Slashdot Mirror
An FBI Hacking Campaign Targeted Over a Thousand Computers (vice.com)
derekmead writes: In order to fight what it has called one of the largest child pornography sites on the dark web, the FBI hacked over a thousand computers, according to court documents reviewed by Motherboard and interviews with legal parties involved.
Just a month after launch, a bulletin board called Playpen had nearly 60,000 member accounts. By the following year, this number had ballooned to almost 215,000, with over 117,000 total posts, and an average of 11,000 unique visitors each week. Many of those posts, according to FBI testimony, contained some of the most extreme child abuse imagery one could imagine, and others included advice on how sexual abusers could avoid detection online.
But after Playpen was seized, it wasn't immediately closed down, unlike previous dark web sites that have been shuttered by law enforcement. Instead, the FBI ran Playpen from its own servers in Newington, Virginia, from February 20 to March 4, reads a complaint filed against a defendant in Utah. During this time, the FBI deployed what is known as a network investigative technique (NIT), the agency's term for a hacking tool.
Just a month after launch, a bulletin board called Playpen had nearly 60,000 member accounts. By the following year, this number had ballooned to almost 215,000, with over 117,000 total posts, and an average of 11,000 unique visitors each week. Many of those posts, according to FBI testimony, contained some of the most extreme child abuse imagery one could imagine, and others included advice on how sexual abusers could avoid detection online.
But after Playpen was seized, it wasn't immediately closed down, unlike previous dark web sites that have been shuttered by law enforcement. Instead, the FBI ran Playpen from its own servers in Newington, Virginia, from February 20 to March 4, reads a complaint filed against a defendant in Utah. During this time, the FBI deployed what is known as a network investigative technique (NIT), the agency's term for a hacking tool.
They weren't hacking. They were obtaining the IP address of connected machines who were using Tor to access child porn sites. I just call that good investigation. Your IP address isn't private information, just like your postal address isn't.
This sort of thing makes you wish they had used the other type of hacking.
Bit of a slippery slope when Law Enforcement is breaking laws to catch criminals. This is not good policing in my opinion. There should be no excuse for breaking the law, especially in an effort to enforce the law. Law enforcement should never be 'do as I say, not as I do.'
A simple test is.. if a citizen did this to another citizen, would that be against the law? Last I checked, hacking your neighbors computer and collecting information from it is definitely against the law. (Unless you're Microsoft and say you're going to do it in your EULA, bit that's a different can of worms.)
The issue was did this one warrant let the government hack into everyone who tried to use Tor to connect this hidden site. Tor prevented the FBI from determining their IP address without further attacks on individual computers. The other issue is if the Judge knew they were authorizing this many computers to possibly be hacked.
I believe they waited until the user tried to login, create an account, or something like that, so just accidentally browsing to the site shouldn't have triggered the attack.
From the facts I have from this article, I think the FBI did the right thing.
There are over 3 billion Internet users. The number that accessed these sites is a small fraction of Internet users. A small fraction of the public are pedophiles, and a significant portion of them probably seek out these sites in order to fulfill their deviant behavior, since it is so easy to obtain via the Internet. What i don't get it how an adult can find children sexually attractive. There are no normal cues that trigger sexual interest. I just feel sorry for the exploited children.
It's all about the percentages, not the raw numbers. United Nations says over 3 billion people are using the internet. 60k from 3B is really not a large number, relatively speaking.
Stupid sexy Flanders.
From TFS: "Many of those posts, according to FBI testimony, contained some of the most extreme child abuse imagery one could imagine, and others included advice on how sexual abusers could avoid detection online."
well look at it differently ... 400,000,000 general population of males from USA and Europe give or take a little, 1% is 4 million, 1% of that is 40,000 so with 215K, that means that there is a lot of people ( about .0005% ) that like this stuff. So the FBI most likely knows a large percentage of them now in the USA. Problem now is what to do with them all. and what does this tell us about society. How about the poor FBI team that had to deal with the web site, those people are psychologically damaged for life ( I got to think that the other .9995 are not into this ).
as to what the images are, I got no clue, but I got to think it's like that south park episode
if you see me, smile and say hello.
I don't get it, either, but again, if you're playing percentages, there's always someone... if it's not prepubescent kids, it's animals, or feet, or fat, or insert whatever. They say psychopaths make up 1% of the population... that's a LOT of psychopaths out there... people who not only don't care about hurting other people, but can get off on it.
Stupid sexy Flanders.
I haven't seen it in the comments yet, but by seizing the site and NOT shutting it down, the government chose to run a child porn server. Does that not then put them under the same legal scrutiny as those they were investigating? Of course I did not read the article and may be missing a bunch of detail, but if the gov was actively serving child porn, then THAT is a crime in my eyes - regardless if it was a honeypot or not.
I don't know what was on this site in particular, but I know that there are many darknet forums filled with egregious, very non-jailbait child porn, right down to infants. People find them by word-of-mouth and darknet pages (like the infamous "hard candy" page, a hidden list of child porn .onion sites on The Hidden Wiki).
We're a fucked-up species and a certain proportion of adult humans are sexually attracted to children for some reason...it's clean over 1% even by the most conservative estimates, and 1% of 7.1 billion is 70 million, so there are way more than enough for a forum to have 60k users.
If it makes you feel better, even among these, many "have a conscience" and see CP as one of the least harmful ways to get their rocks off.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Didn't the FBI already admit to this in the summer of 2014? Don't see any new information on this topic. I think they actually caught a man that made false bomb threats in Seattle in August 2015 using this very same method.
Interesting thing, instruction how people "could avoid detection online" are not illegal, or even immoral. What is the point of including this piece of information?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I wonder how many of those 11,000 unique visits were accidental or a product of phishing(goatse.cx)
Now granted I think this is deplorable and disgusting (think of the Children!)
But I think they need to really scrutinize the data that they have so that innocent mistakes/typos/bad linkage are not falsely accused
no matter how good it is, it is human nature always wants to make things better
GO FBI GO !!!!
I'm glad that the site was (eventually) shut down. The article didn't mention it, but I hope the kids in the pictures are all identified, located, rescued if they were still in an abusive situation, and offered a lifetime supply of mental-health help (yeah yeah, I know, some number > 0% of abused children don't need mental help later, but the offer should be there for those who do need it).
I have little or no problem using these types of warrants if they are used to prevent crimes or identify victims, but I have a real problem with the "fruits" of the warrants being used to actually prosecute people. If the feds had simply seized contraband, helped kids that needed help, and made the perps who were stung publicly admit what they did in exchange for no criminal prosecution, that would seem to be a better solution from civil-liberties point of view. Unfortunately, it would stink from a fairness-to-the-victim point of view and it would also likely incite vigilante behavior from neighbors and others, leading to a net increase in criminal behavior. It would also be an incentive for a false confession for people who were really innocent ("So, my wifi got hacked but if I don't admit guilt and submit myself to unearned public ridicule you will send me to trial and at best my lawyers will bankrupt me? Where do I sign?") Hence my mixed feelings.
I also blame the buggy Tor bundle for making this easy for the feds:
Why wasn't it designed with an intermediate layer that filtered out any traffic not destined for the TOR network?
Example:
* Initialization from boot CD: Go to known locations and retrieve canonical, signed list of TOR entry points and download signed version of current TOR software.
* Start "lowest layer", which block all traffic except to/from known Tor entry points.
* Start TOR software. Even if there is a bug in the TOR software that would allow contacting an IP address other than known-good entry points, it would be blocked by the lower layer.
Start "mid-layer" which blocks all traffic except to the local TOR interface that is running in the immediately-lower layer.
Start a "high-layer" which applications run in. Applications are all socks/proxied to the local TOR software running at a lower layer. Exploits at this layer would not be able to get "out" to the "real internet" as they would be blocked by the lower layers. They couldn't even determine the machine's "real" local-LAN IP address that the lowest layer can see, they only know what they are told by the TOR layer, which is probably a NAT or other fake address.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It is not so clear that this is "good". There is not much evidence for a causal link from porn to sexual crime. Most countries that have liberalized their pornography laws have experienced a decline in sexual violence toward women and children. Child porn is illegal even if is entirely animated, or made with adult actors portraying adolescents. That pushes the entire genre onto the dark web. If, instead, the law only banned the actual abuse of children, rather than thought crime, there could be a legal market that would drive out most of the material involving actual harm to children.
If, instead, the law only banned the actual abuse of children, rather than thought crime, there could be a legal market that would drive out most of the material involving actual harm to children.
AFAIK, the FBI can't prosecute US citizens for thought crimes. If they had a lawful warrant and prosecuted people for criminal behaviour, i.e. passing on the products of criminal acts (against children), then I don't see any problem with what they're doing. This is an actual case of the FBI doing what they're supposed to do instead of going after political dissidents and whistle blowers. We should be praising these actions, not criticising them.
AFAIK, the FBI can't prosecute US citizens for thought crimes.
Then you are obliviously ignorant, and probably should spend a few minutes educating yourself about American child porn laws before you comment on them again.
prosecuted people for criminal behaviour, i.e. passing on the products of criminal acts (against children) ...
This NOT what they are doing. Child porn is illegal, even if it involves NO CHILDREN whatsoever. Many of the people being prosecuted were making or viewing animations or adult actors, not anything involving actual children.
The Franklin Cover-up. The pretense that Government people are altruistic angels guarding over us all is idiotic. People really need to get a grasp of that fantasy and treat it for what it is.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Interesting thing, instruction how people "could avoid detection online" are not illegal, or even immoral.
(a) Offense defined.--A person commits an offense if, with intent to hinder the apprehension, prosecution, conviction or punishment of another for crime or violation of the terms of probation, parole, intermediate punishment or Accelerated Rehabilitative Disposition, he:
(1) harbors or conceals the other;
(2) provides or aids in providing a weapon, transportation, disguise or other means of avoiding apprehension or effecting escape;
(3) conceals or destroys evidence of the crime, or tampers with a witness, informant, document or other source of information, regardless of its admissibility in evidence;
(4) warns the other of impending discovery or apprehension, except that this paragraph does not apply to a warning given in connection with an effort to bring another into compliance with law; or
(5) provides false information to a law enforcement officer.
I agree. While I abhor sexual abuse of children (required statement), it's an easy target of outrage but has far-reaching consequences to charge criminal offenses of people who view such things on the internet. It is a thought crime -- the abuse of the children is the people making the content -- and I think it should end there.
Free access to porn has shown a relative drop in rapes. Violence in games shows a huge drop in violence (relative to the same demographic without video games -- though not sure where they find those anymore).
I think the next battlefield will be on realistic sex robots. People will be morally outraged if they look this way or that. There's no abuse because it's a mechanism. If it stops rapists, sex addicts and molesters from doing damage to real people -- what is the harm?
I think too often we have morals based laws, that don't really meet the public interest of; "what does the most good for the most people?" Sure, we all might be creeped out by someone's preferences, but by not criminalizing the USE of materials, we can better get the CREATORS of harm. And in the future, STDs, Prostitution, and Sexual offenses may take a nose dive as Sexbots hit the scene.
It would be interesting to see the real stats on whether viewing makes someone more or less likely to abuse a kid. Perhaps there's a difference when there is a blog of people reinforcing how "OK" it is. The real question is; what path prevents child abuse?
>>"ad space available -- low rates!!!"
AFAIK, the FBI can't prosecute US citizens for thought crimes.
But how is a website or BBS showing material NOT a thought crime? You might say; the materials are prohibited. But we could outlaw bibles, and then everyone with a bible would be an outlaw. What ABOUT the bible is illegal? Reading the words, of course. They'll say it's possession, but really, it's in what you might learn, think and how it might change your behavior. No clear smoking gun on Pedophilia.
So this is a thought crime. They can see, view and hear but don't DO. Crime is an act that harms people. Until someone actually affects a person or property -- no crime. The only crime is based on prohibited material.
Is the crime in viewing an actual minor, or in viewing someone who LOOKS like a minor -- or a cartoon? What if I'm married to a 26 year old woman who 4 feet tall and looks really cute? Do I go to jail? Sure these people may clearly be looking for kids -- or maybe someone likes tiny women, but how do you define such a thing and does it really matter?
The user in this case is assuming there is privacy. They are viewing material to get stimulated. They didn't touch anyone.
I hate taking the side of Pedos -- but we don't even know if all these people are actual pedophiles. Some of them might just be into extremes and next week they'll be looking at chubby chicks. Some of them may have been abused in the past. If you criminalize this -- you don't have a situation where people can seek help. There are so many cases in our own history where stigmatizing causes MORE of the thing we are trying to reduce.
This is thought crime -- pure and simple. And if the rights of people who have done NO HARM are not considered, as reprehensible as they are, then the long arm of the law might do a reach-around into something else, like colluding with each other to change laws we think are wrong.
>>"ad space available -- low rates!!!"
Child porn is illegal, even if it involves NO CHILDREN whatsoever. Many of the people being prosecuted were making or viewing animations or adult actors, not anything involving actual children.
Didn't Ashcroft v. Free Speech Coalition 535 US 234 (2002) overturn that and rule that the First Amendment protects cartoons, animations, and other works that do not show the sexual violation of actual children?
It's all about the percentages, not the raw numbers. United Nations says over 3 billion people are using the internet. 60k from 3B is really not a large number, relatively speaking.
And yet a not dissimilar proportion of terrorists means that all Muslims are terrorists, in many people's eyes here.
To have a right to do a thing is not at all the same as to be right in doing it
Interesting thing, instruction how people "could avoid detection online" are not illegal, or even immoral. What is the point of including this piece of information?
Telling someone how to hide isn't a crime. Telling an escaped serial killer how to hide is.
To have a right to do a thing is not at all the same as to be right in doing it
One interpretation of this article is that FBI (or contractors) has non-public, zero-day, or old-but-unpatched vulnerabilities which it is using against client machines to collect information. We assume that only misconfigured machines are vulnerable.
A benefit of this knowledge is that it may be possible collect these exploits with a REVERSE honeypot. Simply use a MORE secure browser (Tails in Tails + non-extradition origin + Tor Browser). Then spider the Dark Web but make sure your spider DOES follow post requests and do data fuzzing. This is the most likely to register as an intelligence target.
You could determine a successful exploit occurred if: the outer Tails or the inner Tails (virtualization) sent any traffic to the network. Normal non-exploited behavior would be that all traffic (spidering) would occur only with the innermost Tor Browser connection. So this would require three levels of "wire level" logging. As soon as you detect exploited behavior, stop everything, publish the logs and then act like Gene Hackman in Enemy of the State.
Of course this can all be done without any human interaction with unsavory websites, it can be legal based on origin location and it can arbitrarily secured against detection. Older versions of Tor Browser and known exploits could be used to validate this system. Sorry, this probably belonged as a blog post or a GitHub new repo first commit!
-- I was raised on the command line, bitch
Last I looked at the US Federal law, it wasn't child porn if it didn't have an identifiable individual, under 18 when the porn was produced, doing something sexual (and there were restrictions on what constitutes that). Definitions can differ in other jurisdictions, and some states may have more sweeping laws.
Of course, this doesn't mean the FBI can't investigate, or a Federal prosecutor file charges, if none of the porn they find meets that standard.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes