14 ms·
Feds bust through huge Tor-hidden child porn site using questionable malware
- dkopi 11y ago"The setup was seized in February 2015, but law enforcement allowed it to run for two additional weeks as a way to monitor its nearly 215,000 users." So the FBI was serving child porn for over 2 weeks to hundreds of thousands of users?
- awjr 11y agoIsn't this similar to allowing small time drug dealers to operate to get to the people at the top?
- syoc 11y agoNo. It's similar to FBI agents selling drugs themselves for two weeks and then bust everyone buying from them.
- rasz_pl 11y agoor ATF selling guns directly to crimina...oh, wait
- mikekchar 11y agoWhile I'm sure that's the rationale, I wonder if there is a difference. If the FBI seized drugs and then continued to sell them, isn't that against the law? If the FBI seized a computer and used to to distribute child porn wouldn't that also be against the law? I can see not seizing it and allowing the original operators to continue for 2 weeks. Does the FBI operate under different laws? For example, if I know my neighbour is hosting child porn on their computer and I wait 2 weeks to report them, probably I'm safe. If take his computer and host the files on the same machine for 2 weeks before handing it over to the police, I'm pretty sure I'd be arrested. What law is different for the FBI to be able to do that (if they did)?
- liviu- 11y ago> If take his computer and host the files on the same machine for 2 weeks before handing it over to the police Your example is different as you haven't gotten approval from the law enforcement authorities, like they claim to have gotten in the GP's quote. I'm sure that if you ask before acting upon it your chances of being arrested are a lot lower, and although they would probably revoke your request, they might allow someone else more apt for this (e.g. FBI)
- mikekchar 11y agoNot trying to be snarky, but I hope the justice system doesn't work so that to break the law all I have to do is get permission from the police... What I would like to know is what law allows them to make this kind of decision.
- escherize 11y agoThe government has guns and is allowed to use them morally. You aren't.
- ChristianBundy 11y ago> The government has guns and is allowed to use them.
- logfromblammo 11y agoAllowed by whom? The government. Ah. Well, I guess if it gives itself permission, that's okay then. We wouldn't want them to need consent of the governed or anything. They might say no!
- NullCharacter 11y agoCute cynicism, but you elect representatives who in turn appoint people to positions of authority. That's how this works. The laws are created and managed by people put into power by the governed. I understand that may go against your Freshman sociology 101 libertarian mantra, but the real world has already sorted this out and it tends to work pretty well.
- higherpurpose 11y agoOr even big time drug dealers: http://www.businessinsider.com/the-us-government-and-the-sinaloa-cartel-2014-1 http://www.businessinsider.com/the-us-government-and-the-sin...
- deleted 11y ago[deleted]
- Lawtonfogle 11y agoNo, because drug dealers are not directly harming people and they are running it. It would be like a murderer being given aid to murder more people while they go after the people at the top. Which is horrendous. And which, if I remember correctly, has happened.
- danieltillett 11y agoI am wow that there were 215,000 users! How many of these people have been charged?
- okasaki 11y agoThe authorities have a tendency of being creative with numbers. It could mean anything really. Maybe they received 215k GET requests.
- thefreeman 11y agoDo you really have a problem with that? They didnt make the porn. It's not like removing it would prevent it from being made in the first place. They were capturing information on additional pedophiles. In what world are you trying to frame that as wrong.
- dkopi 11y agoDo the ends justify the means? If you're okay with the FBI running a child porn server, are you okay with the FBI creating a child porn server? How about the FBI creating its own child porn, just to catch pedophiles? How about the FBI selling drugs just to catch drug users?
- neotek 11y agoYour slippery slope is ludicrous, like when homophobes insist gay marriage will lead to people being allowed to marry their pets.
- thefreeman 11y agoYou are grasping at straws. Yes I am OK with the FBI temporarily leaving a child porn server up to capture more pedophiles. No I am not OK with the FBI creating child porn. Use your brain. These aren't even close to the same thing.
- Lawtonfogle 11y agoYet the whole reason it is illegal to possess is because possession is considered a direct act of harm against a child comparable to (though not as severe as) production.
- emergentcypher 11y agoIt doesn't matter who made it. We consider distributing it to be a horrendous crime and yet here's the FBI, distributing it. Next you'll say that the FBI should be commissioning terrorist attacks in order to bring in more terrorists. Oh, wait...
- 11y ago
- mirimir 11y agoThis is reminiscent of the 2013 takedown of Freedom Hosting.[0,1] Exploiting a JavaScript vulnerability in Firefox, compromised sites dropped a Windows executable (“Magneto”) which phoned home (bypassing Tor) with the user's MAC address and hostname. Gareth Owen identified it as EgotisticalGiraffe,[1] which is an NSA tool.[2] [0] http://resources.infosecinstitute.com/fbi-tor-exploit/ http://resources.infosecinstitute.com/fbi-tor-exploit/ [1] https://ghowen.me/fbi-tor-malware-analysis/ https://ghowen.me/fbi-tor-malware-analysis/ [2] http://www.theguardian.com/world/interactive/2013/oct/04/egotistical-giraffe-nsa-tor-document http://www.theguardian.com/world/interactive/2013/oct/04/ego... Edit: Rereading, I see: >The NIT exploit bypassed Tor by creating a direct socket connection that eschews Tor's routing—in this particular case, by using a Flash component. This functionality, the experts noted, was identical to Metasploit's decloaking code. Anonymous used the Metasploit code in a previous attack on Freedom Hosting. Both vulnerabilities used against Freedom Hosting have long been patched. I wonder what vulnerability this takedown exploited. One of the Hacking Team ones, maybe?
- NullCharacter 11y agoEr, no, since the whole HT leak happened within the last two weeks and this operation took place mostly between 2014 and early 2015. You give the Government wayyyy too much credit if you think it can go from leaked exploit to arrests generated from said leaked exploit within a two week period. The process, like all processes quagmired in bureaucracy, takes months.
- mirimir 11y agoMaybe the FBI and Hacking Team had overlapping sets of exploits. Is there double selling by exploit dealers?
- noonespecial 11y ago...the defense expert investigators wrote that they "do not consider the NIT to be 'hacking'" because the NIT "exploited a configuration setting that did not require offensive-based actions." But you'll get maliciously prosecuted for guessing a sequential URL and typing it into your address bar thanks to CFAA...
- vog 11y agoIndeed, these are double standards at its best.
- RexRollman 11y agoDo as I say, not as I do.
- user_0001 11y agoWhich everyone who has ever had to take care of someone has said, in the history of caring, ever
- a3n 11y agoI'm very explicit about telling my kid exactly that. I point out his behavior, I point out how I sometimes do almost exactly that, what's bad about it, and I remind him that just because I do something doesn't make it right. Because I'm not setting switches on my son module, I'm trying to influence a human being toward a good direction, despite my failings. I think it's working.
- x5n1 11y agoThe law does not have to abide by the law, only has to appear to do so. Case in point, parallel reconstruction.
- dragonwriter 11y ago> The law does not have to abide by the law, only has to appear to do so. Given that weev's conviction was overturned for the prosecution not abiding by the law, while that may be true in some abstract sense, it doesn't seem particularly relevant to weev's case.
- omginternets 11y agoI'm both thrilled that child-porn distributors are standing trial, and utterly dismayed that people use Flash on Tor.
- SXX 11y agoFreaks don't automatically become cyber crime experts. Otherwise they'll likely be using browser inside VM that only have access to TOR proxy and no connection to real internet.
- omginternets 11y agoThe Tor Browser Bundle is plainly and loudly advertised on the Tor homepage as being the Right Way of internetting anonymously. You don't have to be a cyber crime expert to get this particular thing right.
- mirimir 11y agoIt's not that simple. Using the Tor browser bundle, there is no protection against phone-home exploits outside the browser. Firewall rules would prevent them, but that's up to users. Far better is to use Whonix Tor gateway and workstation VMs in VirtualBox. The workstation VM has no Internet connectivity except via Tor running in the gateway. Using the Tor browser bundle in Windows is especially risky. The FBI has relied on Firefox bugs and dropped Windows executables. In the Freedom Hosting case, the FBI used a Firefox vulnerability that had just been patched in Tor browser a week or so before.
- omginternets 11y ago>Using the Tor browser bundle, there is no protection Of course not, which is precisely why running Flash is ludicrously stupid. Nobody is claiming that the "victims" of these other exploits are stupid -- just the ones who installed and used Flash (and probably had to deactivate noscript in the process). And more to the point, any remotely reasonable person will RTFM (at least superficially) before using a tool to do something highly illegal. Not doing so is the very definition of stupid.
- belorn 11y agoIf one were to take a look in the long run, what does it mean to the software industry as a whole that bugs are being exploited by script kiddies to mess around, protesters who want to block access in order to raise awareness, criminals that want to steal money or trade illegal content, police that want to catch criminals, secret police that want to keep track of everything a population does, spies that want to keep track of everyone, and military that simply want to break things and take down the bad guys. Each and everyone depends on the same software bugs being unpatched and kept a secret.
- fweespeech 11y agoRegardless of the cause, is anyone else considered with the legal precedents they are setting to catch pedophiles and drug dealers? Legally, there is no real difference between doing this to catch those sorts of people and doing it to de-anonymize whistleblowers under the guise of "National Security" who use Tor to relay such information to the press. :/
- NullCharacter 11y agoYou're absolutely right. Legally there is absolutely no difference between busting pedophiles on Tor and busting "whistleblowers" talking to the press, legally speaking. No difference. It's legally the exact same.
- fweespeech 11y agoThe mechanism used to justify seizing Lavabit's SSL keys and this is the same, despite your sarcastic comment.
- jebblue 11y agoI'm glad they busted them but hopeful that using the technology to stop clearly bad guys does not lead to abuse of the ability to use the technology on a wider basis. It probably will though eventually. It would be great if use required the consensus of at least three courts and one of them federal.
- joshstrange 11y agoSemi-related question: If I write a spider for Tor and my spider collects CP (NOT by design but just in the course of spidering) how responsible am I for: * Having that data in my DB * Showing said site in search results I assume the answer is something like: "You're not as long as when you do notice it you report it and then delete it off your servers (Maybe also blacklist the Tor URL so it doesn't get re-spidered/indexed). I haven't written anything to do this but the concept is extremely interesting to me but I'd hate to write something, let it run, forget about it (keeping it running or just holding on to the data if I ever want to do something with it), and then getting in trouble down the line for having CP or other illegal material. I've tried googling for this but couldn't find anything good. TL;DR: Are search engines (On the web or Tor) responsible for the content of the sites they index