10 ms·

There are some interesting theories being tossed around. I'd like to add one more. The common thread across all darknet websites is the fact that they general

There are some interesting theories being tossed around. I'd like to add one more. The common thread across all darknet websites is the fact that they generally run from datacenters. Most people don't host websites from their residence. Further, most people don't colocate servers anymore. I would be surprised if any of the 414 websites operated on boxes that had been colocated. However I won't rule out that colocating is also compromised. I'd like to posit the following law of nature: You can't run a darknet website from a datacenter and think you've hidden the location of the server, regardless of whether it's using Tor or other anonymity software. Why not? Because the datacenter has the ability to image servers, along with the ability to notice that you're generating large amounts of outgoing Tor traffic (or other anonymity software). Here's how the attack may have happened: Step one, collect data about which computers are sending and receiving large amounts of Tor bandwidth. Step two, if the server resides in a datacenter, request an image of the server. Step three, you now know whether the server is a darknet website. Remember, the point of Tor is to hide the final IP address of a web request or web service. It does not hide the total volume of traffic that must be delivered. And it can't. If you operate a darknet marketplace, you're probably serving a large volume of traffic. Guess who notices? ISPs and datacenters. Guess which datacenters can be trusted not to divulge an image of your server to authorities? None of them. What do I think the future of darknet opsec will look like? Well, if you're reading this, and you're an individual or group interested in pursuing your ideology through a darknet website, you will need to run your website from a datacenter and not rent your server in your name. In fact, your opsec needs to be so good that there's no way to trace the account back to you. This sounds hard, and it is, but it's possible. Secondly, you must assume at all times that the server you're using is compromised. Assume that aurhorities can access the contents of the server, can manipulate it, and can subvert anything you put on it. This is a grim situation, to be sure. The above assumption is that you are never safe from authorities gaining a copy of the contents of your datacenter-hosted darknet website (including any databases), and from a takedown of the service whenever authorities deem to do so. Here's the ray of hope: Just because they takedown your website doesn't mean they take you down. This is where opsec comes into play, and it's our last hope. Every other link in the chain of trust for darknet websites has been broken. The one and only chance is that you can figure out a way to create accounts at datacenters without authorities being able to trace them back to you. Authorities takedown your service? Okay, start it again at some other datacenter. Authorities get a copy of what's on your server? Okay, no problem: you were assuming it was compromised anyway, right? Authorities install a program to make your software malfunction? That's unfortunate, and will shake the trust in your website, but it's possible to recover from this. Do your best, and do not get caught. The rest follows from this. At a minimum, you need to research opsec. Read history of how groups have evaded detection. Do your research using Tor, because associating such Google searches with your home account is a terrible mistake. One of your biggest problems is going to be anonymous money. No, bitcoin won't help you. You can't rent a server from a datacenter using bitcoin. But you can anonymize your money and then use that money to rent your server. It's a long shot, but it's all we've got left. Be perfect. There's no room for error. Or realize the truth: If you can't be perfect, you will get caught. And you may get caught anyway. Being perfect sounds impossible, but human history has shown that there are situations in which no or few mistakes are made. I would recommend you research those situations and how to minimize the total number of mistakes you make. Use software to help you do this, while realizing that clever software alone won't be enough. For example, if you're configuring an individual piece of software on your personal computer to connect to your darknet website, even through Tor, you're doing it wrong. You need to isolate yourself from this equation at all times. Sound hard? Oh, it's hard. It will slowly dawn on you how hard this method of operating is. Convenience? No. You don't get to enjoy the benefits of convenience. Convenience is the opposite of security. Oh, and if you do happen to somehow make a lot of money, you should keep it as bitcoin for the forseeable future. What good is it? Maybe converting small amounts won't be noticed. On the other hand, converting large amounts of bitcoin to dollars will be noticed, and it's extraordinarily dangerous to your opsec. I'll be around to answer questions if you have them. If you'd like to ask a question anonymously using Tor, create a new HN account and post your question. I'll see it, but it will show up as dead on HN, so I won't be able to reply to it directly. So I'll reply to my own comment with a copy of your question, along with a response. Then you can reply to that, and I'll repeat the process. HN is one of the few websites that we can even have these kinds of conversations on using Tor. Everything on Reddit is autokilled. 4chan doesn't let you use Tor. Maybe we should work on this problem first: How to make the equivalent of unlisted Tor exit nodes so that Tor isn't so trivially blocked? There are a lot of ideas in my comment, and some of them are better than others. I hope that the bad ideas can be discarded and the good ones refined until we have someting workable.

emidln 12y ago
Requesting an image of a paranoid person's server isn't necessarily that great. When I worked for a run-of-the-mill cybersecurity firm, our simulator products were protected with full disk encryption using run-of-the-mill open-source software + light patches and keys bound to specific hardware, software, and configuration states via the TPM. This is for fully automated boot up. If you can accept the risk of needing to be physically close to a machine, you can generate random bytes and store those into your TPM and require both the hardware/software/configuration to be correct as well as knowing your key. This would incidentally also prevent you from being able to give law enforcement the key to an image of your computer (this is actually impossible, you don't know the key). If you're doing this under a warrant, you could just request that the server's operator unlock the machine. Whether you comply is a legal situation that varies from jurisdiction to jurisdiction (in the US, it seems that you might be held indefinitely in jail if you refuse to divulge your key). The thing is, you should be able to make an extremely strong case (possibly with the EFF's help) that any warrant is false. Anonymous traffic itself should not be enough to compel you to divulge your secrets without other evidence pointing to your machines (standard IANAL, but this seems consistent from everything I've read).
- devconsole 12y ago
  It's an interesting idea. I think physically shipping a server to a datacenter is precarious. Remember, it is known that your server is hosting a darknet website. You can't really hide this fact. Timing correlations make it possible to figure out which server is doing what. The reason that Tor users are generally safe from this is because they're not constantly connected, and an adversary generally can't cause a client to issue a web request on demand. But a webservice is constantly connected, and any adversary can cause it to issue responses since it's a webservice. Whether it's a timing correlation from a global passive adversary, or it's simply noticing that "silk road is extremely popular and this webserver in this datacenter seems to be hosting a huge amount of Tor traffic," you have to assume that it's known that the location of your server is compromised. And if you assume that, then it suddenly becomes very, very bad if you've personally shipped a computer to the datacenter, colocation-style. First, clever hardware won't protect you if it's a running box. But beyond that, you can be traced simply by the components that you've assembled. You have to order those components from somewhere. You have to assume the worst: that authorities will take your box using a power adapter that lets them physically remove the computer from the datacenter without turning it off (such things exist), dump an image of your server while it's running (so that encryption keys won't help you), and then dismantle your server and trace the origin of the components. Congratulations: you're caught. I think the model of "rent a bunch of servers using opsec" is also precarious, but less precarious than relying on hardware protections to save you.

emidln 12y ago

Requesting an image of a paranoid person's server isn't necessarily that great. When I worked for a run-of-the-mill cybersecurity firm, our simulator products were protected with full disk encryption using run-of-the-mill open-source software + light patches and keys bound to specific hardware, software, and configuration states via the TPM. This is for fully automated boot up. If you can accept the risk of needing to be physically close to a machine, you can generate random bytes and store those into your TPM and require both the hardware/software/configuration to be correct as well as knowing your key. This would incidentally also prevent you from being able to give law enforcement the key to an image of your computer (this is actually impossible, you don't know the key). If you're doing this under a warrant, you could just request that the server's operator unlock the machine. Whether you comply is a legal situation that varies from jurisdiction to jurisdiction (in the US, it seems that you might be held indefinitely in jail if you refuse to divulge your key). The thing is, you should be able to make an extremely strong case (possibly with the EFF's help) that any warrant is false. Anonymous traffic itself should not be enough to compel you to divulge your secrets without other evidence pointing to your machines (standard IANAL, but this seems consistent from everything I've read).

devconsole 12y ago
It's an interesting idea. I think physically shipping a server to a datacenter is precarious. Remember, it is known that your server is hosting a darknet website. You can't really hide this fact. Timing correlations make it possible to figure out which server is doing what. The reason that Tor users are generally safe from this is because they're not constantly connected, and an adversary generally can't cause a client to issue a web request on demand. But a webservice is constantly connected, and any adversary can cause it to issue responses since it's a webservice. Whether it's a timing correlation from a global passive adversary, or it's simply noticing that "silk road is extremely popular and this webserver in this datacenter seems to be hosting a huge amount of Tor traffic," you have to assume that it's known that the location of your server is compromised. And if you assume that, then it suddenly becomes very, very bad if you've personally shipped a computer to the datacenter, colocation-style. First, clever hardware won't protect you if it's a running box. But beyond that, you can be traced simply by the components that you've assembled. You have to order those components from somewhere. You have to assume the worst: that authorities will take your box using a power adapter that lets them physically remove the computer from the datacenter without turning it off (such things exist), dump an image of your server while it's running (so that encryption keys won't help you), and then dismantle your server and trace the origin of the components. Congratulations: you're caught. I think the model of "rent a bunch of servers using opsec" is also precarious, but less precarious than relying on hardware protections to save you.