3 ms·

The conclusion is being jumped to because the timeline of the attack described in the July Tor blog post matches perfectly with the timeline of the investigatio

by guelo 12y ago

The conclusion is being jumped to because the timeline of the attack described in the July Tor blog post matches perfectly with the timeline of the investigation described in the SR2 court docs. It seems very plausible to me.

tptacek 12y ago
To distill 'gwern's comment even further: He's saying that warrants and filings show that FBI had an insider positioned to subvert SR2's servers. If you have that vantage point, a worldwide traffic confirmation attack on Tor is a oddly elaborate way to scoop up SR2 vendors. Why not just use the SR2 servers to trick the vendors? Observe that the relay-early traffic confirmation attack would be a technical effort unprecedented for the DoJ, whereas implanting a backdoor into a web app is already par for their course. The Reddit threads 'gwern links to talk more about the implications of the timing. At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.
- deleted 12y ago
  [deleted]
- sarciszewski 12y ago
  > Why not just use the SR2 servers to trick the vendors? Thank you. We must assume that the FBI is a rational and intelligent adversary (even if we have a difference of opinion on specific public decisions or press releases that impact our perception of their intelligence). They're not going to expend the resources (or, as The Grugq might say, burn a valuable capability) to compromise a server when they already had a man on the inside (Cirrus). I would be willing to accept that it's possible they were on a dragnet fishing expedition around the same time to see what they could sweep up, and they just happened to use this information to confirm the efficacy of their Tor attack. This would also explain Doxbin going down, but so would Doxbin and another target of theirs being on the same bare metal server. > At first glance, it's an awfully big coincidence to write off, but there are mitigating factors. Agreed. Given what is already public knowledge, it's far from the most likely explanation.
  - guelo 12y ago
    But they did burn that valuable capability. Did they do it for no gain?
    - tptacek 12y ago
      How do you know who "they" is? The Tor project said it seemed like it could have been a research project.
    - sarciszewski 12y ago
      Academics would have no such motivational constraints unless working for the feds. They burn capabilities with wild abandon and still serve their own self-interest.
- dustingetz 12y ago
  I think a multi prong attack from independent teams is reasonable for such a high profile target.
- dsl 12y ago
  Given a global deanon attack against Tor, the DoJ absolutely would have rounded up the members of the dozens of child abuse related hidden services. The fact that only a single site was compromised indicates it was most likely an insider attack against the SR2 servers.

by guelo 12y ago

tptacek 12y ago

To distill 'gwern's comment even further: He's saying that warrants and filings show that FBI had an insider positioned to subvert SR2's servers. If you have that vantage point, a worldwide traffic confirmation attack on Tor is a oddly elaborate way to scoop up SR2 vendors. Why not just use the SR2 servers to trick the vendors? Observe that the relay-early traffic confirmation attack would be a technical effort unprecedented for the DoJ, whereas implanting a backdoor into a web app is already par for their course. The Reddit threads 'gwern links to talk more about the implications of the timing. At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.

deleted 12y ago
[deleted]
sarciszewski 12y ago
> Why not just use the SR2 servers to trick the vendors? Thank you. We must assume that the FBI is a rational and intelligent adversary (even if we have a difference of opinion on specific public decisions or press releases that impact our perception of their intelligence). They're not going to expend the resources (or, as The Grugq might say, burn a valuable capability) to compromise a server when they already had a man on the inside (Cirrus). I would be willing to accept that it's possible they were on a dragnet fishing expedition around the same time to see what they could sweep up, and they just happened to use this information to confirm the efficacy of their Tor attack. This would also explain Doxbin going down, but so would Doxbin and another target of theirs being on the same bare metal server. > At first glance, it's an awfully big coincidence to write off, but there are mitigating factors. Agreed. Given what is already public knowledge, it's far from the most likely explanation.
- guelo 12y ago
  But they did burn that valuable capability. Did they do it for no gain?
  - tptacek 12y ago
    How do you know who "they" is? The Tor project said it seemed like it could have been a research project.
  - sarciszewski 12y ago
    Academics would have no such motivational constraints unless working for the feds. They burn capabilities with wild abandon and still serve their own self-interest.
dustingetz 12y ago
I think a multi prong attack from independent teams is reasonable for such a high profile target.
dsl 12y ago
Given a global deanon attack against Tor, the DoJ absolutely would have rounded up the members of the dozens of child abuse related hidden services. The fact that only a single site was compromised indicates it was most likely an insider attack against the SR2 servers.