Slashdot Mirror
Feds Say NSA "Bogeyman" Did Not Find Silk Road's Servers
An anonymous reader writes The secret of how the FBI pinpointed the servers allegedly used by the notorious Silk Road black market website has been revealed: repeated login attempts. In a legal rebuttal, the FBI claims that repeatedly attempting to login to the marketplace revealed its host location. From the article: "As they typed 'miscellaneous' strings of characters into the login page's entry fields, Tarbell writes that they noticed an IP address associated with some data returned by the site didn't match any known Tor 'nodes,' the computers that bounce information through Tor's anonymity network to obscure its true source. And when they entered that IP address directly into a browser, the Silk Road's CAPTCHA prompt appeared, the garbled-letter image designed to prevent spam bots from entering the site. 'This indicated that the Subject IP Address was the IP address of the SR Server,' writes Tarbell in his letter, 'and that it was "leaking" from the SR Server because the computer code underlying the login interface was not properly configured at the time to work on Tor.'"
At least that is what they are saying... did they capture SR server logs confirming the mis-configuration at the time?
This issue is a bit more complicated than you think.
... as long as there is no resourceful federal agency trying to get you.
Linux is for people who don't mind RTFM.
In other words: perjury, but you can't prove it.
Could someone elaborate on how a captcha would leak an IP address? They weren't using something like re-captcha were they?
Back in 2006 it was already out that the NSA was sharing information with the FBI among others:
http://www.washingtonpost.com/...
With multiple leaders of the U.S. intelligence apparatus having been caught lying under oath, we'll never know. One of the techniques is for the NSA to pinpoint something then the FBI look at the target and find something else they can label as the "reason" they found out about it.
At this point, because of our government's shortsighted decision's (Bush/Obama) to pursue and institute a surveillance state (ala East Germany), we'll never know what the story was here and have to take any claim from the Feds with a huge dose of skepticism.
https://www.nikcub.com/posts/a...
If you still believe that the server was discovered in the way the FBI described it - try it. I did. I setup a virtual machine with a web server running a Tor hidden server. I then accessed the hidden server over Tor and looked at the traffic. No matter how much I intentionally misconfigured the server, or included scripts from clearnet hosts, I never observed traffic from a non-Tor node or a "real" IP address.
Recently there was this story about NSA guys leaking Tor bugs to devs and suggesting changes to "improve" Tor's design:
http://yro.slashdot.org/story/...
I vividly remember that Snowden's documents said that NSA tries to influence Tor's design, being unable to actually break it. This might be a way of doing it: they pretend to be "good guys" and suggest changes that, while removing purely theoretical vulnerabilities, actually open the doors to more serious ones.
I hope Tor developers aren't so foolish to follow those "suggestions".
Comment removed based on user account deletion
Stick a php_info in your code or something equivalent. I don't believe the FBI was claiming that they received traffic from a non-tor IP, but rather that they received an IP address somewhere in the data sent over tor.
Nothing in tor prevents you from sending your name, address, and social security number in the html of a webpage that you serve. If I wanted to depend on a website remaining anonymous over tor I'd probably stick the entire thing on a private network (with private IPs) such that none of the machines ever contained identifying information (including traceable machine IDs or MACs/etc), heavily firewall it, and carefully control that nothing goes out except via tor. I'd treat every device on the network as if it were compromised and intentionally trying to communicate out every bit of data stored within, so it would be essential that none of these devices contain any information worth stealing.
It's not about a server misconfiguration.
TOR connections are tunnels. You don't have to configure your webserver etc for TOR, your machine just has to behind a firewall etc that doesn't allow the traffic out (or really, a router that just doesn't NAT it in). The only way to access the webserver would be through the tunnel, so no TOR=no access.
I find it a bit hard to believe that a guy who is able to get one of the largest black-market enterprises running on a server/farm connected to an anonymous/decentralized network isn't smart enough to *not* give it a public IP and/or put the equivalent to a home internet router in front of it.
Tor makes you a target.
> I find it a bit hard to believe that a guy who is able to get one of the largest black-market enterprises running on a server
Do you find it hardto believe that Paypal's engineers make significantly more obvious mistakes? They do, of course. The thing about crime, and security, is that you can do a hundred things just right, and be taken down by the one thing you missed. It's adversarial like sports, but unlike sports 47-2 is a losing score for the team who scored 47. Those two items on which you let the authorities score put you in prison.
How many sites out there are HTTPS but deliver some data via HTTP by mistake or oversight? Looks like that applies here too. Good job tracking this down. Plain old inspecting what your receiving and digging into it.
So then why does anyone care if the FBI is lying about how they busted them? I mean, these same sort of illegal procedures are practiced at all levels of law enforcement, and yet when Tyrone gets busted for allegedly selling crack-cocain (conspiracy charges) no one cares.
We have discovered so many lies from various LEAs and NSA about parallel construction (they even lie to judges and prosecutors) that it is impossible to believe them without iron-clad evidence at this point.
Perhaps they'd care to show us the code? Show us the log of the exploit? Bare assertions won't do.
Fair enough, but shouldn't the source of the data have been revealed during discovery phase to the defense?
That'd be one useless network though. If your devices have no information worth stealing - than what are they doing?
That's the problem with anonymity (and security in general). To be perfect, it's got to have no value.
In a more practical case like this one, I fully expect that administrators of those servers made one small mistake (more likely simply could not check every possible bit of code for information it may leak) and that was their downfall.
I find it a bit hard to believe that a guy who is able to get one of the largest black-market enterprises running on a server/farm connected to an anonymous/decentralized network isn't smart enough to *not* give it a public IP and/or put the equivalent to a home internet router in front of it.
People make mistakes all the time. Even smart people.
You've never made a mistake? Never missed a bug? Never misconfigured a system? Ever?
Do a hundred things right, and one thing wrong, and just guess which one will get caught.
http://www.geoffreylandis.com
this is what Tails tries to do.
Really you could just run tor on a vm and then setup all client machines on the LAN to VPN into it. then set each client's firewall to drop any traffic to any interface except tun/tap.
You could also run dansguarian+squid on that tor vm to sniff for and catch reg-ex's that look like your public IP or PII.
There is a difference between no identifying information, and no information.
Rips of DVDs, for example, would be information - but they would not contain any identification other than the program used to make them, and the DVDs in question.
They cared enough to use Tor but not enough to configure their firewall?
Well, in their case they are running a storefront. That has a few components.
1. You need a searchable catalog of stuff that you are selling, and the ability to put together orders. That isn't too sensitive up until you checkout since your goal is to advertise the catalog anyway.
2. You need to be able to collect info on where to ship the goods. This is sensitive information if you don't want people figuring out who your customers are. You can't avoid collecting this info from your customers, but you could control storage of it. The first time somebody sets up an account you could collect info from them, but then you could take that data off the network and just reference their account number inside the network. As long as the customer sticks with the same delivery address and doesn't care that the order doesn't show it, then their info could be safe from compromise a few days after their first order.
3. You need to handle payment. Since they traded in Bitcoin this also could be done in a way that doesn't eliminate the risk of problems, but it does greatly mitigate it. For each transaction create a bitcoin account, and the tor-connected network can provide those details to the client so that they can make payment. At that point you can remove that data from the tor-connected network and move it elsewhere. That means that if somebody gets onto the network they can only get your bitcoin credentials for a few days worth of transactions, and future transactions going forward. Money would be moved out of those accounts into another set of accounts whose credentials were never at risk as soon as it was received, so if there were an attempt to seize funds it would be limited to accounts that only received funds recently.
All the order fulfilment can happen off of the tor-connected network. Getting data between the networks could involve sneakernet, or maybe even manual printing of paper orders. An operation like Silk Road is no doubt very high-margin, and I can't imagine that they can operate at high volume without risk of detection. So, a manual process where tor tells you ship 2kg of product A to customer 123 just means punching 2, A, and 123 into another application which prints out the shipping label - that system doesn't need to be attached to the internet. Dealing with bitcoin account numbers and credentials might be more of a pain, since they are long numbers.
Now TOR (or whom ever) can fix it.
"If any question why we died, Tell them because our fathers lied."
Now put some flash on your website. something that does network connectivity and test again. there are plenty of stupid things to do with a web site. or have mole put these in a web site on purpose. please re-read what you need to disable to keep you anonymity. -shrugs-
the public eye: This post up. do and doing what up today! If you guys are usually is dying and its and abroad for EFNet, and apply the above is far Usenet is roughly own lube, beverage, problems that I've IF YOU HAVE halt. Even Emacs BSD's filesystem to work I'm doing, where it was when fatal mistakes, Mr. Raymond's project returns goodbye...she had most. Look at the BSD style.' In the I've never ssen FreeBSD showed Can no longer be
My understanding of TOR is that the server never sees the client's real IP address. That's the whole idea, right? Then how the hell can a misconfigured server send anything directly to an IP address it doesn't have?
I call BULLSHIT!
Oh, I wouldn't just worry about flash. I'd assume that somebody I don't like is going to find an exploit in my webserver, and run arbitrary code on that host, and every other host it can reach via the network. All of this stuff has to run in a DMZ that contains no identifying information at all. That is certainly a challenge to do in practice.
For every lie NSA gets printed on the news...
The thing about writing the website or configuring the system to tunnel data through any kind of proxy/tor is that for every packet or http request or whatever you work with you have to EXACTLY specify what happens as in what comes in and what goes out, the lie is just too retarded.
I've made like a dozen network backends for different kinds of applications and progarms. I know.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Where a group of FBI boffins are cheering, hooting and hollering about the find, and a group of NSA boffins, rolling their eyes and being coy, "Awe! Look at them, you'd think they just broke codes!".
The NSA and the feds are well known to do "parallel contruction", and you can be sure they won't tell you how they really did it if they have in their possesion an unknown secret security flaw. Why even consider trusting anything they say after it has come to light that they do "parallel-construction". We can't trust them anymore, whatever they say.
I don't believe that the long-term op of Silk Road would be stupid enough to send his identifying information in the html of a wepage. They probably had other ways to do it and are leading everbody on as usual.
"An operation like Silk Road is no doubt very high-margin, and I can't imagine that they can operate at high volume without risk of detection."
This sounds like someone thinks Silk Road is more like Amazon when in fact it is more like eBay than Amazon. So the volume of "Silk Road" depends on the number of sellers and the volume of each seller to the buyers. SR was (is) just a web site to connect buyers with sellers and it in itself does not do order fulfillment.
(And no, I haven't used it to buy or sell ever).
Check out https://openbazaar.org/ for a more decentralized version of eBay (or SR for that matter).
Because you're a cunt. You personally. Is the answer to all of your questions.
I've been thinking about this over the last few days, ever since the story popped up in wired.
If they exceed the captcha's rate limit, the captcha -might- leak information in its rate-limiting error message. The message would be something like "your server at IP has exceeded its request limit."
This is likely because if you exceed the rate limit you'd kind of want to know which one of your front-ends was be the bad one.
Nobody really would test that sort of thing either.
Ah, in this case it is even easier to anonymize then, assuming you don't care about the buyers or the sellers. Just store all the data on the servers with nothing identifying, and the only thing you have to deal with is getting the listing fees off the site.
I'll confess I don't know a great deal about the Silk Road, as I've never visited the site.
My example was contrived. The point is that tor doesn't prevent you from leaking identifying info. There are LOTS of ways this can happen, including:
1. Some application happens to embed a non-private IP in the data stream (maybe in a header or something). This is a classic problem if you try to run bittorrent over tor.
2. Somebody manages to run arbitrary code on your server via an exploit and this code has access to identifying information, such as a non-private IP, mac address, or just the ability to send packets to the internet (which can be sent to a server controlled by the attacker revealing the source IP).
Neither of these requires NSA-like capabilities to pull off, or the ability to defeat tor in general.
try replying to the guy that actually said that next time.
Doubts cast over FBI 'leaky CAPTCHA' Silk Road rapture - Security bod says affadavit makes no sense, omitted exploitation works
Who would be so stupid to run a server like that without masquerading? That is not credible at all. A simple masquerading firewall before the actual server makes sure that a) no non-TOR traffic ever reaches or leaves the actual server and b) the server itself does not know the public IP it is reachable under. This is really basic protection and set up withing a few hours. It also makes sure nothing like the FBI claims can ever happen.
The only sensible explanation is that the FBI is lying through its teeth.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Did the Feds have a warrant for searching this particular server? Quote the 4th Amendment:
... and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Did they have a warrant specifically describing the place to be searched, and the persons or things to be seized?
If not, they were violating the CSRA, by accessing a server without authorization, which is exactly what they tried to charge Aaron Schwarz with.
It is not permissible to break the law in order to enforce the law. This is a principle older than the United States itself.
Paypal engineers do not go to prison for an extended period of time when they are caught. Paypal engineers are also the cheapest possible that can just about get the job done.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
> Paypal engineers do not go to prison for an extended period of time when they are caught.
Neither does the script monkey that Ulbricht hired to set up the captcha.
He had a huge criminal enterprise to run, tons of money to launder, murders to order, and hopefully he'd make some time to enjoy his ill-gotten gains before he eventually made a mistake and got busted. If he was wasting his time setting up a captcha, that was pretty stupid. The smart thing would be for him to have someone eho understands banking and finance take care if the banking and finance, someone who understands programming take care of the programming, someone who understands high-capacity server infrastructure take care of the server infrastructure, ehile he ran the whole operation and spent some time on his boat. Actually, not really. He was successful before silk road,so the smart thing to do would have been to continue to make money legally. That has the advantage of not ending with a prison sentence.
pretty sure AC repeats post - and is +5 insightful, while original post is 0? WTF? view at -1 to see this post...
The IP will probably be revealed as being 127.0.0.1.
The judge will accept it as evidence, and the jury will convict because we are still living in a society of imbeciles trying to impose on how everyone should live under the premise that they know better as a collective decider.
We are destroying basic human rights and severely punishing people simply so we can "show them a better path" in life.
It's absurd. Why can't we just close all these ineffective branches of government fighting pseudo crimes already?
Given it is a criminal enterprise it makes no sense for him to go out hiring people to do programming, infrastructure, banking, finance etc as the more people he has to deal with the more people that can be compromised or just blab. The is a saying along the lines of "if you don't want anyone to find out your secrets then don't tell anyone". Master of your own destiny and all that.