3 ms·

Can someone who knows things about things address this item in the errattasec article: > BTW: one plausible way of having discovered the server is to scan the

by CPLX 12y ago

Can someone who knows things about things address this item in the errattasec article: > BTW: one plausible way of having discovered the server is to scan the entire Internet for SSL certificates, then correlate information in those certificates with the information found going across the Tor onion connection. Would this be considered parallel construction, or would this be a legitimate way to attempt to figure out who was involved in the Silk Road, and is it plausibly the way the FBI might have zeroed in on the server?

frontline 12y ago
parallel construction is retroactively finding an alternate, legal/unclassified explanation for an evidence trail, but one which is inherently incorrect; if the ssl cert scanning or other repeatable method was the route taken, nsa probably wouldn't want to tip their hand. it's probably worth noting that the only examples of parallel construction that we have confirmation of were drug cases
- CPLX 12y ago
  Yes I know what it is, but what I'm curious about is would that tactic fit the definition. Scanning IP addresses for publicly served SSL certs and comparing them with one served over TOR isn't obviously an unwarranted search is it?
  - sp332 12y ago
    If the original TOR cert was discovered in an unlawful search, and then they did a scan of the public internet to find it again in a legal search, that's parallel construction.
    - AlyssaRowan 12y ago
      And let's not forget: NSA already have an almost-irresistibly useful database designed for exactly this purpose (selecting and correlating on attributes of SIGINT-captured SSL/TLS sessions, such as certificates - and they could easily just put a selector on the CommonName or the certificate fingerprint). You don't have to be the NSA to make a database like that, but it helps. I could build a database broadly like that for certificates/ciphersuites/other metadata myself with active scanning and zmap (and it might make a good weekend project, to examine and contrast RC4 proliferation amongst TLS-encrypted web and mail servers) - but they have a near-realtime-updating passively-constructed one. If the FBI asked them for help, they'd definitely use that.

by CPLX 12y ago

frontline 12y ago

parallel construction is retroactively finding an alternate, legal/unclassified explanation for an evidence trail, but one which is inherently incorrect; if the ssl cert scanning or other repeatable method was the route taken, nsa probably wouldn't want to tip their hand. it's probably worth noting that the only examples of parallel construction that we have confirmation of were drug cases

CPLX 12y ago
Yes I know what it is, but what I'm curious about is would that tactic fit the definition. Scanning IP addresses for publicly served SSL certs and comparing them with one served over TOR isn't obviously an unwarranted search is it?
- sp332 12y ago
  If the original TOR cert was discovered in an unlawful search, and then they did a scan of the public internet to find it again in a legal search, that's parallel construction.
  - AlyssaRowan 12y ago
    And let's not forget: NSA already have an almost-irresistibly useful database designed for exactly this purpose (selecting and correlating on attributes of SIGINT-captured SSL/TLS sessions, such as certificates - and they could easily just put a selector on the CommonName or the certificate fingerprint). You don't have to be the NSA to make a database like that, but it helps. I could build a database broadly like that for certificates/ciphersuites/other metadata myself with active scanning and zmap (and it might make a good weekend project, to examine and contrast RC4 proliferation amongst TLS-encrypted web and mail servers) - but they have a near-realtime-updating passively-constructed one. If the FBI asked them for help, they'd definitely use that.