Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular dark-web hosting provider hacked, 6,500 sites down

zdnet.com

Post reply on HN
Print view View original

121–130 of 160 posts

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#121

Post by runn1ng »

saurik wrote: post #41

I am confused: is this seriously saying that over 30% of "hidden" services were being hosted on the server of one guy named Daniel?... that in a world where the entire point is that you don't know where anything is hosted and you are using tons of indirection through Tor to ensure there is no obvious place to hook all of the traffic or even see packets for timing attacks, it turns out there was a one in three chance…

If you saw the state of hidden web, you would agree.

There are very few hidden services and most of them are... questionable.

The article cites child porn. That's about right.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#122

Post by sandworm101 »

mirimir wrote: post #91
jstanley wrote: post #57

Earlier quoted context omitted.

The hoster certainly has the power to scam people, but he doesn't have the power to deanonymise them.

He does, if he drops phone-home malware. As the FBI has done, at least twice.

That in turn only works where the users havent taken additional steps beyond Tor. Tor was never meant to solve every problem.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#123

Post by A2017U1 »

Eliezer wrote: post #71
taylorfinley wrote: post #66

Earlier quoted context omitted.

I think we all agree rolling your own crypto is dangerous, but what siliconunit described is just a one time pad. Assuming your key data is truly random and unknown to your attacker, isn't this kind of the gold standard for uncrackable cyphered communication?

If interpreted that way, storing the noise and memorizing the offset, it amounts to having a privately stored one-time pad to be used as key... with a passphrase with as many bits in it as the offset. That’s probably not a lot of bits. You are better off storing the data, encrypted with a real pass phrase, wherever you would have stored the random noise stream that is needed to read the data in any case. Don’t roll y…

Using a one time pad isn't "rolling your own crypto".

It is also provably secure unlike every other cryptosystem.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#124

Post by busterarm »

jorblumesea wrote: post #119
busterarm wrote: post #85

Earlier quoted context omitted.

They probably were the biggest pedos in the world. That's the only sane reason to host a platform like this, if you have any sense of self-preservation. Moreover, its predecessors, Freedom Hosting and Freedom Hosting II, were both the biggest purveyors of CP when they were taken down. If it walks like a duck...

Yeah, and the biggest users of cryptography are criminals. Only the guilty lock their car doors, right?

You and the other commenter are missing the point. I'm not stating either of those.

The motivation for hosting something like this is to hide what you're hosting in a bunch of noise. Legal or illegal. Your goal is to make it hard to gather metadata about the service. There are perfectly legitimate reasons to want that...

That said, it's a foregone conclusion that if you host a service like this, people who want to distribute child pornography are going to flock to it. If you don't police the content, that's even more true.

In fact, in the case of Freedom Hosting II, the host was allowing the pedos to circumvent the normal limitations of the platform, in theory because they were paying cold hard cash, as well as allowing scammers to operate on the platform, also for cold hard cash. It's been suggested that as much as 50% of the content hosted on Freedom Hosting II was child porn.

If you knowingly allow people to use your service to distribute child pornography or commit other crimes, you're every bit as culpable as your customers. This type of platform costs not-insignificant money to run -- it's a business. Nobody is hosting this many services out of a sense of altruism.

And honestly, in the case of CP, if you're hosting it, including running a service that facilitates the hosting of it, you deserve to serve consecutive life sentences in prison and whatever harm befalls those in prison who get found out as pedos.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#125

Post by jabberthemutt »

busterarm wrote: post #124
jorblumesea wrote: post #119

Earlier quoted context omitted.

Yeah, and the biggest users of cryptography are criminals. Only the guilty lock their car doors, right?

You and the other commenter are missing the point. I'm not stating either of those. The motivation for hosting something like this is to hide what you're hosting in a bunch of noise. Legal or illegal. Your goal is to make it hard to gather metadata about the service. There are perfectly legitimate reasons to want that... That said, it's a foregone conclusion that if you host a service like this, people who want to di…

> you deserve to serve consecutive life sentences in prison and whatever harm befalls those in prison who get found out as pedos

Pedophilia by itself is not harmful to anyone. It is those who physically act in their urges or support the creation of CP media that are harmful. Passive consumption is not something I would blindly use as reason to wish someone harm. Instead I wish them psychological support to overcome their abnormal sexuality. Rehabilitation beats punishment any day for behaviour like that.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#126

Post by function_seven »

A2017U1 wrote: post #123
Eliezer wrote: post #71

Earlier quoted context omitted.

If interpreted that way, storing the noise and memorizing the offset, it amounts to having a privately stored one-time pad to be used as key... with a passphrase with as many bits in it as the offset. That’s probably not a lot of bits. You are better off storing the data, encrypted with a real pass phrase, wherever you would have stored the random noise stream that is needed to read the data in any case. Don’t roll y…

Using a one time pad isn't "rolling your own crypto". It is also provably secure unlike every other cryptosystem.

Sure, except now you have an equal amount of data that needs to be stored somewhere. The pad is as long as the data. Either you have to encrypt that using some other means, or you do the weak "store offset" method.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#127

Post by airnomad »

Would it be possible or feasible to compile a site into a single binary? Within binary there would be, say 1GB encrypted file system and embedded SQL lite could write data to it and embedded http process would be able to serve and store static content.

On startup you'd enter password and decrypt a baked-in filesystem.

I guess this would still be possible to break into as long as the app is working since decryption key would be saved in RAM but as soon as server goes offline data would be inaccessible.

Then you host this, say, in Russia or China and you should be safe from USA authorities.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#128

Post by dredmorbius »

kodablah wrote: post #29
hnphillipj wrote: post #6

Earlier quoted context omitted.

How do you anonymously host a service from your home computer? I'm new to all this. I also checked out your site. I hope to be at your level of expertise one day.

Onion (née hidden) services are easily hosted from any computer, even behind a NAT/ISP due to how it publishes its descriptor and relies on reachable relays for rendezvous. It's easy with the Tor executable and a torrc file, there are plenty of guides out there. Even though you're new to all this, for others wanting to do this programmatically, there is Stem for Python and I've written one for Go [0]. It's such an ea…

Inexpertly hosting onion services on your own premises, particularly if you're doing so out of a real fear of getting found out, is not recommended.

Talk to the Dread Pirate Roberts next time he's in the neighbourhood.

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#129

Post by SmellyGeekBoy »

kryogen1c wrote: post #75

>a PHP zero-day vulnerability. Details about this unpatched vulnerability were known for about a month I find this to be a very upsetting attempt at technical clickbaiting. Feels like a journalist trying to appeal to semitechnical readers with hackerman slang. If it was known for a month, it's not an 0day.

Surely all 0days are known about by someone for some period of time before they actually get used? Or do you think people discover these exploits and then use them on the same day?

My understanding was that 0day just meant that it was unpatched, not "publicly" known and being used for the first time "in the wild".

Re: Popular dark-web hosting provider hacked, 6,500 sites down

#130

Post by SmellyGeekBoy »

jabberthemutt wrote: post #125
busterarm wrote: post #124

Earlier quoted context omitted.

You and the other commenter are missing the point. I'm not stating either of those. The motivation for hosting something like this is to hide what you're hosting in a bunch of noise. Legal or illegal. Your goal is to make it hard to gather metadata about the service. There are perfectly legitimate reasons to want that... That said, it's a foregone conclusion that if you host a service like this, people who want to di…

> you deserve to serve consecutive life sentences in prison and whatever harm befalls those in prison who get found out as pedos Pedophilia by itself is not harmful to anyone. It is those who physically act in their urges or support the creation of CP media that are harmful. Passive consumption is not something I would blindly use as reason to wish someone harm. Instead I wish them psychological support to overcome t…

"Passive consumption" enables the industry that creates this content to exist in the first place. It is not victimless. This is not a difficult concept to understand.

That said, I agree with your point that these people need help and support and that blindly locking them away for looking at pictures on the internet is generally not a good use of resources.

Post reply on HN