3 ms·

Is it just me, or the rhetorical question in the title ("why I now think Tor is the devil") never got answered? Also not clear whether the Dark Web spider proj

by imrehg 11y ago

Is it just me, or the rhetorical question in the title ("why I now think Tor is the devil") never got answered? Also not clear whether the Dark Web spider project was just to later seed the honeypot sites to appear legit, or was it a project on its own? The quote "The reports are published nightly on a hacker-related Dark Web site that I am involved with" hints at the latter, and then I'd double don't understand why Tor would be the devil, if for other uses (hackers) the author is happy to take advantage of it? I'm a bit confused about what good does it do to reveal the exit node addresses? It has nothing to do with the actual Tor user, and could be even considered "public info" the way Tor is used, doesn't it?

nightpool 11y ago
Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes. I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though... EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.
- geek_slop 11y ago
  It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up. The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities. My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.
  - vfdva 11y ago
    "A knock on your door", ha! That's one way to put it.
  - girvo 11y ago
    But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.
  - aftbit 11y ago
    Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.
    - gizmo686 11y ago
      Although they could be made to run a packet sniffer, which could provide useful information.
      - utuxia 11y ago
        But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.
  - icehawk 11y ago
    The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.
- userbinator 11y ago
  I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high. I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.
  - htns 11y ago
    Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.
- vacri 11y ago
  > this is a fundamental tenant might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.
  - nightpool 11y ago
    huh, I guess I just always assumed they were homonyms. Thanks!
AdeptusAquinas 11y ago
I think the implication is its the devil because mostly Tor is used for pedophilic reasons - drugs, counterfeiting or political protest (I'd assume) are almost insignificant in comparison to pedophile traffic.
- tokenizerrr 11y ago
  I don't think that's true. The darknet drug markets are insanely popular, just take a look at https://www.reddit.com/r/darknetmarkets https://www.reddit.com/r/darknetmarkets for a small taste.
  - AdeptusAquinas 11y ago
    This is just based on what he said, which was based on what he observed from the traffic to his honeypots. Understandably you probably cant create a honeypot to gauge political activism so that might be hard to measure :D
- gwern 11y ago
  To expand ontokenizerrr's point, I read this as a big victory: > First, the pedo site saw magnitudes more traffic than the counterfeiting or drugs websites – in the order of 100 times more traffic than the other two combined. When someone wants to use the DNMs, they start at http://deepdotweb.com/ http://deepdotweb.com/ , http://thehub7gqe43miyc.onion/ http://thehub7gqe43miyc.onion/ , http://darknetmarkets.reddit.com/ http://darknetmarkets.reddit.com/ or http://www.gwern.net/Black-market%20survival http://www.gwern.net/Black-market%20survival ; these are curated community lists, which people use to avoid falling for phishing links and scams. Just look at the traffic stats for the one subreddit: https://www.reddit.com/r/DarkNetMarkets/about/traffic/ https://www.reddit.com/r/DarkNetMarkets/about/traffic/ ! DNM users do not start at a random .onion because that is a recipe for being the latest victim of 'Drug Market' and other longstanding onion scams. OP appears to have made no effort to get his honeypot into any of the standard sources of DNM info, and accordingly, he got no traffic. This is exactly as one would hope, and says more about how badly he bungled the drugs honeypot (and conversely, how pathetic the security of the pedo community is) than about any ratio of pedos to drug buyers. (This is a similar problem as the paper which counts .onions and argues that pedophiles are 99% or whatever of hidden-service traffic; the differing communities using hidden-services simply don't work the way that OP or that paper assumed for ease of making wild claims. Counting onion addresses does not work because the pedo sites tend to change onions constantly while the huge blackmarkets like Agora stick at a single onion like agorahooawayyfoe.onion for months or years; counting visits to a lame honeypot like OP's does not work because with no advertising, vetting, or sellers, no one would bother with his honeypot when they could use Agora, Nucleus, Abraxas, or other established markets with broad offerings.)
geek_slop 11y ago
The crawler project was a project on its own but after discovering that the many of the discovered sites were pedophile-related, I started to shut down the spider. Then I figured, what the heck, maybe I can hack around on Tor and see how close I can come to determining their real identity. For those that chose to run the scanner, their identity was revealed (name, IP, and enough of a hardware footprint to identify their machine).
jandrese 11y ago
It did seem a bit strange with "I created a pedo honeypot and gasp horror it attracted a bunch of pedos!!" The biggest thing he demonstrated is that a percentage of pedos would run an executable from some guy on Tor if he asks nicely. How can it be hard for the FBI to catch those guys?

by imrehg 11y ago

nightpool 11y ago

Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes. I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though... EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.

geek_slop 11y ago
It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up. The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities. My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.
- vfdva 11y ago
  "A knock on your door", ha! That's one way to put it.
- girvo 11y ago
  But most Tor users, especially the ones who are using it for disgusting purposes don't run an exit node, so I don't think I understand your point? In addition, Tor exit node IPs are basically public info already.
- aftbit 11y ago
  Here you go, all Tor exit nodes: https://check.torproject.org/exit-addresses https://check.torproject.org/exit-addresses The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.
  - gizmo686 11y ago
    Although they could be made to run a packet sniffer, which could provide useful information.
    - utuxia 11y ago
      But the traffic between nodes is encrypted. All they may get is the previous node's IP address....then they have to start over. Go find that node operator and get them to do the same.
- icehawk 11y ago
  The exit node IP is run by an unrelated third party. Unless they're logging all of the traffic going through the exit node they have an extremely limited idea of what the exit node is doing.
userbinator 11y ago
I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high. I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.
- htns 11y ago
  Another thing is that Tor is global. People might not think twice about their security when they are effectively within the law or at worst may get a fine.
vacri 11y ago
> this is a fundamental tenant might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.
- nightpool 11y ago
  huh, I guess I just always assumed they were homonyms. Thanks!

AdeptusAquinas 11y ago

I think the implication is its the devil because mostly Tor is used for pedophilic reasons - drugs, counterfeiting or political protest (I'd assume) are almost insignificant in comparison to pedophile traffic.

tokenizerrr 11y ago
I don't think that's true. The darknet drug markets are insanely popular, just take a look at https://www.reddit.com/r/darknetmarkets https://www.reddit.com/r/darknetmarkets for a small taste.
- AdeptusAquinas 11y ago
  This is just based on what he said, which was based on what he observed from the traffic to his honeypots. Understandably you probably cant create a honeypot to gauge political activism so that might be hard to measure :D
gwern 11y ago
To expand ontokenizerrr's point, I read this as a big victory: > First, the pedo site saw magnitudes more traffic than the counterfeiting or drugs websites – in the order of 100 times more traffic than the other two combined. When someone wants to use the DNMs, they start at http://deepdotweb.com/ http://deepdotweb.com/ , http://thehub7gqe43miyc.onion/ http://thehub7gqe43miyc.onion/ , http://darknetmarkets.reddit.com/ http://darknetmarkets.reddit.com/ or http://www.gwern.net/Black-market%20survival http://www.gwern.net/Black-market%20survival ; these are curated community lists, which people use to avoid falling for phishing links and scams. Just look at the traffic stats for the one subreddit: https://www.reddit.com/r/DarkNetMarkets/about/traffic/ https://www.reddit.com/r/DarkNetMarkets/about/traffic/ ! DNM users do not start at a random .onion because that is a recipe for being the latest victim of 'Drug Market' and other longstanding onion scams. OP appears to have made no effort to get his honeypot into any of the standard sources of DNM info, and accordingly, he got no traffic. This is exactly as one would hope, and says more about how badly he bungled the drugs honeypot (and conversely, how pathetic the security of the pedo community is) than about any ratio of pedos to drug buyers. (This is a similar problem as the paper which counts .onions and argues that pedophiles are 99% or whatever of hidden-service traffic; the differing communities using hidden-services simply don't work the way that OP or that paper assumed for ease of making wild claims. Counting onion addresses does not work because the pedo sites tend to change onions constantly while the huge blackmarkets like Agora stick at a single onion like agorahooawayyfoe.onion for months or years; counting visits to a lame honeypot like OP's does not work because with no advertising, vetting, or sellers, no one would bother with his honeypot when they could use Agora, Nucleus, Abraxas, or other established markets with broad offerings.)

geek_slop 11y ago

The crawler project was a project on its own but after discovering that the many of the discovered sites were pedophile-related, I started to shut down the spider. Then I figured, what the heck, maybe I can hack around on Tor and see how close I can come to determining their real identity. For those that chose to run the scanner, their identity was revealed (name, IP, and enough of a hardware footprint to identify their machine).

jandrese 11y ago

It did seem a bit strange with "I created a pedo honeypot and gasp horror it attracted a bunch of pedos!!" The biggest thing he demonstrated is that a percentage of pedos would run an executable from some guy on Tor if he asks nicely. How can it be hard for the FBI to catch those guys?