28 ms·

Running a Dark Web pedophile honeypot

185 points by nkurz 11y ago

imrehg 11y ago
Is it just me, or the rhetorical question in the title ("why I now think Tor is the devil") never got answered? Also not clear whether the Dark Web spider project was just to later seed the honeypot sites to appear legit, or was it a project on its own? The quote "The reports are published nightly on a hacker-related Dark Web site that I am involved with" hints at the latter, and then I'd double don't understand why Tor would be the devil, if for other uses (hackers) the author is happy to take advantage of it? I'm a bit confused about what good does it do to reveal the exit node addresses? It has nothing to do with the actual Tor user, and could be even considered "public info" the way Tor is used, doesn't it?
- nightpool 11y ago
  Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes. I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though... EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.
  - geek_slop 11y ago
    It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up. The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities. My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.
    - vfdva 11y ago
      "A knock on your door", ha! That's one way to put it.
    - girvo 11y ago
      But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.
    - aftbit 11y ago
      Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.
      - gizmo686 11y ago
        Although they could be made to run a packet sniffer, which could provide useful information.
        utuxia 11y ago
        But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.
    - icehawk 11y ago
      The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.
  - userbinator 11y ago
    I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high. I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.
    - htns 11y ago
      Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.
  - vacri 11y ago
    > this is a fundamental tenant might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.
    - nightpool 11y ago
      huh, I guess I just always assumed they were homonyms. Thanks!
- AdeptusAquinas 11y ago
  I think the implication is its the devil because mostly Tor is used for pedophilic reasons - drugs, counterfeiting or political protest (I'd assume) are almost insignificant in comparison to pedophile traffic.
  - tokenizerrr 11y ago
    I don't think that's true. The darknet drug markets are insanely popular, just take a look at https://www.reddit.com/r/darknetmarkets https://www.reddit.com/r/darknetmarkets for a small taste.
    - AdeptusAquinas 11y ago
      This is just based on what he said, which was based on what he observed from the traffic to his honeypots. Understandably you probably cant create a honeypot to gauge political activism so that might be hard to measure :D
  - gwern 11y ago
    To expand ontokenizerrr's point, I read this as a big victory: > First, the pedo site saw magnitudes more traffic than the counterfeiting or drugs websites – in the order of 100 times more traffic than the other two combined. When someone wants to use the DNMs, they start at http://deepdotweb.com/ http://deepdotweb.com/ , http://thehub7gqe43miyc.onion/ http://thehub7gqe43miyc.onion/ , http://darknetmarkets.reddit.com/ http://darknetmarkets.reddit.com/ or http://www.gwern.net/Black-market%20survival http://www.gwern.net/Black-market%20survival ; these are curated community lists, which people use to avoid falling for phishing links and scams. Just look at the traffic stats for the one subreddit: https://www.reddit.com/r/DarkNetMarkets/about/traffic/ https://www.reddit.com/r/DarkNetMarkets/about/traffic/ ! DNM users do not start at a random .onion because that is a recipe for being the latest victim of 'Drug Market' and other longstanding onion scams. OP appears to have made no effort to get his honeypot into any of the standard sources of DNM info, and accordingly, he got no traffic. This is exactly as one would hope, and says more about how badly he bungled the drugs honeypot (and conversely, how pathetic the security of the pedo community is) than about any ratio of pedos to drug buyers. (This is a similar problem as the paper which counts .onions and argues that pedophiles are 99% or whatever of hidden-service traffic; the differing communities using hidden-services simply don't work the way that OP or that paper assumed for ease of making wild claims. Counting onion addresses does not work because the pedo sites tend to change onions constantly while the huge blackmarkets like Agora stick at a single onion like agorahooawayyfoe.onion for months or years; counting visits to a lame honeypot like OP's does not work because with no advertising, vetting, or sellers, no one would bother with his honeypot when they could use Agora, Nucleus, Abraxas, or other established markets with broad offerings.)
- geek_slop 11y ago
  The crawler project was a project on its own but after discovering that the many of the discovered sites were pedophile-related, I started to shut down the spider. Then I figured, what the heck, maybe I can hack around on Tor and see how close I can come to determining their real identity. For those that chose to run the scanner, their identity was revealed (name, IP, and enough of a hardware footprint to identify their machine).
- jandrese 11y ago
  It did seem a bit strange with "I created a pedo honeypot and gasp horror it attracted a bunch of pedos!!" The biggest thing he demonstrated is that a percentage of pedos would run an executable from some guy on Tor if he asks nicely. How can it be hard for the FBI to catch those guys?
methou 11y ago
I got a 403 error while accessing the site.
- geek_slop 11y ago
  Sorry, it's under an insane load right now. I fully expect to find a dead server when I wake up in the morning.
sarahj 11y ago
Some of the technical points of this article are simply wrong... > The exit node IP address of the user was easily obtained using the two different methods discussed briefly above. This is really not a vulnerability but simply how tor, and the internet at large, works - hidden services by design protect the service not the user (the user is protected by tor by default) - what the author actually did here was "leak" their non-hidden services IP. > and true external IP address (see partial data example to the above). And to answer the second question, “no”, this did not involve the placement of malicious malware. Read on… The author then goes on to state that they gave the users malicious malware to run which revealed their ip address. They justify that this was not malware by stating: > It should be noted that this was not malware per se. It did not replicate and was run voluntarily by the user. The user was notified that a “security scan” was going to be run on their machine and they freely chose to run the scan. The author then goes on to publish a list of tor exit nodes with tor user agents...which they could have gotten directly from the tor directory services... And, as pointed out by others, the author never really goes on to state why they think Tor is the devil - they built a honeypot and were disgusted by the flies it attracted....I'm not really sure what they were expecting...
- jrcii 11y ago
  The author appears to believe that "Tor is the devil" because "4,000-5,000 hidden services are running at any given time. Secondly, the content served by these sites is almost universally illegal or immoral (by my definition anyway). A conservative estimate would be maybe 1 out of 200 or so hidden service websites contain content I would deem worthy of the protection an anonymous network provides. Sites featuring free speech dumps or libraries of hard-to-find underground literature are few and far between on the Dark Web."
  - MichaelCrawford 11y ago
    The vast majority of illegal or immoral content is not encrypted in any way. Giving the Finger to Vasha: Child Pornography on the Internet http://www.warplife.com/jonathan-swift/books/software-problem/deadly-sins/greed/pornography/child/internet/ http://www.warplife.com/jonathan-swift/books/software-proble... A straightford way to find many of those who profit from its distribution would be to use a bot to locate forum threads that go on for hundreds of pages.
kauffj 11y ago
> On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. The FBI twice rejecting a set of information that could have reasonably led to the arrest of several pedophiles seems like a big mistake.
- nightpool 11y ago
  "full sets of data" seem to include Tor exit node IP addresses (public information that you can obtain from the Tor directory service) and a few possible real IP addresses—but not ones he can directly tie to any actual CP. As he says, "Admittedly, after introducing the security scanner, traffic patterns changed. Scans on the server dropped and some of the users who opted to run the software appeared to be government or private researchers. Most visitors were reluctant to run the security scanner." Later he says that between 4 and 7 percent of his registered users ran the scanner. He never says how many registered users he had, and never said how many uploaded child porn or could be directly connected to it (and how many of those ran the scanner) I'm not surprised the FBI turned him down.
  - geek_slop 11y ago
    I have already shut down the VM but I believe there were around 550-650 registered users in 14 days. Around 40-60 new registrations per day. Total registrations for counterfeiting+drugs sites: 8. Since the article went out, someone pointed out to me that one popular pedo .onion site has 90,000 registered users.
- zxcvcxz 11y ago
  Personally I'm glad some random guy can't hand off a whole bunch of IPs to the FBI and tell them they're all pedophiles. I'm sure it would cost thousands of dollars to sift through the data too, and would be pretty useless seeing as the guy wasn't hosting child porn. Besides, taking down these pedophiles might be "fun" to some people, but if you really want to help children you need to go after the people producing/hosting child pornography.
  - 11y ago
zxcvcxz 11y ago
"pedophiles use encryption, so encryption is the devil." seems to be where this is going. That's a slippery slope and a bit unethical to use pedophiles to push an authoritarian political agenda. I bet it's fun to call all his critics pedophile sympathizers and sit upon a moral high-horse of self-righteousness while pushing his authoritarian ideology under the guise of social justice.. That's the thing about these people, they take on social issues for which they can't be criticized without the criticizer looking like a pedophile, racist, or a misogynist. I guess it gives them a sense of power.
- userbinator 11y ago
  Also terrorism and hackers (of the black-hat kind.) I've even been called one when I tried to argue against the proliferation of closed, walled-garden systems that seem so common today. That reminds me, Freenet has an interesting stance on this: https://freenetproject.org/faq.html#childporn https://freenetproject.org/faq.html#childporn
- _asummers 11y ago
  To be clear, Tor does not provide encryption but anonymization. While your comment is valid (and something I personally agree with) nonetheless, I feel this distinction is important.
  - thelamest 11y ago
    For that purpose of anonymization it provides encryption, but with significant exceptions (non-hidden, non-HTTPS services) (when you use Tor correctly and can trust the PKI) (if I understand correctly).
- anigbrowl 11y ago
  You're projecting a great more than he did.
- craigmccaskill 11y ago
  Sadly this is where the UK government seems to be going [1]. They want all encryption to have a backdoor or be outlawed. [1] http://www.businessinsider.com/david-cameron-encryption-back-doors-iphone-whatsapp-2015-7?r=UK http://www.businessinsider.com/david-cameron-encryption-back...
athenot 11y ago
As a father of a little girl, this is a depressing read for me. Yes in the back of my mind I know this stuff is going on but it's really sad seeing the collection of data showing people who are partaking in this stuff. Also this gave me a nasty flashback of looking at filenames (never content) of deleted files in the process of gathering evidence against a family member who now sits on the registered sex offender list...
- johnnycarcin 11y ago
  Tell me about it. Awhile back as a reason to learn some new things I setup a Tor hidden service/page crawler and a basic search engine. For troubleshooting purposes (and to see how popular the site was) I was logging what was being searched for. After about a two weeks of having the site up I shut it down because 90% of the searches were for child porn. As a Tor supporter it was kind of eye opening. I guess though if you had the logs for Google you might see something similar...
  - belorn 11y ago
    I suspect this is where the myth of 99% of the Internet is made out of porn comes from. It is very easy to get misleading statistics, especially if you have small sample size or where a minority of users are creating the majority of the collected data points. Add to this the amount of bots out there, and "false" data generated by police, federal investigators and interest groups doing the very thing people pay them to do, and you would really have to design the data collecting system in such a way that it identified who is doing the searching and what their usage patterns are. For example, If they return every hour on the hour, such result would likely be made by a bot, or if every search is extremely specific, it could very likely be an investigator doing work in a specific case. If I did this kind of research, I would contact professional investigators in order to work together and to collect search patterns so to exclude that kind of traffic.
  - gambiting 11y ago
    Bear in mind that at least some of the "14 year old sex" searches are done by 14 year old children who do not know any better.
shruubi 11y ago
I must say, even reading the article made me feel quite uneasy. I can't imagine doing this myself, but if it leads to the capture of some pedophiles then I tip my hat to this person.
whatisup 11y ago
Smells like False Flag. https://en.wikipedia.org/wiki/False_flag https://en.wikipedia.org/wiki/False_flag
dvt 11y ago
It seems like the author is emotionally invested in this topic: > Given my circumstances, I have seen first-hand, the psychological damage a pedophile’s actions cause. The damage done to these children is permanent and no matter how much counseling and assistance they seek – the experience is forever embedded into their self, shaping (and sometimes limiting) what they become as adults. I can't pretend like I really get this because I've never dealt with pedophiles or pedophilia first-hand but I can agree, however, that people that hurt children are doing something morally wrong. With that said, this kinds of vigilante-esque behavior can be (and often times is) the absolute antithesis of justice. > On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. Since OP tried to approach the FBI on two different occasions, it doesn't really seem to me like this was merely an innocuous "security" experiment (like this one: http://www.tomsguide.com/us/spoiled-onions-tor-network,news-18237.html http://www.tomsguide.com/us/spoiled-onions-tor-network,news-...). It seems like OP really feels a deep hatred towards pedophiles and was, in a sense, out to get them. Thankfully, we have the justice system that handles this for us. These are people that try to be impartial, fair, and just. When accused, we have the court system -- a system that values innocence until proven guilt. I hope I won't be taken out of context here. I'm not defending pedophilia (or drug trafficking or murder -- a few other Tor commodities). Do you really feel compelled to "get the bad guys?" Great. Go to a police academy or go to law school. Real life isn't like a superhero graphic novel. The law, for the most part, works. More importantly, it provides some boundaries for those that enforce it. I had to read Mill's On Liberty in a Philosophy of Law class I took a few years ago and Chapter IV, Of the Limits to the Authority of Society over the Individual, really stuck with me. I would strongly suggest OP give it a good read: http://www.bartleby.com/130/4.html http://www.bartleby.com/130/4.html.
- mikekchar 11y ago
  I couldn't really finish reading the article. I hope the original author will realize that hanging on to his anger will only perpetuate the crimes committed against his daughter. His characterisation of permanent damage done to his daughter makes me wonder if she will ever be able to escape the trauma in his eyes. Will he be able to provide a safe place for her to go where people know about her past but care only about her present? If he thinks of her as having limited potential for the future, how will she escape that past? She needs a father, not an avenger. It's amazing the damage people can do chasing justice.
ikeboy 11y ago
> Had I been the FBI, they would have been caught. Considering that no actual files were made available for download, and many of the visitors were likely researchers, there wouldn't be enough to prosecute, but given the implied level of security the actual pedos were using, the FBI could just search their computers and would likely find enough evidence. >For instance, pedophiles form their own communities and within those communities, a sense of trust is developed. Or, pedos aren't drawn from the same population that knows how to do stuff securely, they just read a guide or two on how to use Tor. I'd assume you could get "4-7%" of many groups of people to download something and run it, that doesn't show that pedos necessarily are more trusting. (In fact, I'd expect higher numbers from random internet users, thus implying that pedos are less trusting, which I'd expect at a minimum given the fact that they can access Tor).
ThomPete 11y ago
Maybe it's just me but I don't really like the tendency to treat pedophiles as if they are the devils themselves. Let there be no doubt. I have two kids and there is probably no limit to what I would do to someone who did anything to my kids. But it's not as simply as just condemning pedophiles for being that and I ultimately think there is something morally or ethically questionable about this approach. It's fairly well established that many pedophiles where in fact victims of pedophilia in their childhood themselves and so I would like to see a less hysteric and more balanced response to the issue. Just because he is helping catching the bad guys does not give him the moral upper hand as he seem to think he has. Too bad such a complex issue gets treated with such brushing generalizations. Maybe I am reading too much into what he writes, but these honeypots to hit random people just feels wrong to me. Like snooping on someone else life.
- allendoerfer 11y ago
  > It's fairly well established that many pedophiles where in fact victims of pedophilia in their childhood themselves … Wouldn't that mean, that he is not only trying to catch pedophiles but actively curing pedophilia? I think what is going on in the US with the public shaming of offenders in databases is wrong, but I am fine with honeypots to catch them. Legally he is in no position to do so, of course.
  - ThomPete 11y ago
    Maybe a few but he is also hurting someone who might just be watching and could destroy their lives completely. As I said it's not that simple. I find it all disgusting but these people need help not traps. They are humans not animals despite what we think of some of their actions.
    - allendoerfer 11y ago
      There is no "just be watching". If you watch a child getting raped, you are committing a crime and better have a very convincing argument why you had to do it. It is in fact that simple. Of course they need help, too. We need both prosecution and prevention.
api 11y ago
An interesting point I heard here I think, long ago... The fact that tor is full of stuff like kidporn is actually a positive commentary on our society. It means that almost everyone, even people with wildly unpopular views, feel comfortable discussing them in the open. Tor isn't full of manifestos and political texts because people don't feel the need to hide that stuff. I am sort of glad tor exists in spite of the nasty uses some put it to. It's like the modern equivalent of what having a well armed militia around was once supposed to achieve. It's like a backup system.
- sgt 11y ago
  Interesting point. Society can change though - and networks like Tor may be come increasingly important in the future.
InTheArena 11y ago
Probably condemning myself to eternal down-voting here, but some of the reactions here are depressing as fuck. There is no world in which this content is acceptable. The presence of this on TOR is not "good for society" in any way shape or form, and reveals that society can't be trusted with anonymous speech... Which is a really big problem, because there are a shit-ton of other problems that require anonymous speech.
- sumitviii 11y ago
  Internet is like a loud speaker. Just because some people can use it to communicate some profanities doesn't mean that it should be banned.
wodenokoto 11y ago
I didn't understand what he offers users that entices them to go to a higher level. At what point do users give up since there is no content on the website?
woah 11y ago
Wait... Is anyone else seeing this? The guy ran a crawler that visited many such illegal sites, then used stats on the number of visits that his honeypot got to draw conclusions about TOR. What is the standard of evidence that he is using? Seems like some weird methodology.
utuxia 11y ago
I don't think he understands how Tor works. Everything you visit on tor gets your exit node IP address. That's how it works.
- nightpool 11y ago
  Technically, because of how hidden services work in the tor architecture (both the service AND the user are hidden from each other) there's no "exit ip" when connecting to a hidden service, it just happens somewhere in the intermediary hops. (with the hidden service pretending that its just getting a response from somewhere up the chain) so what the author of this article was actually doing was just leaking his own IP. lol
foopants 11y ago
And how does he know the email addresses he published aren't from some clueless persons compromised gmail account?
AlyssaRowan 11y ago
Firstly, so - the writer is geek_slop? - let me get this straight about you?: · You adopted a girl at some point. · You are not law enforcement, and are not authorised by them in any way. · You disclose, here in this webpage, that you ran a hidden service site, via Tor, explicitly for paedophiles. · You have admitted the above, to the FBI. · You haven't considered what child protective services' post-adoptive services might think of your doing this? Um, I am a trifle concerned that you may have let your emotional investment get in the way of good research, or good sense, thinking this vigilantism through to its logical conclusion. Secondly, I think I'm enough of an expert on the topic of malware to say that the software, designed to cause a privacy breach upon whomever runs it and to disguise that purpose so that they may be tricked into running it voluntarily, is definitely malware: what is technically known as a "Trojan Horse", essentially doing the same job as the FBI's "CIPAV", but worse. Thirdly, I've spoken with law enforcement on this topic before, in the context of discussing anonymous networks like Tor. They are frequently displeased about vigilantes ruining their operations by doing shit like this - it makes the paedophiles more paranoid and careful, actively disrupting ongoing law enforcement investigations. Fourthly, it's not valid research. geek_slop doesn't appear to be familiar with how Tor actually works, in fact, they actually list the wonderful exit nodes they got, apparently unaware that the list of exit nodes is public and by design doesn't tell you anything at all about the visitors to your site. Web crawlers (including "Dark Web" - a wording which is another sign that the author does not have a strong background in anonymous networks - it's correctly "onion site" now, formerly "hidden service") naturally find related sites that link to each other, if you're going by links, which they might have done. If they're neutrally HSdir crawling, most of them are dead (because they're ephemeral services created by a P2P chat app?). We know all that from previous research (Dr Gareth Owen, University of Portsmouth, Tor Hidden Services and Deanonymisation, 31C3 https://www.youtube.com/watch?v=oZdeRmlj8Gw https://www.youtube.com/watch?v=oZdeRmlj8Gw ). Finally, this crawler might in fact be the exact same "dumb crawler" I previously identified as doing repeated HSdir directory service lookups (instead of caching) while refreshing paedophile sites, causing disproportionate load on the Tor network's HSdir services and strongly skewing Dr Owen's results on this topic (if it's not yours, it's probably IWF's). So, um, thanks for that.
- mrsteveman1 11y ago
xorcist 11y ago
Numbering hidden services is something you publish papers on, and most researchers arrive at much larger numbers than 4000. But just as the author pulled numbers out of thin air (20 out the 4000 are deemed worthy of anonymity), 9 out of 10 paedophiles caught by him would turn out to be other researchers (or "researchers"). They are much more likely to run the spyware he offered. At any time, Tor is frequented by many like him. Some law enforcement, some working for child abuse organizations, some academia, and a lot of regular people with the same ambitions. Advertising a high child porn site is the best way to attract them. Most likely many of them have an unhealthy interest in this stuff, and line between "researcher" and paedophile is not always clear. The law does not make a distinction.
buster 11y ago
Nice article! I only "visited" the dark web once and was surprised and disgusted about the content, which was like 99% illegal, immoral shit. Did the FBI corporate with you? You said, you contacted them twice
merb 11y ago
Question: Didn't he need to host some illegal / immoral stuff to get some visitors around this topic. Somehow I question the "research".
cuillevel3 11y ago
Wow, I think this 'experiment' was highly unethical.
sgt 11y ago
So with pedophilia being a deviant behavior, yet relatively common through the ages, it doesn't seem like it's going away any time soon. Wouldn't legal computer generated child pornography be a potential solution? One could argue that this type of pornography would encourage pedophiles to seek out real girls, but then the same would apply for married men looking at porn. Do most of them seek out women in bars or escort services? I doubt that.

185 points by nkurz 11y ago

Is it just me, or the rhetorical question in the title ("why I now think Tor is the devil") never got answered? Also not clear whether the Dark Web spider project was just to later seed the honeypot sites to appear legit, or was it a project on its own? The quote "The reports are published nightly on a hacker-related Dark Web site that I am involved with" hints at the latter, and then I'd double don't understand why Tor would be the devil, if for other uses (hackers) the author is happy to take advantage of it? I'm a bit confused about what good does it do to reveal the exit node addresses? It has nothing to do with the actual Tor user, and could be even considered "public info" the way Tor is used, doesn't it?

nightpool 11y ago
Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes. I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though... EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.
- geek_slop 11y ago
  It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up. The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities. My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.
  - vfdva 11y ago
    "A knock on your door", ha! That's one way to put it.
  - girvo 11y ago
    But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.
  - aftbit 11y ago
    Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.
    - gizmo686 11y ago
      Although they could be made to run a packet sniffer, which could provide useful information.
      - utuxia 11y ago
        But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.
  - icehawk 11y ago
    The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.
- userbinator 11y ago
  I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high. I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.
  - htns 11y ago
    Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.
- vacri 11y ago
  > this is a fundamental tenant might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.
  - nightpool 11y ago
    huh, I guess I just always assumed they were homonyms. Thanks!
AdeptusAquinas 11y ago
I think the implication is its the devil because mostly Tor is used for pedophilic reasons - drugs, counterfeiting or political protest (I'd assume) are almost insignificant in comparison to pedophile traffic.
- tokenizerrr 11y ago
  I don't think that's true. The darknet drug markets are insanely popular, just take a look at https://www.reddit.com/r/darknetmarkets https://www.reddit.com/r/darknetmarkets for a small taste.
  - AdeptusAquinas 11y ago
    This is just based on what he said, which was based on what he observed from the traffic to his honeypots. Understandably you probably cant create a honeypot to gauge political activism so that might be hard to measure :D
- gwern 11y ago
  To expand ontokenizerrr's point, I read this as a big victory: > First, the pedo site saw magnitudes more traffic than the counterfeiting or drugs websites – in the order of 100 times more traffic than the other two combined. When someone wants to use the DNMs, they start at http://deepdotweb.com/ http://deepdotweb.com/ , http://thehub7gqe43miyc.onion/ http://thehub7gqe43miyc.onion/ , http://darknetmarkets.reddit.com/ http://darknetmarkets.reddit.com/ or http://www.gwern.net/Black-market%20survival http://www.gwern.net/Black-market%20survival ; these are curated community lists, which people use to avoid falling for phishing links and scams. Just look at the traffic stats for the one subreddit: https://www.reddit.com/r/DarkNetMarkets/about/traffic/ https://www.reddit.com/r/DarkNetMarkets/about/traffic/ ! DNM users do not start at a random .onion because that is a recipe for being the latest victim of 'Drug Market' and other longstanding onion scams. OP appears to have made no effort to get his honeypot into any of the standard sources of DNM info, and accordingly, he got no traffic. This is exactly as one would hope, and says more about how badly he bungled the drugs honeypot (and conversely, how pathetic the security of the pedo community is) than about any ratio of pedos to drug buyers. (This is a similar problem as the paper which counts .onions and argues that pedophiles are 99% or whatever of hidden-service traffic; the differing communities using hidden-services simply don't work the way that OP or that paper assumed for ease of making wild claims. Counting onion addresses does not work because the pedo sites tend to change onions constantly while the huge blackmarkets like Agora stick at a single onion like agorahooawayyfoe.onion for months or years; counting visits to a lame honeypot like OP's does not work because with no advertising, vetting, or sellers, no one would bother with his honeypot when they could use Agora, Nucleus, Abraxas, or other established markets with broad offerings.)
geek_slop 11y ago
The crawler project was a project on its own but after discovering that the many of the discovered sites were pedophile-related, I started to shut down the spider. Then I figured, what the heck, maybe I can hack around on Tor and see how close I can come to determining their real identity. For those that chose to run the scanner, their identity was revealed (name, IP, and enough of a hardware footprint to identify their machine).
jandrese 11y ago
It did seem a bit strange with "I created a pedo honeypot and gasp horror it attracted a bunch of pedos!!" The biggest thing he demonstrated is that a percentage of pedos would run an executable from some guy on Tor if he asks nicely. How can it be hard for the FBI to catch those guys?

methou 11y ago

I got a 403 error while accessing the site.

geek_slop 11y ago
Sorry, it's under an insane load right now. I fully expect to find a dead server when I wake up in the morning.

sarahj 11y ago

Some of the technical points of this article are simply wrong... > The exit node IP address of the user was easily obtained using the two different methods discussed briefly above. This is really not a vulnerability but simply how tor, and the internet at large, works - hidden services by design protect the service not the user (the user is protected by tor by default) - what the author actually did here was "leak" their non-hidden services IP. > and true external IP address (see partial data example to the above). And to answer the second question, “no”, this did not involve the placement of malicious malware. Read on… The author then goes on to state that they gave the users malicious malware to run which revealed their ip address. They justify that this was not malware by stating: > It should be noted that this was not malware per se. It did not replicate and was run voluntarily by the user. The user was notified that a “security scan” was going to be run on their machine and they freely chose to run the scan. The author then goes on to publish a list of tor exit nodes with tor user agents...which they could have gotten directly from the tor directory services... And, as pointed out by others, the author never really goes on to state why they think Tor is the devil - they built a honeypot and were disgusted by the flies it attracted....I'm not really sure what they were expecting...

jrcii 11y ago
The author appears to believe that "Tor is the devil" because "4,000-5,000 hidden services are running at any given time. Secondly, the content served by these sites is almost universally illegal or immoral (by my definition anyway). A conservative estimate would be maybe 1 out of 200 or so hidden service websites contain content I would deem worthy of the protection an anonymous network provides. Sites featuring free speech dumps or libraries of hard-to-find underground literature are few and far between on the Dark Web."
- MichaelCrawford 11y ago
  The vast majority of illegal or immoral content is not encrypted in any way. Giving the Finger to Vasha: Child Pornography on the Internet http://www.warplife.com/jonathan-swift/books/software-problem/deadly-sins/greed/pornography/child/internet/ http://www.warplife.com/jonathan-swift/books/software-proble... A straightford way to find many of those who profit from its distribution would be to use a bot to locate forum threads that go on for hundreds of pages.

kauffj 11y ago

> On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. The FBI twice rejecting a set of information that could have reasonably led to the arrest of several pedophiles seems like a big mistake.

nightpool 11y ago
"full sets of data" seem to include Tor exit node IP addresses (public information that you can obtain from the Tor directory service) and a few possible real IP addresses—but not ones he can directly tie to any actual CP. As he says, "Admittedly, after introducing the security scanner, traffic patterns changed. Scans on the server dropped and some of the users who opted to run the software appeared to be government or private researchers. Most visitors were reluctant to run the security scanner." Later he says that between 4 and 7 percent of his registered users ran the scanner. He never says how many registered users he had, and never said how many uploaded child porn or could be directly connected to it (and how many of those ran the scanner) I'm not surprised the FBI turned him down.
- geek_slop 11y ago
  I have already shut down the VM but I believe there were around 550-650 registered users in 14 days. Around 40-60 new registrations per day. Total registrations for counterfeiting+drugs sites: 8. Since the article went out, someone pointed out to me that one popular pedo .onion site has 90,000 registered users.
zxcvcxz 11y ago
Personally I'm glad some random guy can't hand off a whole bunch of IPs to the FBI and tell them they're all pedophiles. I'm sure it would cost thousands of dollars to sift through the data too, and would be pretty useless seeing as the guy wasn't hosting child porn. Besides, taking down these pedophiles might be "fun" to some people, but if you really want to help children you need to go after the people producing/hosting child pornography.
- 11y ago

zxcvcxz 11y ago

"pedophiles use encryption, so encryption is the devil." seems to be where this is going. That's a slippery slope and a bit unethical to use pedophiles to push an authoritarian political agenda. I bet it's fun to call all his critics pedophile sympathizers and sit upon a moral high-horse of self-righteousness while pushing his authoritarian ideology under the guise of social justice.. That's the thing about these people, they take on social issues for which they can't be criticized without the criticizer looking like a pedophile, racist, or a misogynist. I guess it gives them a sense of power.

userbinator 11y ago
Also terrorism and hackers (of the black-hat kind.) I've even been called one when I tried to argue against the proliferation of closed, walled-garden systems that seem so common today. That reminds me, Freenet has an interesting stance on this: https://freenetproject.org/faq.html#childporn https://freenetproject.org/faq.html#childporn
_asummers 11y ago
To be clear, Tor does not provide encryption but anonymization. While your comment is valid (and something I personally agree with) nonetheless, I feel this distinction is important.
- thelamest 11y ago
  For that purpose of anonymization it provides encryption, but with significant exceptions (non-hidden, non-HTTPS services) (when you use Tor correctly and can trust the PKI) (if I understand correctly).
anigbrowl 11y ago
You're projecting a great more than he did.
craigmccaskill 11y ago
Sadly this is where the UK government seems to be going [1]. They want all encryption to have a backdoor or be outlawed. [1] http://www.businessinsider.com/david-cameron-encryption-back-doors-iphone-whatsapp-2015-7?r=UK http://www.businessinsider.com/david-cameron-encryption-back...

athenot 11y ago

As a father of a little girl, this is a depressing read for me. Yes in the back of my mind I know this stuff is going on but it's really sad seeing the collection of data showing people who are partaking in this stuff. Also this gave me a nasty flashback of looking at filenames (never content) of deleted files in the process of gathering evidence against a family member who now sits on the registered sex offender list...

johnnycarcin 11y ago
Tell me about it. Awhile back as a reason to learn some new things I setup a Tor hidden service/page crawler and a basic search engine. For troubleshooting purposes (and to see how popular the site was) I was logging what was being searched for. After about a two weeks of having the site up I shut it down because 90% of the searches were for child porn. As a Tor supporter it was kind of eye opening. I guess though if you had the logs for Google you might see something similar...
- belorn 11y ago
  I suspect this is where the myth of 99% of the Internet is made out of porn comes from. It is very easy to get misleading statistics, especially if you have small sample size or where a minority of users are creating the majority of the collected data points. Add to this the amount of bots out there, and "false" data generated by police, federal investigators and interest groups doing the very thing people pay them to do, and you would really have to design the data collecting system in such a way that it identified who is doing the searching and what their usage patterns are. For example, If they return every hour on the hour, such result would likely be made by a bot, or if every search is extremely specific, it could very likely be an investigator doing work in a specific case. If I did this kind of research, I would contact professional investigators in order to work together and to collect search patterns so to exclude that kind of traffic.
- gambiting 11y ago
  Bear in mind that at least some of the "14 year old sex" searches are done by 14 year old children who do not know any better.

shruubi 11y ago

I must say, even reading the article made me feel quite uneasy. I can't imagine doing this myself, but if it leads to the capture of some pedophiles then I tip my hat to this person.

whatisup 11y ago

Smells like False Flag. https://en.wikipedia.org/wiki/False_flag https://en.wikipedia.org/wiki/False_flag

dvt 11y ago

It seems like the author is emotionally invested in this topic: > Given my circumstances, I have seen first-hand, the psychological damage a pedophile’s actions cause. The damage done to these children is permanent and no matter how much counseling and assistance they seek – the experience is forever embedded into their self, shaping (and sometimes limiting) what they become as adults. I can't pretend like I really get this because I've never dealt with pedophiles or pedophilia first-hand but I can agree, however, that people that hurt children are doing something morally wrong. With that said, this kinds of vigilante-esque behavior can be (and often times is) the absolute antithesis of justice. > On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. Since OP tried to approach the FBI on two different occasions, it doesn't really seem to me like this was merely an innocuous "security" experiment (like this one: http://www.tomsguide.com/us/spoiled-onions-tor-network,news-18237.html http://www.tomsguide.com/us/spoiled-onions-tor-network,news-...). It seems like OP really feels a deep hatred towards pedophiles and was, in a sense, out to get them. Thankfully, we have the justice system that handles this for us. These are people that try to be impartial, fair, and just. When accused, we have the court system -- a system that values innocence until proven guilt. I hope I won't be taken out of context here. I'm not defending pedophilia (or drug trafficking or murder -- a few other Tor commodities). Do you really feel compelled to "get the bad guys?" Great. Go to a police academy or go to law school. Real life isn't like a superhero graphic novel. The law, for the most part, works. More importantly, it provides some boundaries for those that enforce it. I had to read Mill's On Liberty in a Philosophy of Law class I took a few years ago and Chapter IV, Of the Limits to the Authority of Society over the Individual, really stuck with me. I would strongly suggest OP give it a good read: http://www.bartleby.com/130/4.html http://www.bartleby.com/130/4.html.

mikekchar 11y ago
I couldn't really finish reading the article. I hope the original author will realize that hanging on to his anger will only perpetuate the crimes committed against his daughter. His characterisation of permanent damage done to his daughter makes me wonder if she will ever be able to escape the trauma in his eyes. Will he be able to provide a safe place for her to go where people know about her past but care only about her present? If he thinks of her as having limited potential for the future, how will she escape that past? She needs a father, not an avenger. It's amazing the damage people can do chasing justice.

ikeboy 11y ago

> Had I been the FBI, they would have been caught. Considering that no actual files were made available for download, and many of the visitors were likely researchers, there wouldn't be enough to prosecute, but given the implied level of security the actual pedos were using, the FBI could just search their computers and would likely find enough evidence. >For instance, pedophiles form their own communities and within those communities, a sense of trust is developed. Or, pedos aren't drawn from the same population that knows how to do stuff securely, they just read a guide or two on how to use Tor. I'd assume you could get "4-7%" of many groups of people to download something and run it, that doesn't show that pedos necessarily are more trusting. (In fact, I'd expect higher numbers from random internet users, thus implying that pedos are less trusting, which I'd expect at a minimum given the fact that they can access Tor).

ThomPete 11y ago

Maybe it's just me but I don't really like the tendency to treat pedophiles as if they are the devils themselves. Let there be no doubt. I have two kids and there is probably no limit to what I would do to someone who did anything to my kids. But it's not as simply as just condemning pedophiles for being that and I ultimately think there is something morally or ethically questionable about this approach. It's fairly well established that many pedophiles where in fact victims of pedophilia in their childhood themselves and so I would like to see a less hysteric and more balanced response to the issue. Just because he is helping catching the bad guys does not give him the moral upper hand as he seem to think he has. Too bad such a complex issue gets treated with such brushing generalizations. Maybe I am reading too much into what he writes, but these honeypots to hit random people just feels wrong to me. Like snooping on someone else life.

allendoerfer 11y ago
> It's fairly well established that many pedophiles where in fact victims of pedophilia in their childhood themselves … Wouldn't that mean, that he is not only trying to catch pedophiles but actively curing pedophilia? I think what is going on in the US with the public shaming of offenders in databases is wrong, but I am fine with honeypots to catch them. Legally he is in no position to do so, of course.
- ThomPete 11y ago
  Maybe a few but he is also hurting someone who might just be watching and could destroy their lives completely. As I said it's not that simple. I find it all disgusting but these people need help not traps. They are humans not animals despite what we think of some of their actions.
  - allendoerfer 11y ago
    There is no "just be watching". If you watch a child getting raped, you are committing a crime and better have a very convincing argument why you had to do it. It is in fact that simple. Of course they need help, too. We need both prosecution and prevention.

api 11y ago

An interesting point I heard here I think, long ago... The fact that tor is full of stuff like kidporn is actually a positive commentary on our society. It means that almost everyone, even people with wildly unpopular views, feel comfortable discussing them in the open. Tor isn't full of manifestos and political texts because people don't feel the need to hide that stuff. I am sort of glad tor exists in spite of the nasty uses some put it to. It's like the modern equivalent of what having a well armed militia around was once supposed to achieve. It's like a backup system.

sgt 11y ago
Interesting point. Society can change though - and networks like Tor may be come increasingly important in the future.

InTheArena 11y ago

Probably condemning myself to eternal down-voting here, but some of the reactions here are depressing as fuck. There is no world in which this content is acceptable. The presence of this on TOR is not "good for society" in any way shape or form, and reveals that society can't be trusted with anonymous speech... Which is a really big problem, because there are a shit-ton of other problems that require anonymous speech.

sumitviii 11y ago
Internet is like a loud speaker. Just because some people can use it to communicate some profanities doesn't mean that it should be banned.

wodenokoto 11y ago

I didn't understand what he offers users that entices them to go to a higher level. At what point do users give up since there is no content on the website?

woah 11y ago

Wait... Is anyone else seeing this? The guy ran a crawler that visited many such illegal sites, then used stats on the number of visits that his honeypot got to draw conclusions about TOR. What is the standard of evidence that he is using? Seems like some weird methodology.

utuxia 11y ago

I don't think he understands how Tor works. Everything you visit on tor gets your exit node IP address. That's how it works.

nightpool 11y ago
Technically, because of how hidden services work in the tor architecture (both the service AND the user are hidden from each other) there's no "exit ip" when connecting to a hidden service, it just happens somewhere in the intermediary hops. (with the hidden service pretending that its just getting a response from somewhere up the chain) so what the author of this article was actually doing was just leaking his own IP. lol

foopants 11y ago

And how does he know the email addresses he published aren't from some clueless persons compromised gmail account?

AlyssaRowan 11y ago

Firstly, so - the writer is geek_slop? - let me get this straight about you?: · You adopted a girl at some point. · You are not law enforcement, and are not authorised by them in any way. · You disclose, here in this webpage, that you ran a hidden service site, via Tor, explicitly for paedophiles. · You have admitted the above, to the FBI. · You haven't considered what child protective services' post-adoptive services might think of your doing this? Um, I am a trifle concerned that you may have let your emotional investment get in the way of good research, or good sense, thinking this vigilantism through to its logical conclusion. Secondly, I think I'm enough of an expert on the topic of malware to say that the software, designed to cause a privacy breach upon whomever runs it and to disguise that purpose so that they may be tricked into running it voluntarily, is definitely malware: what is technically known as a "Trojan Horse", essentially doing the same job as the FBI's "CIPAV", but worse. Thirdly, I've spoken with law enforcement on this topic before, in the context of discussing anonymous networks like Tor. They are frequently displeased about vigilantes ruining their operations by doing shit like this - it makes the paedophiles more paranoid and careful, actively disrupting ongoing law enforcement investigations. Fourthly, it's not valid research. geek_slop doesn't appear to be familiar with how Tor actually works, in fact, they actually list the wonderful exit nodes they got, apparently unaware that the list of exit nodes is public and by design doesn't tell you anything at all about the visitors to your site. Web crawlers (including "Dark Web" - a wording which is another sign that the author does not have a strong background in anonymous networks - it's correctly "onion site" now, formerly "hidden service") naturally find related sites that link to each other, if you're going by links, which they might have done. If they're neutrally HSdir crawling, most of them are dead (because they're ephemeral services created by a P2P chat app?). We know all that from previous research (Dr Gareth Owen, University of Portsmouth, Tor Hidden Services and Deanonymisation, 31C3 https://www.youtube.com/watch?v=oZdeRmlj8Gw https://www.youtube.com/watch?v=oZdeRmlj8Gw ). Finally, this crawler might in fact be the exact same "dumb crawler" I previously identified as doing repeated HSdir directory service lookups (instead of caching) while refreshing paedophile sites, causing disproportionate load on the Tor network's HSdir services and strongly skewing Dr Owen's results on this topic (if it's not yours, it's probably IWF's). So, um, thanks for that.

mrsteveman1 11y ago

xorcist 11y ago

Numbering hidden services is something you publish papers on, and most researchers arrive at much larger numbers than 4000. But just as the author pulled numbers out of thin air (20 out the 4000 are deemed worthy of anonymity), 9 out of 10 paedophiles caught by him would turn out to be other researchers (or "researchers"). They are much more likely to run the spyware he offered. At any time, Tor is frequented by many like him. Some law enforcement, some working for child abuse organizations, some academia, and a lot of regular people with the same ambitions. Advertising a high child porn site is the best way to attract them. Most likely many of them have an unhealthy interest in this stuff, and line between "researcher" and paedophile is not always clear. The law does not make a distinction.

buster 11y ago

Nice article! I only "visited" the dark web once and was surprised and disgusted about the content, which was like 99% illegal, immoral shit. Did the FBI corporate with you? You said, you contacted them twice

merb 11y ago

Question: Didn't he need to host some illegal / immoral stuff to get some visitors around this topic. Somehow I question the "research".

cuillevel3 11y ago

Wow, I think this 'experiment' was highly unethical.

sgt 11y ago

So with pedophilia being a deviant behavior, yet relatively common through the ages, it doesn't seem like it's going away any time soon. Wouldn't legal computer generated child pornography be a potential solution? One could argue that this type of pornography would encourage pedophiles to seek out real girls, but then the same would apply for married men looking at porn. Do most of them seek out women in bars or escort services? I doubt that.