6 ms·

Large Number of Tor Sites Seized by the FBI were Clone or Scam Sites

99 points by nikcub 12y ago

Privatoria 12y ago
It is a well-known fact that Tor is controlled by FBI. That's why for trully anonymous surf you should use VPN or Proxy services which are working on their own servers, not Tor
- middleclick 12y ago
  > It is a well-known fact that Tor is controlled by FBI. Citation please.
  - Privatoria 12y ago
    certainly Tor is a great service. Dut due to it's popularity it is very inetersting for FBI. So they are making an effort to deanonymize service.For example, http://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-law-enforcement-break-tor/ http://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-l...
    - simoncion 12y ago
      Honestly, it would run counter to the FBI's interest to not divulge flaws that invalidate the anonymity guarantees that tor provides. Tor was originally developed to mask the identity of USian spooks performing intelligence operations and will continue to be used in that role for the foreseeable future. [0] Like any FBI spokesman would say, things that make it harder for law enforcement to engage in surreptitious observation of targets endanger us all.[1] [0] https://news.ycombinator.com/item?id=8610532 https://news.ycombinator.com/item?id=8610532 [1] NB: I neither agree with nor endorse this claim that is all-too-often made.
    - Karunamon 12y ago
      due to it's popularity it is very inetersting for FBI. So they are making an effort to deanonymize service. Is a completely separate and much weaker claim than: It is a well-known fact that Tor is controlled by FBI No kidding they're trying to deanonymize it. The NSA is no doubt working on breaking GPG, that hardly means they own it!
- 13 12y ago
  Why do you trust any VPN provider? You're paying to push all of your information through a dubious looking service and just hoping that they don't tamper with your pipe. I trust my ISP (who actively poison my DNS lookups) more than I would any of these sort of services. It seems like an ideal sort of business to have more than just your direct income flowing in.
- spacefight 12y ago
  As if you can trust your VPN provider, let alone his upstream providers.
- dewey 12y ago
  I guess the services advertised in your profile come highly recommended then?
- eksith 12y ago
  Privatoria.net is a service which provides secure communication, anonymous surf and secure file sharing for individuals and business. All security services are united together in Privatoria. It includes Secure VPN and Anonymous Proxy, that enable surf anonymously, change IP, unblock sites, Anonymous E-mail, Secure Chat, Secure Call, Secure Video Chat for secure communications and Secure file sharing via FTP and Secure Data Storage. No conflict of interest there at all in your badmouthing of Tor, with no corroborating evidence at all to boot.
kissickas 12y ago
This is quite interesting. It's initially unclear exactly what the angle of this research is, but I think that reflects the uncertainty that still surrounds this operation. Most notable to me was that the jihad-funding site was left up while its clone was taken down. Does that mean they couldn't locate the server, or that it's controlled by the FBI?
- userbinator 12y ago
  Most notable to me was that the jihad-funding site was left up while its clone was taken down. Does that mean they couldn't locate the server, or that it's controlled by the FBI? I was wondering the same thing - and this line from the article too: In a number of cases the FBI has seized the clone or scam version of a site while leaving up the real site. Is it because all the clone/scam sites were hosted on the same set of servers, or do the FBI know where the real ones are already but are deliberately leaving it up (and just removing the fakes since they're presumably interfering with their surveillance)?
yc1010 12y ago
"The slapshot nature of how sites were seized suggests that rather than starting with an onion address and then discovering the host server to seize, this campaign simply vacuumed up a large number of onion websites by targeting specific hosting companies. We have tracked down the hosting companies affected and the details will be published in a follow-up." Very interested to see the list of hosting companies that were targeted.
- nikcub 12y ago
  It is the reason why we're asking for administrators of sites that were seized or those at hosting companies to come forward. Have already spoken to a number of people and got a full list of the hosts involved, but we need a secondary confirmation, or details we can make public, on some of sites and hosts. Looking at what the seized sites had in common, in terms of host, configuration, etc. narrows down the methods that might have been used to uncover the hidden sites and provides a clearer picture of what went on.
- cesarb 12y ago
  The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar? Hosting a hidden service by itself does not mean doing something illegal, even Facebook hosts a hidden service nowadays. The only valid justification for the seizure would be if they had traced an illegal hidden service to that host, but from what I have read this seizure sounds too indiscriminate for that to be the case (IIRC even some pure relays, which don't host anything at all, were seized).
  - forgottenpass 12y ago
    The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar? That would require the defendant's rights to have been violated. I'm no doctor of law, but even if they were slipshod enough to violate rights in investigation regarding the datacenters, I'd be surprised if the defendants rights were the ones violated (3rd party doctrine and all).
TempleOS 12y ago
God is perfectly just. You must be severely persecuted to be severely blessed. Joseph in the Old Testament did 7 years for false rape. That's how he earned ruler status in Egypt for interpretation skills. These cops are troglodytes, subhumans, badly in need of interpreter skills. Highs and lows balance. You must suffer to be blessed.
monort 12y ago
Tor TLS traffic can be distinguished by random domain in SNI during handshake (https://news.ycombinator.com/item?id=5505056 https://news.ycombinator.com/item?id=5505056). If FBI can sniff all traffic originating from hosting provider, then it seems to be trivial to detect all Tor servers and go through them manually?
- userbinator 12y ago
  SNI is an extension, it's not required and makes for the traffic to be easily distinguishable, so what's the reason for Tor to send an SNI?
  - monort 12y ago
    Probably it will be even easier to detect Tor nodes - just look for IPs which never receive SNI in TLS exchange on 443 port.
    - userbinator 12y ago
      Thinking over the protocol again I think TLS wasn't a great choice for Tor - not only because of SNI but other things like server certificates are also sent in cleartext during the handshake so it's easy to distinguish and just block all TLS traffic that uses self-signed or otherwise certificates not issued by the big CAs. Something more like SSH, not relying on central CAs, would be less distinguishable - is it Tor traffic, or is it just someone accessing his/her server remotelly.
      - conductor 12y ago
        I would suggest impersonating other encrypted protocols with heavy traffic like encrypted BitTorrent or P2P Skype (is it still P2P or MS centralized it already?). On the other hand, systems administrators are frequently blocking BitTorrent and Skype traffic so the "TLS" traffic on port 443 has more chances to pass.
  - cesarb 12y ago
MisterNegative 12y ago
Well this is to be expected if they can force a hosting company to report when servers connect to public tor nodes for a considerable amount of traffic.

99 points by nikcub 12y ago

It is a well-known fact that Tor is controlled by FBI. That's why for trully anonymous surf you should use VPN or Proxy services which are working on their own servers, not Tor

middleclick 12y ago
> It is a well-known fact that Tor is controlled by FBI. Citation please.
- Privatoria 12y ago
  certainly Tor is a great service. Dut due to it's popularity it is very inetersting for FBI. So they are making an effort to deanonymize service.For example, http://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-law-enforcement-break-tor/ http://www.forbes.com/sites/kashmirhill/2014/11/07/how-did-l...
  - simoncion 12y ago
    Honestly, it would run counter to the FBI's interest to not divulge flaws that invalidate the anonymity guarantees that tor provides. Tor was originally developed to mask the identity of USian spooks performing intelligence operations and will continue to be used in that role for the foreseeable future. [0] Like any FBI spokesman would say, things that make it harder for law enforcement to engage in surreptitious observation of targets endanger us all.[1] [0] https://news.ycombinator.com/item?id=8610532 https://news.ycombinator.com/item?id=8610532 [1] NB: I neither agree with nor endorse this claim that is all-too-often made.
  - Karunamon 12y ago
    due to it's popularity it is very inetersting for FBI. So they are making an effort to deanonymize service. Is a completely separate and much weaker claim than: It is a well-known fact that Tor is controlled by FBI No kidding they're trying to deanonymize it. The NSA is no doubt working on breaking GPG, that hardly means they own it!
13 12y ago
Why do you trust any VPN provider? You're paying to push all of your information through a dubious looking service and just hoping that they don't tamper with your pipe. I trust my ISP (who actively poison my DNS lookups) more than I would any of these sort of services. It seems like an ideal sort of business to have more than just your direct income flowing in.
spacefight 12y ago
As if you can trust your VPN provider, let alone his upstream providers.
dewey 12y ago
I guess the services advertised in your profile come highly recommended then?
eksith 12y ago
Privatoria.net is a service which provides secure communication, anonymous surf and secure file sharing for individuals and business. All security services are united together in Privatoria. It includes Secure VPN and Anonymous Proxy, that enable surf anonymously, change IP, unblock sites, Anonymous E-mail, Secure Chat, Secure Call, Secure Video Chat for secure communications and Secure file sharing via FTP and Secure Data Storage. No conflict of interest there at all in your badmouthing of Tor, with no corroborating evidence at all to boot.

kissickas 12y ago

This is quite interesting. It's initially unclear exactly what the angle of this research is, but I think that reflects the uncertainty that still surrounds this operation. Most notable to me was that the jihad-funding site was left up while its clone was taken down. Does that mean they couldn't locate the server, or that it's controlled by the FBI?

userbinator 12y ago
Most notable to me was that the jihad-funding site was left up while its clone was taken down. Does that mean they couldn't locate the server, or that it's controlled by the FBI? I was wondering the same thing - and this line from the article too: In a number of cases the FBI has seized the clone or scam version of a site while leaving up the real site. Is it because all the clone/scam sites were hosted on the same set of servers, or do the FBI know where the real ones are already but are deliberately leaving it up (and just removing the fakes since they're presumably interfering with their surveillance)?

yc1010 12y ago

"The slapshot nature of how sites were seized suggests that rather than starting with an onion address and then discovering the host server to seize, this campaign simply vacuumed up a large number of onion websites by targeting specific hosting companies. We have tracked down the hosting companies affected and the details will be published in a follow-up." Very interested to see the list of hosting companies that were targeted.

nikcub 12y ago
It is the reason why we're asking for administrators of sites that were seized or those at hosting companies to come forward. Have already spoken to a number of people and got a full list of the hosts involved, but we need a secondary confirmation, or details we can make public, on some of sites and hosts. Looking at what the seized sites had in common, in terms of host, configuration, etc. narrows down the methods that might have been used to uncover the hidden sites and provides a clearer picture of what went on.
cesarb 12y ago
The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar? Hosting a hidden service by itself does not mean doing something illegal, even Facebook hosts a hidden service nowadays. The only valid justification for the seizure would be if they had traced an illegal hidden service to that host, but from what I have read this seizure sounds too indiscriminate for that to be the case (IIRC even some pure relays, which don't host anything at all, were seized).
- forgottenpass 12y ago
  The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar? That would require the defendant's rights to have been violated. I'm no doctor of law, but even if they were slipshod enough to violate rights in investigation regarding the datacenters, I'd be surprised if the defendants rights were the ones violated (3rd party doctrine and all).

TempleOS 12y ago

God is perfectly just. You must be severely persecuted to be severely blessed. Joseph in the Old Testament did 7 years for false rape. That's how he earned ruler status in Egypt for interpretation skills. These cops are troglodytes, subhumans, badly in need of interpreter skills. Highs and lows balance. You must suffer to be blessed.

monort 12y ago

Tor TLS traffic can be distinguished by random domain in SNI during handshake (https://news.ycombinator.com/item?id=5505056 https://news.ycombinator.com/item?id=5505056). If FBI can sniff all traffic originating from hosting provider, then it seems to be trivial to detect all Tor servers and go through them manually?

userbinator 12y ago
SNI is an extension, it's not required and makes for the traffic to be easily distinguishable, so what's the reason for Tor to send an SNI?
- monort 12y ago
  Probably it will be even easier to detect Tor nodes - just look for IPs which never receive SNI in TLS exchange on 443 port.
  - userbinator 12y ago
    Thinking over the protocol again I think TLS wasn't a great choice for Tor - not only because of SNI but other things like server certificates are also sent in cleartext during the handshake so it's easy to distinguish and just block all TLS traffic that uses self-signed or otherwise certificates not issued by the big CAs. Something more like SSH, not relying on central CAs, would be less distinguishable - is it Tor traffic, or is it just someone accessing his/her server remotelly.
    - conductor 12y ago
      I would suggest impersonating other encrypted protocols with heavy traffic like encrypted BitTorrent or P2P Skype (is it still P2P or MS centralized it already?). On the other hand, systems administrators are frequently blocking BitTorrent and Skype traffic so the "TLS" traffic on port 443 has more chances to pass.
- cesarb 12y ago

MisterNegative 12y ago

Well this is to be expected if they can force a hosting company to report when servers connect to public tor nodes for a considerable amount of traffic.