting their expert.
deleted 12y ago
[deleted]
pbhjpbhj 12y ago
Isn't it contempt of court to bear false witness; don't people caught doing that get charged and put in prison? So, which person was in the witness stand and will USA prove to be a democratic nation under the rule-of-law and charge them?
- spacemanmatt 12y ago
  The government (executive) lies to other branches of the government (judiciary) with impunity. Once in a while, a judge will get angry about it, but prosecutors and expert witnesses issue whopping lies into the official record every day.
  - pbhjpbhj 12y ago
    Aren't USA judges voted in? Why do the people vote for judges that will sit quiet whilst someone provably lies in court? We found them by simple looking at the IP that the packets of the captcha were served from. The captcha was served over tor, based on the evidence that's impossible. Either you lied or you need to add further evidence. If you can't/won't add further evidence then as the court sees it you lied and are in contempt and will be punished in line with minimum sentencing?? This is of the order of a "he robbed me at home at exactly 2pm", "your submitted cell-phone evidence says you were at work from 1pm until 4pm". If the defendant is convicted on some other counts can they, or anyone else, do anything or is the allowance of officers of the FBI to lie in open court somehow embedded in the USA constitution. As a foreigner to the USA this sort of thing just undermines the entire foreign policy rhetoric of bringing democracy to the world. Bring some damned democracy to the USA first: government by the people for the people, my arse.
    - kd0amg 12y ago
      Why do the people vote for judges that will sit quiet whilst someone provably lies in court? Most voters don't have information about such incidents or enough time to crawl through court records looking for that information. Actually, in judicial elections, most voters don't even have anyone else to vote for.
    - 12y ago
tuxidomasx 12y ago
The FBI owes me 1 bitcoin.
samcrawford 12y ago
> The second problem is that some of the details are impossible, such as seeing the IP address in the "packet headers". If the frontend server in Germany is reverse proxying through to the backend server in Iceland, then sure, a user is not going to see the Icelandic server's IP in the source IP field of the packets. But I don't see this as definitive proof of the FBI's assertion being a flat out lie. The IP could easily have been exposed in the packet body. What happens if you visited the captcha URL with a HTTP/1.0 request without Host header? If the resulting URL generated any self-referential links, what did they use as the hostname? If the Host header is available the norm is to use this, but if not then the script may use the server's FQDN or IP address. If it sent a 301/302 redirect in the HTTP response headers, then that _must_ contain a hostname according to the RFC (it shouldn't be relative), so what was used there? There's nothing in the nginx config that rewrote such response headers. What happens if you make malformed requests to the captcha URL? Do you get an error page with the IP address embedded, or something that references an object hosted on the IP? These are just two possibilities, and yes, neither would lead to the IP being exposed in the 'packet headers'. But it's very feasible for it to be exposed in the packet body, so it seems silly to hang the entire argument on the basis that one word is correct, without considering the alternatives.
- forgotAgain 12y ago
  In both the cases you site would there be a trail of those requests in the server log files? If so they could have been (or will be) pointed to by the prosecution. Since the prosecution has an image of the server they should be able to demonstrate the point if needed. If they can't then I think it casts doubt on their story.
  - samcrawford 12y ago
    You'll see the requests in nginx's access logs, but it might be very hard to isolate them. These would not show the response data (only the length and the response code). But you're right, I'd expect that whatever tactic they used, the prosecution should be able to demonstrate in far more depth how the IP leaked.
  - 12y ago
jackgavigan 12y ago
There are some jigsaw pieces missing here. If the nginx configuration for port 443 did indeed not restrict access to [star].php, then that means that index.php would have been accessible to the Internet at large (although HTML elements with other suffixes - e.g. .jpg, .css, .js - would not have been served). If the CAPTCHA element's URL also ended in .php, then it's not beyond the realms of possibility that Tarbell could type the IP address, followed by /index.php and end up seeing a screwed-up version of the SR home page, with the CAPTCHA as he describes in his testimony. The log file entries cited are for port 80, whereas the SR webserver ran on port 443. If the defence already have all the log files, they should grep for 199.170.71.133 in the 443 logs and/or search for a group of log file entries with simultaneous successful serves of anything ending in .php, with "permission denied" failures for things not ending in .php Incidentally, the May 3, 2013 webserver IP leak referred to in footnote 5 to Tarbell's testimony syncs up nicely with the date of this thread on Reddit: https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_be_worried_showing_on_login_page/ https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_... Credit to Michael Koziarski for the Reddit link: http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/comment-page-1/#comment-296697 http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...
NoMoreNicksLeft 12y ago
I thought it was a foregone conclusion that the NSA uses its massive surveillance network to do traffic analysis on all entrance and exit nodes. What we're seeing here is called "parallel construction". The FBI was given this illegally obtained surveillance data, made the arrest, and then needed to make up a lie as to how they really found him.
thornofmight 12y ago
I know for a fact that there was a source disclosure MySQL injection bug on many of the pages in SR. There was also other MySQL Injection bugs. You could even look through the SR forum archive and find people talking about how the search field at one point was exploitable by the standard "' or 'a'='a" and was disclosing customer's names and addresses.
us0r 12y ago
The Iceland/Reykjavik bits are pretty interesting[1]. I wonder if they just said here you go? It sure seems like it. [1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-4.pdf http://krebsonsecurity.com/wp-content/uploads/2014/10/70-4.p...
Evolved 12y ago
This may have something to do with discovering the real IP. https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_be_worried_showing_on_login_page/ https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_...
CPLX 12y ago
Can someone who knows things about things address this item in the errattasec article: > BTW: one plausible way of having discovered the server is to scan the entire Internet for SSL certificates, then correlate information in those certificates with the information found going across the Tor onion connection. Would this be considered parallel construction, or would this be a legitimate way to attempt to figure out who was involved in the Silk Road, and is it plausibly the way the FBI might have zeroed in on the server?
- frontline 12y ago
  parallel construction is retroactively finding an alternate, legal/unclassified explanation for an evidence trail, but one which is inherently incorrect; if the ssl cert scanning or other repeatable method was the route taken, nsa probably wouldn't want to tip their hand. it's probably worth noting that the only examples of parallel construction that we have confirmation of were drug cases
  - CPLX 12y ago
    Yes I know what it is, but what I'm curious about is would that tactic fit the definition. Scanning IP addresses for publicly served SSL certs and comparing them with one served over TOR isn't obviously an unwarranted search is it?
    - sp332 12y ago
      If the original TOR cert was discovered in an unlawful search, and then they did a scan of the public internet to find it again in a legal search, that's parallel construction.
      - AlyssaRowan 12y ago
        And let's not forget: NSA already have an almost-irresistibly useful database designed for exactly this purpose (selecting and correlating on attributes of SIGINT-captured SSL/TLS sessions, such as certificates - and they could easily just put a selector on the CommonName or the certificate fingerprint). You don't have to be the NSA to make a database like that, but it helps. I could build a database broadly like that for certificates/ciphersuites/other metadata myself with active scanning and zmap (and it might make a good weekend project, to examine and contrast RC4 proliferation amongst TLS-encrypted web and mail servers) - but they have a near-realtime-updating passively-constructed one. If the FBI asked them for help, they'd definitely use that.
kerkeslager 12y ago
It's hard enough to explain this kind of stuff to one intelligent businessperson--there's just so much background knowledge that goes into understanding this. Explaining this to 12 jurors, half of whom will likely be of below average intelligence, is a pretty much impossible task. Sadly I think this case will be won on the charisma of the lawyers rather than facts which will go over most jurors' heads.

247 points by philip1209 12y ago

I don't know how the US legal system works - but is there any chance of the DPR actually walking away a free man if the FBI are lying?

bruceb 12y ago
Maybe. Though I don't know what other evidence they have. It might allow him to plead to lesser charges. Long but give an overview of this point: http://legal-dictionary.thefreedictionary.com/Fruit+of+a+poisonous+tree http://legal-dictionary.thefreedictionary.com/Fruit+of+a+poi...
downandout 12y ago
It would be a big step forward. The government would be unable to use anything that it obtained from the server in their prosecution. This may make it impossible to prove that he ran Silk Road. I think he has several other charges though, including multiple counts of solicitation to commit murder. Those may well involve evidence from outside the server that would be unaffected by this. Given this, the odds of DPR ever seeing the light of day, even if they win this suppression motion, are quite small. He is looking at multiple life sentences even without Silk Road specific charges. But his lawyers are going through piece by piece, hoping to convince prosecutors that it will be difficult enough to get convictions that they offer him a substantial, but less than life, prison sentence in exchange for a plea. Even then we're talking about decades in prison.
- icebraining 12y ago
  I think he has several other charges though, including multiple counts of solicitation to commit murder. Nope, most were dropped before the indictment. Only one (in Maryland) remains: http://freeross.org/correction-of-our-report-on-the-indictment/ http://freeross.org/correction-of-our-report-on-the-indictme...
  - downandout 12y ago
    Still, one is probably enough for a decades-long or life sentence.
- higherpurpose 12y ago
  This could also be a HUGE step for all anti-parallel construction cases out there. Not only will it embolden other lawyers to look for details in their cases that might point to parallel construction, therefore leading to more such discoveries, but the government should also freak out that their parallel-constructed cases (I assume they have at least hundreds we don't know about, possibly thousands) would get invalidated, and might actually stop getting information this way.
  - mindslight 12y ago
    > the government ... might actually stop getting information this [parallel construction] way lololol. They'll just smooth the practice over with some new laws which, like every other blatantly unconstitutional law currently in effect, won't be overturned by the courts because doing so would upset the status quo. The only way it'll ever stop is when the fuckers are finally bankrupt, both economically and socially.
kapnobatairza 12y ago
There is a very very very slim chance.... I wrote a bit about this last year when he was first arrested. http://msansnom.tumblr.com/post/63069733245/fruit-of-the-poisonous-tree http://msansnom.tumblr.com/post/63069733245/fruit-of-the-poi...
NoMoreNicksLeft 12y ago
No. It's federal, they seriously don't like him, he's never walking. At some point a judge will come up with a bullshit ruling that covers the feds' collective ass, and he'll die in a cage.
logn 12y ago
All evidence from the server, and anything obtained subsequently because of the server evidence, would be inadmissible (i.e., it could not be presented to the jury). The burden is on the prosecution to prove DPR guilty beyond a reasonable doubt, and so their job gets a lot harder. Probably before it gets to trial, the prosecution could be sufficiently concerned about their ability to convict that they let DPR plead guilty to some lesser charge.

BuildTheRobots 12y ago

Am I being extremely thick here? The evidence submitted by the FBI [1] shows the phpmyadmin page running on address 192.168.1.24. Are they claiming to have connected over the internet to a public facing RFC1918 address and it was routable? (Saying that, I'm now realising that I could knock up a similar screenshot showing me connecting to any "real-world" IP address anyway; it seems to prove nothing. [1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-8.pdf http://krebsonsecurity.com/wp-content/uploads/2014/10/70-8.p...

pyre 12y ago
Interesting that they are: 1) using IceWeasel and 2) searching the login page for "downloads."
- skolor 12y ago
  Looks to me like they're just using Kali. Not that surprising, for someone doing that type of work.
samcrawford 12y ago
Just a guess, but I imagine that's a clone of the original server (using the server image they took) running on a local network.
- BuildTheRobots 12y ago
  It's no longer a clone if they've made config changes... o_0
skolor 12y ago
The way I read that was that the phpmyadmin screenshot was not supplied by the FBI, rather it came from Krebs for the purpose of demonstration.
- andrewjkerr 12y ago
  I don't think it came from Krebs. The pdf is labeled like the rest of the evidence submitted.

iaw 12y ago

I wish they'd have made the FBI's story a little more believable. I mean, it seems slightly more legitimate than what you see on TV and movies about hacking.

junto 12y ago
I have a feeling that they don't actually care. They know that judges and juries can't handle these kinds of technical details.
- AlyssaRowan 12y ago
  That's what experts are for. I don't do forensics. But I am a reverse-engineer and I am familiar with the techniques: more familiar than Tarbell, it seems. (That's really his name? Tarballs from Tarbell? My goodness.) Tarbell's declaration reads to me more like a textbook demonstration of (bad) parallel construction in action. They could have done it legitimately, without compromising the server and potentially tainting the evidence any way they wanted: DPR indeed made a few rookie mistakes that would potentially provide for that. But the logs don't seem to actually have evidence supporting that, which is very unusual and at this time not explained? The declarations filed so far do not really seem to support that either, which is very odd and strongly suggests that we don't have the whole picture here: and we really should. (Of course, we don't have the whole image, so we don't have the whole picture here. BTW: They used tar, not dd or ddfldd? Boo.)
nerdy 12y ago
So, I had to indulge myself... http://www.collegehumor.com/video/6905757/the-worst-hacking-scenes-in-movies http://www.collegehumor.com/video/6905757/the-worst-hacking-... ...I've got to be honest, a few of those are better than the FBI story!
- nerdy 12y ago
  Ouch on the downvotes, it's called sarcasm guys!

plumeria 12y ago

How much time would it take to browse all public IP addresses?

adamnemecek 12y ago
Depends on your definition of 'browse'. But possibly 45 minutes https://zmap.io https://zmap.io.
- philip1209 12y ago
  This is strictly for IPv4 addresses
- huuu 12y ago
  Note that in one of his talks Morgan Marquis-Boire said he had to change IP some times because he was blocked generating too much traffic while scanning. But he managed to map a lot of secret Trojan servers used by govs.
chronid 12y ago
Someone recently did this and posted screenshots of what was available on the public internet (including a control system for a water turbine, IIRC).
- MrJagil 12y ago
  You have a link?
  - Shish2k 12y ago
    If you scroll down past all the photos of chilli peppers, this guy was posting interesting things he found during the VNC scan: https://twitter.com/viss/media https://twitter.com/viss/media (Would be nice if there was a gallery, as infinite scrolling uses a ton of browser memory, but I'm not aware of one...)
  - chronid 12y ago

dolzenko 12y ago

Fun, failing to count how many times he said "I am an expert", I assume thats the basic tactic to survival in security consultant space but still.

wrboyce 12y ago
I would say you assume incorrectly, and this guy is just a tool.
rjaco31 12y ago
Yeah, that pretty much undermined his speech..
forgotAgain 12y ago
I thought he pressed that point a little as well but assuming his lack of writing skills disqualifies his security opinion is a bit of a far jump to me.
tvanantwerp 12y ago
The original charges against Ulbricht, as well as his defense attorney's responses, both include this kind of "I am an expert" language. This is most likely a convention of legal writing, not technical writing.
- dolzenko 12y ago
  Not quite, Silk Road document is using very neutral and "objective" kind of speech, c.f. "Based on my training and experience, Silk Road has emerged as the most sophisticated and extensive criminal marketplace on the Internet today." [0] [0] http://computersweden.idg.se/polopoly_fs/1.526338.1380735946!172773407-ulbricht-criminal-complaint-silk-road.pdf http://computersweden.idg.se/polopoly_fs/1.526338.1380735946...
meowface 12y ago
This is actually a legal convention, not arrogance. Look at criminal complaints for other computer crimes (child pornography, hacking, etc.) and the language is identical.

comex 12y ago

Talk about burying the lede! Even though he starts off by saying the data confirms the "parallel construction" theory, he proceeds to poke a hole in the defense's claim - that someone wouldn't have been able to access the login page (I am too tired to determine whether or not he's correct about this), and then proposes a possible mechanism (scanning the entire Internet for pages containing a term) which, although it would technically constitute "parallel construction" in that it wasn't mentioned by the prosecution, need not have anything to do with the NSA and could have been done (with enough time) by anyone. If he's right that the quoted configuration file doesn't do what the defense said it did as part of their accusations of lying, they've seriously messed up, no matter what the truth is.

thomaslutz 12y ago

"myphpadmin"? "200 error code"? "As an expert[...]" ... no comment.

wrboyce 12y ago

Why not link the original Krebs article? http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/ http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...

dang 12y ago
Ok, we changed to that from http://blog.erratasec.com/2014/10/reading-silk-road-configuration.html http://blog.erratasec.com/2014/10/reading-silk-road-configur..., which points to it.
- cyphunk 12y ago
  oh HN, the articles are completely different with one general and the other technically detailed.
- deleted 12y ago
  [deleted]
- dchest 12y ago
  Please, change it back. These are completely different articles, and most of comments here are about the first one.
  - colinbartlett 12y ago
    Seriously how is this constructive? We let people up vote and comment on an article and then swap it out to something else leaving all the comments and up votes? HackerNews, you frustrate me.
  - tim333 12y ago
    Also the new one is not accessible due to server overload.
  - dang 12y ago
    Ok, done.

snowy 12y ago

I am a foremost Internet expert on this sort of thing..........As an expert in such topics as sniffing passwords.........As an expert, I know the Tarbell declaration is gibberish. As an expert reading the configuration and logs........ HA!

Luc 12y ago
It is somewhat comical, but he's not lying. At least he's not hiding the fact that he's arguing from authority (his own).
- jessaustin 12y ago
  Arguments from authority might be a bad thing on internet fora where everyone is assumed to have infinite time (and ability) to dig into details. In society as a whole, and especially in the courts, however, these arguments are a useful short-cut.
- chc 12y ago
  There is nothing inherently wrong with making judgments based on one's expertise. That's pretty much what expertise is good for.
snowy 12y ago
I was quoting from the original article http://blog.erratasec.com/2014/10/reading-silk-road-configuration.html#.VC5yZR_0-kB http://blog.erratasec.com/2014/10/reading-silk-road-configur... Which has since been changed to http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/ http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...
dthunt 12y ago
It may help to rewrite those in your head to, "as an experienced systems administrator who knows how these particular config files work" or perhaps "how config files work in general". These are all questions of basic fact and they are all easily testable. What do courts do when this situation comes up? Do they play warring experts, when (at least) one side definitely wants to perform a test, because they are confident that their interpretation is correct? (ed: 'questions of basic fact' like, whether a server with this configuration is hittable from non-allowed IPs)

nisa 12y ago

So - how to do it correctly? The onion server should not be able to access the internet directly and should never know it's own IP-address. So putting it inside a virtual machine/container and redirecting outgoing traffic through Tor (on another VM) should fix that. As for the backend servers - if all machines are connected through OpenVPN with TLS-Auth they can use private IP space and are not accessible from outside. The OpenVPN tunnels are configured outside of the onion VM and Tor VM and the backend machines are also in a VM that pipes all outgoing traffic (except OpenVPN traffic) to the internet through Tor. This setup should at least omit the problem of leaking public IP addresses on compromise or did I overlook something? Let's ignore VM outbreak exploits (ksplice/unattenend-upgrades should help here if it's not the NSA). With TLS-Auth and a default DROP firewall rule all machines should not even appear in scans on the internet. So any outside contact to any machines is only possible if you know the OpenVPN TLS-Key + Certificates. An intruder would only see local IP addresses even if he manages to compromise a backend server. All created outgoing traffic to find the machines would be routed through Tor. As the Tor onion VM is separate from the webserver only a Tor remote exploit or a VM outbreak exploit would be critical. Maybe encryption can help here. Another point is using dedicated hardware with Full Disk Encryption and just enter the passphrase via the provider console. There are cold boot attacks but VPS servers allow to dump a memory image while running - that's not so easy with dedicated hardware.

waps 12y ago
Just making a tiny point here : advising criminals on how to avoid law enforcement is obviously illegal and carries prison sentences. Please don't do it. If you must, start an unrelated article or something. But don't explicitly try to help other criminals avoid capture. Frankly it is also immoral. This guy was selling drugs without caring about the consequences on people's lives, medical and otherwise and was organizing assassinations. This is not the FBI enforcing the letter of some stupid law, this is not some teenager getting in over his head, this guy needs to be punished.
- bruceb 12y ago
  Explaining how something works is not illegal in the US. Not sure why you think it is. Most people don't feel sorry for the guy but we don't want the country to turn in to a lawless place where law enforcement doesn't have to follow the law.

denzil_correa 12y ago

Is it time to have special judges/jury who understand the technical details of such cases? I can't seem to even think as to how a judge/jury with no technical expertise would understand the fine print of the details being given out by the lawyers.

Yardlink 12y ago
I think expert witnesses serve that purpose. There have been complicated technical details in jury trials before the internet and this seems to be an adequate way to solve the problem.
- spacemanmatt 12y ago
  The problem with expert witnesses is that the skill required to tell which expert is more credible is the same skill that each expert claims to represent best. And then you have the outright liars who have made their careers being expert liars in court, like Dr. Michael West, who are not backed up by the medical community, but by prosecutors.
rayiner 12y ago
It's interesting to parallel to medical cases. Ordinarily, a jury uses their own judgment to decide if someone was negligent measured against ordinary standards of care. But in a medical malpractice case, they decide instead whether someone failed to adhere to accepted medical practice. That gives the medical community a lot of power, because they get to set the standard of practice, and testimony about a specific doctor's actions is always filtered through a medical expert witness. To date, engineers have not been given similar consideration, probably because they're not independent and their employers would force them to abuse the privilege. E.g. automotive engineers would say "oh, it's totally acceptable to have that exploding gas tank" and software engineers would say "oh, it's totally okay for that to lose all your data." Barring special consideration like that, it comes down to the expert witnesses. The jury will decide based on which expert they find more credible / whose lawyers do the best job of presenting their expert.

deleted 12y ago

[deleted]

pbhjpbhj 12y ago

Isn't it contempt of court to bear false witness; don't people caught doing that get charged and put in prison? So, which person was in the witness stand and will USA prove to be a democratic nation under the rule-of-law and charge them?

spacemanmatt 12y ago
The government (executive) lies to other branches of the government (judiciary) with impunity. Once in a while, a judge will get angry about it, but prosecutors and expert witnesses issue whopping lies into the official record every day.
- pbhjpbhj 12y ago
  Aren't USA judges voted in? Why do the people vote for judges that will sit quiet whilst someone provably lies in court? We found them by simple looking at the IP that the packets of the captcha were served from. The captcha was served over tor, based on the evidence that's impossible. Either you lied or you need to add further evidence. If you can't/won't add further evidence then as the court sees it you lied and are in contempt and will be punished in line with minimum sentencing?? This is of the order of a "he robbed me at home at exactly 2pm", "your submitted cell-phone evidence says you were at work from 1pm until 4pm". If the defendant is convicted on some other counts can they, or anyone else, do anything or is the allowance of officers of the FBI to lie in open court somehow embedded in the USA constitution. As a foreigner to the USA this sort of thing just undermines the entire foreign policy rhetoric of bringing democracy to the world. Bring some damned democracy to the USA first: government by the people for the people, my arse.
  - kd0amg 12y ago
    Why do the people vote for judges that will sit quiet whilst someone provably lies in court? Most voters don't have information about such incidents or enough time to crawl through court records looking for that information. Actually, in judicial elections, most voters don't even have anyone else to vote for.
  - 12y ago

tuxidomasx 12y ago

The FBI owes me 1 bitcoin.

samcrawford 12y ago

> The second problem is that some of the details are impossible, such as seeing the IP address in the "packet headers". If the frontend server in Germany is reverse proxying through to the backend server in Iceland, then sure, a user is not going to see the Icelandic server's IP in the source IP field of the packets. But I don't see this as definitive proof of the FBI's assertion being a flat out lie. The IP could easily have been exposed in the packet body. What happens if you visited the captcha URL with a HTTP/1.0 request without Host header? If the resulting URL generated any self-referential links, what did they use as the hostname? If the Host header is available the norm is to use this, but if not then the script may use the server's FQDN or IP address. If it sent a 301/302 redirect in the HTTP response headers, then that _must_ contain a hostname according to the RFC (it shouldn't be relative), so what was used there? There's nothing in the nginx config that rewrote such response headers. What happens if you make malformed requests to the captcha URL? Do you get an error page with the IP address embedded, or something that references an object hosted on the IP? These are just two possibilities, and yes, neither would lead to the IP being exposed in the 'packet headers'. But it's very feasible for it to be exposed in the packet body, so it seems silly to hang the entire argument on the basis that one word is correct, without considering the alternatives.

forgotAgain 12y ago
In both the cases you site would there be a trail of those requests in the server log files? If so they could have been (or will be) pointed to by the prosecution. Since the prosecution has an image of the server they should be able to demonstrate the point if needed. If they can't then I think it casts doubt on their story.
- samcrawford 12y ago
  You'll see the requests in nginx's access logs, but it might be very hard to isolate them. These would not show the response data (only the length and the response code). But you're right, I'd expect that whatever tactic they used, the prosecution should be able to demonstrate in far more depth how the IP leaked.
- 12y ago

jackgavigan 12y ago

There are some jigsaw pieces missing here. If the nginx configuration for port 443 did indeed not restrict access to [star].php, then that means that index.php would have been accessible to the Internet at large (although HTML elements with other suffixes - e.g. .jpg, .css, .js - would not have been served). If the CAPTCHA element's URL also ended in .php, then it's not beyond the realms of possibility that Tarbell could type the IP address, followed by /index.php and end up seeing a screwed-up version of the SR home page, with the CAPTCHA as he describes in his testimony. The log file entries cited are for port 80, whereas the SR webserver ran on port 443. If the defence already have all the log files, they should grep for 199.170.71.133 in the 443 logs and/or search for a group of log file entries with simultaneous successful serves of anything ending in .php, with "permission denied" failures for things not ending in .php Incidentally, the May 3, 2013 webserver IP leak referred to in footnote 5 to Tarbell's testimony syncs up nicely with the date of this thread on Reddit: https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_be_worried_showing_on_login_page/ https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_... Credit to Michael Koziarski for the Reddit link: http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/comment-page-1/#comment-296697 http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...

NoMoreNicksLeft 12y ago

I thought it was a foregone conclusion that the NSA uses its massive surveillance network to do traffic analysis on all entrance and exit nodes. What we're seeing here is called "parallel construction". The FBI was given this illegally obtained surveillance data, made the arrest, and then needed to make up a lie as to how they really found him.

thornofmight 12y ago

I know for a fact that there was a source disclosure MySQL injection bug on many of the pages in SR. There was also other MySQL Injection bugs. You could even look through the SR forum archive and find people talking about how the search field at one point was exploitable by the standard "' or 'a'='a" and was disclosing customer's names and addresses.

us0r 12y ago

The Iceland/Reykjavik bits are pretty interesting[1]. I wonder if they just said here you go? It sure seems like it. [1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-4.pdf http://krebsonsecurity.com/wp-content/uploads/2014/10/70-4.p...

Evolved 12y ago

This may have something to do with discovering the real IP. https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_be_worried_showing_on_login_page/ https://www.reddit.com/r/SilkRoad/comments/1dmznd/should_we_...

CPLX 12y ago

Can someone who knows things about things address this item in the errattasec article: > BTW: one plausible way of having discovered the server is to scan the entire Internet for SSL certificates, then correlate information in those certificates with the information found going across the Tor onion connection. Would this be considered parallel construction, or would this be a legitimate way to attempt to figure out who was involved in the Silk Road, and is it plausibly the way the FBI might have zeroed in on the server?

frontline 12y ago
parallel construction is retroactively finding an alternate, legal/unclassified explanation for an evidence trail, but one which is inherently incorrect; if the ssl cert scanning or other repeatable method was the route taken, nsa probably wouldn't want to tip their hand. it's probably worth noting that the only examples of parallel construction that we have confirmation of were drug cases
- CPLX 12y ago
  Yes I know what it is, but what I'm curious about is would that tactic fit the definition. Scanning IP addresses for publicly served SSL certs and comparing them with one served over TOR isn't obviously an unwarranted search is it?
  - sp332 12y ago
    If the original TOR cert was discovered in an unlawful search, and then they did a scan of the public internet to find it again in a legal search, that's parallel construction.
    - AlyssaRowan 12y ago
      And let's not forget: NSA already have an almost-irresistibly useful database designed for exactly this purpose (selecting and correlating on attributes of SIGINT-captured SSL/TLS sessions, such as certificates - and they could easily just put a selector on the CommonName or the certificate fingerprint). You don't have to be the NSA to make a database like that, but it helps. I could build a database broadly like that for certificates/ciphersuites/other metadata myself with active scanning and zmap (and it might make a good weekend project, to examine and contrast RC4 proliferation amongst TLS-encrypted web and mail servers) - but they have a near-realtime-updating passively-constructed one. If the FBI asked them for help, they'd definitely use that.

kerkeslager 12y ago

It's hard enough to explain this kind of stuff to one intelligent businessperson--there's just so much background knowledge that goes into understanding this. Explaining this to 12 jurors, half of whom will likely be of below average intelligence, is a pretty much impossible task. Sadly I think this case will be won on the charisma of the lawyers rather than facts which will go over most jurors' heads.