9 ms·

Feds found Silk Road 2 servers after a six-month attack on Tor?

194 points by kryptiskt 12y ago

Zikes 12y ago
So the FBI knowingly attacked a civilian communications network, potentially causing a great deal of harm to the entire network in order to catch a few bad apples. Like nuking a city because you're pretty sure you'll get a few bad guys.
- deleted 12y ago
  [deleted]
- tptacek 12y ago
  If the network can't ensure anonymity against bad actors, it was already fatally broken. If the consequence is improvements in Tor that break the attack, and the cost is a prosecution against someone breaking black-letter law, the result are a net-positive for civil liberties.
  - Zikes 12y ago
    We can't ignore the potential collateral damage. Even the attempt, due to its inherently indiscriminate nature, is a violation of citizens' fourth amendment rights. By your reasoning we should expect that they can kick in every door in a city looking for a suspect, then blame the doors for being too weak.
    - tptacek 12y ago
      Can you be more specific about the collateral damage you're referring to? I don't understand the argument you're making. Perturbing Tor routing isn't in any way equivalent to kicking down doors. It seems that by your logic, even a title 3 wiretap "kicks down doors", since modern wiretaps happen on packet switched networks and involve filtering out other people's traffic. If the collateral damage you're referring to is loss of trust in Tor, that's not damage: that's new information.
      - Zikes 12y ago
        > According to a Tor blog post, someone during that period was infiltrating the network by offering new relays, then altering the traffic subtly so as to weaken Tor's anonymity protections. By attacking the system from within, they were able to trace traffic across the network, effectively following the server traffic back to their home IP. This is network-wide. They did not and could not target just Silk Road 2 and its users, they sabotaged the anonymity of every user and service on Tor. A title 3 wiretap requires trust in both the government and network operator, which users of Tor may be avoiding for entirely legitimate reasons.
        tptacek 12y ago
        I'm not seeing the moral distinction between title 3 wiretaps and Tor infiltration. It can't simply be that people on Tor have expressed an unwillingness to be tapped. Every rational actor has that preference in both scenarios.
        Zikes 12y ago
        Every rational actor has that preference, but not that expectation. I'm well aware that my ISP can eavesdrop on everything that happens over their network, and can extend that ability to any party they choose. I agree that there is no moral distinction between a title 3 wiretap and Tor infiltration, however a title 3 wiretap is a passive listener while this Tor infiltration is not. The nature of the Tor infiltration caused anonymity to be stripped and readable by anyone aware of the flaw. They used resources unavailable to others to expose that information not only for themselves but to everyone. The equivalent would be streaming a title 3 wiretap sans filter to everyone on the internet.
        tedunangst 12y ago
        Perhaps you need to update your expectations? Merely expecting Tor to be secure does not make it so.
        tptacek 12y ago
    - moe 12y ago
      Tor is specifically designed to withstand attacks from resourceful adversaries who do not respect your fourth amendment rights. The FBI putting it to the test provides us with valuable information both about the FBI and about Tor.
      - Zikes 12y ago
        It didn't teach us anything we didn't already know about the FBI, but it also does not excuse their actions any more than if we were to attack any of their networks.
        moe 12y ago
        It didn't teach us anything we didn't already know about the FBI Well, it taught us that the FBI is capable of carrying out a successful attack against Tor. Maybe you knew that already - I didn't.
        mirimir 12y ago
        It's common knowledge that the FBI, DEA, etc have typically relied on the NSA for such exploits.
        tptacek 12y ago
        It is? Cite a credible source?
        mirimir 12y ago
        I'm thinking mainly of EFF, Bamford's books, and the Snowden releases. Are you claiming that parallel construction isn't SOP? Reaching way back, why do you think that the Weathermen got a pass in Chicago?
        tedunangst 12y ago
        There are at least three levels of claim that can be made here. 1. The NSA passes along tips to FBI. 2. The NSA regularly passes along tips. 3. The FBI relies on NSA tips to do its job.
    - tachion 12y ago
      What about the citizens that dont have 'fourth amendment rights' just because they're not US citizens? As far as I know, Tor is not something that 'belongs' to US, nor 'exists' in US soil so it is very interesting what about the rest of the world.
    - deleted 12y ago
      [deleted]
  - jes 12y ago
    I agree with your last sentence, as long as the black-letter law that is being violated is itself moral. I question the morality of many drug laws, however.
- __xtrimsky 12y ago
  nuking kills. slowing down a network you are not forced to use? fine by my standards.
  - Zikes 12y ago
    This isn't about the performance of the network. They could've brought it offline and that wouldn't have been as egregious an affront. They willfully subverted the network to invade the privacy and anonymity of the people using it. Regardless of the purpose, the potential damage to the people using it for any reason is too great to ignore. Political dissidents, whistleblowers, journalists, lots of people rely on Tor, and who knows how much of their information was exposed as a result.
    - moe 12y ago
      If it's really that easy to subvert Tor then we should thank the FBI for showing us.
  - rosser 12y ago
    In the case of political dissidents in repressive regimes, compromising Tor can also kill.
    - hellbanner 12y ago
      There was a DEFCON talk about TOR where the speaker advised "All of my friends and contacts in Israel & the Middle East who didn't use TOR -- I no longer hear from them".
- higherpurpose 12y ago
  Billions are "collateral damage" in US government's "cyberwar". We even know now that NSA routinely captures botnets and "repurposes" them - anyone remember the Wikileaks DDoS? That one was quite obviously done by the NSA/FBI, but they may do it against other targets as well, in a much more subtle way or even blame it on someone else.
- JohnTHaller 12y ago
  Over 80% of Tor hidden service visits are related to child pornography.* A 'few bad guys' is stretching things a bit. Additionally, they didn't nuke anything, Tor continued to function, albeit with a wide open security flaw that multiple actors besides the ones mentioned here were exploiting. * http://www.wired.com/2014/12/80-percent-dark-web-visits-relate-pedophilia-study-finds/ http://www.wired.com/2014/12/80-percent-dark-web-visits-rela...
  - gwern 12y ago
    Under a very uncertain traffic measurement methodology which plausibly biases towards very evanescent .onion addresses.
  - Zikes 12y ago
    And over 70% of emails are spam[1], so we should route every email we send through the FBI/NSA? That other 20% of Tor usage may very well be political dissidents, whistleblowers, or average Joes that just don't want half the world watching everything they do and say online. [1] http://www.kaspersky.com/about/news/spam/2013/Spam_in_Q2_2013_More_offices_in_danger_from_targeted_plausible_fakes http://www.kaspersky.com/about/news/spam/2013/Spam_in_Q2_201...
    - bigiain 12y ago
      "That other 20% of Tor usage may very well be political dissidents, whistleblowers, or average Joes that just don't want half the world watching everything they do and say online." Or me, browsing my local government website to check when the next recycling pickup day is. Because I feel some kind of duty to do my bit to make the entirely innocent portion of the haystack bigger...
    - frandroid 12y ago
      That's a terrible comparison.
    - JohnTHaller 12y ago
      Two points. First, the comparison of spam to child pornography is a bit... lopsided. Second, every email we send is made available to the FBI/NSA already.
- lotsofmangos 12y ago
  Tor is hardly a civilian network. It is quick and dirty secure communications for intelligence agents, developed by the Naval Research Laboratory. The civilians on tor are doing the useful job of adding routing complexity, which is probably why it was publicly released in the first place, as if it was only agents on there it would be useless for the job.
gwern 12y ago
OP is wrong. Weaver is (as usual) jumping to conclusions and sensationalizing (not that he did any of the work to turn up these search warrants or is deeply familiar with the topic matter... He predicted all the blackmarkets would be dead by now; how's that going?). What we know, after I and Moustache and DeepDotWeb have gone through the warrants & complaints, is that a handful (~78) IPs were deanonymized as late as July 2014 after accessing the Silk Road 2 vendor .onion. This is almost certainly due to the UC account 'Cirrus' in some form, who was perfectly placed to de-anonymize the SR2 servers and insert a payload into the landing page. A former SR2 employee says they were even using crummy commercial software like 'DeskPro' on the SR2 servers. In other words, right now the evidence is consistent with a Freedom Hosting redux scenario: the FBI has gotten another Tor Browser or other browser exploit and then phoned home. It could also be the big mysterious attack, but why would they do that when they had an insider who was involved in hiring additional employees? And also given that the SR2 vendor onion should have been seeing a lot of traffic from vendors who almost all preferred to use it due to better uptime, a mere 78 IPs sounds low. Further reading: - https://www.reddit.com/r/DarkNetMarkets/comments/2sppy0/sr2_buyer_arrested_affidavit_claims_fbi_collected/ https://www.reddit.com/r/DarkNetMarkets/comments/2sppy0/sr2_... - https://www.reddit.com/r/DarkNetMarkets/comments/2t30hs/the_plot_thickens_sr2s_doctorclu_possibly_arrested/ https://www.reddit.com/r/DarkNetMarkets/comments/2t30hs/the_...
- praptak 12y ago
  It sounds like running the server on a heavily un-trusted and sandboxed machine would prevent this class of attacks, right? I mean a machine set up so that even if attacker gets root, they can still only send Tor traffic.
  - xorcist 12y ago
    That is also not surprisingly best practice, according to the Tor documentation. You shouldn't trust it completely since there are always escapes from virtual environments but there's no reason not to.
    - dublinben 12y ago
mrb 12y ago
Edit: Ars Technica also published a nice article about the attack today: http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-sustained-attack-on-tor-to-decloak-crime-suspects/ http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-... My technical summary is that we now think it is the feds who initiated this 6-month long attack [1] which consisted in them using "a combination of two classes of attacks: a traffic confirmation attack and a Sybil attack." They ran many (115 to be exact) non-exit Tor relays on 50.7.0.0/16 and 204.45.0.0/16 (Sybil attack) to increase their chances of controlling both ends of a Tor circuit: the first relay (entry guard) reached by the SR2 server and the last relay used as a hidden service directory where the service is published. The feds' relays then actively modified traffic to inject a signal into the Tor protocol headers (bits encoded as a sequence of "relay" and "relay early" commands) to help them correlate traffic from one end of the circuit with the other end (traffic confirmation attack). So whenever the SR2 hidden service was being published (which happens whenever the server reconnects to the Tor cloud?) the last relay knew it was for the SR2 service (but didn't know the server IP), and could correlate it with the entry guard which knew the IP address (but didn't know the service name). Once they knew the SR2 server IP, the game was over. [1] https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack https://blog.torproject.org/blog/tor-security-advisory-relay...
- at-fates-hands 12y ago
  I remember seeing a Def Con presentation about this by the guy who founded Derby Con. Can't find it right now, but will post it if I can find it again.
  - at-fates-hands 12y ago
    Not sure why I can't edit my original comment, but whatever. Here is the presentation Adrian Crenshaw gave at DefCon 22 called "Dropping Docs on Darknets: How People Got Caught" Great presentation: https://www.youtube.com/watch?v=eQ2OZKitRwc https://www.youtube.com/watch?v=eQ2OZKitRwc
Zikes 12y ago
I'm getting some surprisingly mixed messages on here because I've come into the discussion with a couple of assumptions, so I'd like to try to clear those up. 1. Do we have the right to private, secure, anonymous communications? 2. If yes, do we have the right to be outraged when our government attempts to subvert our private communications, most especially with broadly-scoped warrants or tactics that can expose your communications to any potential listeners?
- tedunangst 12y ago
  If nobody is trying to subvert your private communications, you don't need secure private communications in the first place. If you assume you need secure comms, you should assume people will try to subvert and break your secure comms.
  - nickysielicki 12y ago
    "If nobody is trying to search your home, you don't need locks in the first place."
    - tedunangst 12y ago
      Is that not true?
      - striking 12y ago
        This metaphor works well. What about thieves (internet criminals) or nosy passersby (script kiddies)? Don't you need protection against those, too?
      - paulhebert 12y ago
        I think his point is you can never be sure when someone is trying to break in to your house/subvert your communications, so it makes sense to take precautions. I don't want the government actively working to weaken house lock standards for a lot of the same reasons I don't want them working to subvert privacy technology. Admittedly, in this case the metaphor is kind of flawed since SR2 is the equivalent of a drug dealer's home, which the Feds would have no qualms about breaking in to.
kilovoltaire 12y ago
"Silk Road 2 wasn't vulnerable to the same CAPTCHA attack that gave away location of the first Silk Road's servers" In case I'm not the only one who hadn't read about how the first Silk Road got caught, it's simple but interesting: http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...
- nikcub 12y ago
  It also isn't true: https://www.nikcub.com/posts/analyzing-fbi-explanation-silk-road/ https://www.nikcub.com/posts/analyzing-fbi-explanation-silk-... Krebs also posted an update (which he should probably link to from his 'leaky captcha' post): http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/ http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...
geographomics 12y ago
We know that a global adversary exists, and that Tor is vulnerable to certain types of attacks by such an adversary (e.g. [1,2]). Given that the list of relays is public by design, that their (albeit encrypted) communication can be monitored by the adversary, that popular hidden services will be moving a significant amount of traffic to and from a single static IP address in a manner modifiable by any user of it, and that there are known methods of disrupting hidden services to effect a global change in this [3] - it follows that such hidden services are rather more vulnerable to deanonymisation, compared to most other users. Seems like running one is an incredibly risky thing to be doing. [1] http://cryptome.org/2013/08/tor-users-routed.pdf http://cryptome.org/2013/08/tor-users-routed.pdf [2] https://mice.cs.columbia.edu/getTechreport.php?techreportID=556&format=pdf https://mice.cs.columbia.edu/getTechreport.php?techreportID=... [3] http://donncha.is/2013/05/trawling-tor-hidden-services/ http://donncha.is/2013/05/trawling-tor-hidden-services/

194 points by kryptiskt 12y ago

Zikes 12y ago

So the FBI knowingly attacked a civilian communications network, potentially causing a great deal of harm to the entire network in order to catch a few bad apples. Like nuking a city because you're pretty sure you'll get a few bad guys.

deleted 12y ago
[deleted]
tptacek 12y ago
If the network can't ensure anonymity against bad actors, it was already fatally broken. If the consequence is improvements in Tor that break the attack, and the cost is a prosecution against someone breaking black-letter law, the result are a net-positive for civil liberties.
- Zikes 12y ago
  We can't ignore the potential collateral damage. Even the attempt, due to its inherently indiscriminate nature, is a violation of citizens' fourth amendment rights. By your reasoning we should expect that they can kick in every door in a city looking for a suspect, then blame the doors for being too weak.
  - tptacek 12y ago
    Can you be more specific about the collateral damage you're referring to? I don't understand the argument you're making. Perturbing Tor routing isn't in any way equivalent to kicking down doors. It seems that by your logic, even a title 3 wiretap "kicks down doors", since modern wiretaps happen on packet switched networks and involve filtering out other people's traffic. If the collateral damage you're referring to is loss of trust in Tor, that's not damage: that's new information.
    - Zikes 12y ago
      > According to a Tor blog post, someone during that period was infiltrating the network by offering new relays, then altering the traffic subtly so as to weaken Tor's anonymity protections. By attacking the system from within, they were able to trace traffic across the network, effectively following the server traffic back to their home IP. This is network-wide. They did not and could not target just Silk Road 2 and its users, they sabotaged the anonymity of every user and service on Tor. A title 3 wiretap requires trust in both the government and network operator, which users of Tor may be avoiding for entirely legitimate reasons.
      - tptacek 12y ago
        I'm not seeing the moral distinction between title 3 wiretaps and Tor infiltration. It can't simply be that people on Tor have expressed an unwillingness to be tapped. Every rational actor has that preference in both scenarios.
        Zikes 12y ago
        Every rational actor has that preference, but not that expectation. I'm well aware that my ISP can eavesdrop on everything that happens over their network, and can extend that ability to any party they choose. I agree that there is no moral distinction between a title 3 wiretap and Tor infiltration, however a title 3 wiretap is a passive listener while this Tor infiltration is not. The nature of the Tor infiltration caused anonymity to be stripped and readable by anyone aware of the flaw. They used resources unavailable to others to expose that information not only for themselves but to everyone. The equivalent would be streaming a title 3 wiretap sans filter to everyone on the internet.
        tedunangst 12y ago
        Perhaps you need to update your expectations? Merely expecting Tor to be secure does not make it so.
        tptacek 12y ago
  - moe 12y ago
    Tor is specifically designed to withstand attacks from resourceful adversaries who do not respect your fourth amendment rights. The FBI putting it to the test provides us with valuable information both about the FBI and about Tor.
    - Zikes 12y ago
      It didn't teach us anything we didn't already know about the FBI, but it also does not excuse their actions any more than if we were to attack any of their networks.
      - moe 12y ago
        It didn't teach us anything we didn't already know about the FBI Well, it taught us that the FBI is capable of carrying out a successful attack against Tor. Maybe you knew that already - I didn't.
        mirimir 12y ago
        It's common knowledge that the FBI, DEA, etc have typically relied on the NSA for such exploits.
        tptacek 12y ago
        It is? Cite a credible source?
        mirimir 12y ago
        I'm thinking mainly of EFF, Bamford's books, and the Snowden releases. Are you claiming that parallel construction isn't SOP? Reaching way back, why do you think that the Weathermen got a pass in Chicago?
        tedunangst 12y ago
        There are at least three levels of claim that can be made here. 1. The NSA passes along tips to FBI. 2. The NSA regularly passes along tips. 3. The FBI relies on NSA tips to do its job.
  - tachion 12y ago
    What about the citizens that dont have 'fourth amendment rights' just because they're not US citizens? As far as I know, Tor is not something that 'belongs' to US, nor 'exists' in US soil so it is very interesting what about the rest of the world.
  - deleted 12y ago
    [deleted]
- jes 12y ago
  I agree with your last sentence, as long as the black-letter law that is being violated is itself moral. I question the morality of many drug laws, however.
__xtrimsky 12y ago
nuking kills. slowing down a network you are not forced to use? fine by my standards.
- Zikes 12y ago
  This isn't about the performance of the network. They could've brought it offline and that wouldn't have been as egregious an affront. They willfully subverted the network to invade the privacy and anonymity of the people using it. Regardless of the purpose, the potential damage to the people using it for any reason is too great to ignore. Political dissidents, whistleblowers, journalists, lots of people rely on Tor, and who knows how much of their information was exposed as a result.
  - moe 12y ago
    If it's really that easy to subvert Tor then we should thank the FBI for showing us.
- rosser 12y ago
  In the case of political dissidents in repressive regimes, compromising Tor can also kill.
  - hellbanner 12y ago
    There was a DEFCON talk about TOR where the speaker advised "All of my friends and contacts in Israel & the Middle East who didn't use TOR -- I no longer hear from them".
higherpurpose 12y ago
Billions are "collateral damage" in US government's "cyberwar". We even know now that NSA routinely captures botnets and "repurposes" them - anyone remember the Wikileaks DDoS? That one was quite obviously done by the NSA/FBI, but they may do it against other targets as well, in a much more subtle way or even blame it on someone else.
JohnTHaller 12y ago
Over 80% of Tor hidden service visits are related to child pornography.* A 'few bad guys' is stretching things a bit. Additionally, they didn't nuke anything, Tor continued to function, albeit with a wide open security flaw that multiple actors besides the ones mentioned here were exploiting. * http://www.wired.com/2014/12/80-percent-dark-web-visits-relate-pedophilia-study-finds/ http://www.wired.com/2014/12/80-percent-dark-web-visits-rela...
- gwern 12y ago
  Under a very uncertain traffic measurement methodology which plausibly biases towards very evanescent .onion addresses.
- Zikes 12y ago
  And over 70% of emails are spam[1], so we should route every email we send through the FBI/NSA? That other 20% of Tor usage may very well be political dissidents, whistleblowers, or average Joes that just don't want half the world watching everything they do and say online. [1] http://www.kaspersky.com/about/news/spam/2013/Spam_in_Q2_2013_More_offices_in_danger_from_targeted_plausible_fakes http://www.kaspersky.com/about/news/spam/2013/Spam_in_Q2_201...
  - bigiain 12y ago
    "That other 20% of Tor usage may very well be political dissidents, whistleblowers, or average Joes that just don't want half the world watching everything they do and say online." Or me, browsing my local government website to check when the next recycling pickup day is. Because I feel some kind of duty to do my bit to make the entirely innocent portion of the haystack bigger...
  - frandroid 12y ago
    That's a terrible comparison.
  - JohnTHaller 12y ago
    Two points. First, the comparison of spam to child pornography is a bit... lopsided. Second, every email we send is made available to the FBI/NSA already.
lotsofmangos 12y ago
Tor is hardly a civilian network. It is quick and dirty secure communications for intelligence agents, developed by the Naval Research Laboratory. The civilians on tor are doing the useful job of adding routing complexity, which is probably why it was publicly released in the first place, as if it was only agents on there it would be useless for the job.

gwern 12y ago

OP is wrong. Weaver is (as usual) jumping to conclusions and sensationalizing (not that he did any of the work to turn up these search warrants or is deeply familiar with the topic matter... He predicted all the blackmarkets would be dead by now; how's that going?). What we know, after I and Moustache and DeepDotWeb have gone through the warrants & complaints, is that a handful (~78) IPs were deanonymized as late as July 2014 after accessing the Silk Road 2 vendor .onion. This is almost certainly due to the UC account 'Cirrus' in some form, who was perfectly placed to de-anonymize the SR2 servers and insert a payload into the landing page. A former SR2 employee says they were even using crummy commercial software like 'DeskPro' on the SR2 servers. In other words, right now the evidence is consistent with a Freedom Hosting redux scenario: the FBI has gotten another Tor Browser or other browser exploit and then phoned home. It could also be the big mysterious attack, but why would they do that when they had an insider who was involved in hiring additional employees? And also given that the SR2 vendor onion should have been seeing a lot of traffic from vendors who almost all preferred to use it due to better uptime, a mere 78 IPs sounds low. Further reading: - https://www.reddit.com/r/DarkNetMarkets/comments/2sppy0/sr2_buyer_arrested_affidavit_claims_fbi_collected/ https://www.reddit.com/r/DarkNetMarkets/comments/2sppy0/sr2_... - https://www.reddit.com/r/DarkNetMarkets/comments/2t30hs/the_plot_thickens_sr2s_doctorclu_possibly_arrested/ https://www.reddit.com/r/DarkNetMarkets/comments/2t30hs/the_...

praptak 12y ago
It sounds like running the server on a heavily un-trusted and sandboxed machine would prevent this class of attacks, right? I mean a machine set up so that even if attacker gets root, they can still only send Tor traffic.
- xorcist 12y ago
  That is also not surprisingly best practice, according to the Tor documentation. You shouldn't trust it completely since there are always escapes from virtual environments but there's no reason not to.
  - dublinben 12y ago

mrb 12y ago

Edit: Ars Technica also published a nice article about the attack today: http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-sustained-attack-on-tor-to-decloak-crime-suspects/ http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-... My technical summary is that we now think it is the feds who initiated this 6-month long attack [1] which consisted in them using "a combination of two classes of attacks: a traffic confirmation attack and a Sybil attack." They ran many (115 to be exact) non-exit Tor relays on 50.7.0.0/16 and 204.45.0.0/16 (Sybil attack) to increase their chances of controlling both ends of a Tor circuit: the first relay (entry guard) reached by the SR2 server and the last relay used as a hidden service directory where the service is published. The feds' relays then actively modified traffic to inject a signal into the Tor protocol headers (bits encoded as a sequence of "relay" and "relay early" commands) to help them correlate traffic from one end of the circuit with the other end (traffic confirmation attack). So whenever the SR2 hidden service was being published (which happens whenever the server reconnects to the Tor cloud?) the last relay knew it was for the SR2 service (but didn't know the server IP), and could correlate it with the entry guard which knew the IP address (but didn't know the service name). Once they knew the SR2 server IP, the game was over. [1] https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack https://blog.torproject.org/blog/tor-security-advisory-relay...

at-fates-hands 12y ago
I remember seeing a Def Con presentation about this by the guy who founded Derby Con. Can't find it right now, but will post it if I can find it again.
- at-fates-hands 12y ago
  Not sure why I can't edit my original comment, but whatever. Here is the presentation Adrian Crenshaw gave at DefCon 22 called "Dropping Docs on Darknets: How People Got Caught" Great presentation: https://www.youtube.com/watch?v=eQ2OZKitRwc https://www.youtube.com/watch?v=eQ2OZKitRwc

Zikes 12y ago

I'm getting some surprisingly mixed messages on here because I've come into the discussion with a couple of assumptions, so I'd like to try to clear those up. 1. Do we have the right to private, secure, anonymous communications? 2. If yes, do we have the right to be outraged when our government attempts to subvert our private communications, most especially with broadly-scoped warrants or tactics that can expose your communications to any potential listeners?

tedunangst 12y ago
If nobody is trying to subvert your private communications, you don't need secure private communications in the first place. If you assume you need secure comms, you should assume people will try to subvert and break your secure comms.
- nickysielicki 12y ago
  "If nobody is trying to search your home, you don't need locks in the first place."
  - tedunangst 12y ago
    Is that not true?
    - striking 12y ago
      This metaphor works well. What about thieves (internet criminals) or nosy passersby (script kiddies)? Don't you need protection against those, too?
    - paulhebert 12y ago
      I think his point is you can never be sure when someone is trying to break in to your house/subvert your communications, so it makes sense to take precautions. I don't want the government actively working to weaken house lock standards for a lot of the same reasons I don't want them working to subvert privacy technology. Admittedly, in this case the metaphor is kind of flawed since SR2 is the equivalent of a drug dealer's home, which the Feds would have no qualms about breaking in to.

kilovoltaire 12y ago

"Silk Road 2 wasn't vulnerable to the same CAPTCHA attack that gave away location of the first Silk Road's servers" In case I'm not the only one who hadn't read about how the first Silk Road got caught, it's simple but interesting: http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leaky-captcha/ http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...

nikcub 12y ago
It also isn't true: https://www.nikcub.com/posts/analyzing-fbi-explanation-silk-road/ https://www.nikcub.com/posts/analyzing-fbi-explanation-silk-... Krebs also posted an update (which he should probably link to from his 'leaky captcha' post): http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-holes-in-fbis-story/ http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...

geographomics 12y ago

We know that a global adversary exists, and that Tor is vulnerable to certain types of attacks by such an adversary (e.g. [1,2]). Given that the list of relays is public by design, that their (albeit encrypted) communication can be monitored by the adversary, that popular hidden services will be moving a significant amount of traffic to and from a single static IP address in a manner modifiable by any user of it, and that there are known methods of disrupting hidden services to effect a global change in this [3] - it follows that such hidden services are rather more vulnerable to deanonymisation, compared to most other users. Seems like running one is an incredibly risky thing to be doing. [1] http://cryptome.org/2013/08/tor-users-routed.pdf http://cryptome.org/2013/08/tor-users-routed.pdf [2] https://mice.cs.columbia.edu/getTechreport.php?techreportID=556&format=pdf https://mice.cs.columbia.edu/getTechreport.php?techreportID=... [3] http://donncha.is/2013/05/trawling-tor-hidden-services/ http://donncha.is/2013/05/trawling-tor-hidden-services/