A dark web tycoon pleads guilty, but how was he caught? • Hacker News Board

Re: A dark web tycoon pleads guilty, but how was he caught?

#101

Post by rolltiide » Mon, Feb 10, 2020, 10:32 PM UTC

ohmygodel wrote: post #46

Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here's why: 1. Each hidden service chooses a "guard" relay to serve as the first hop for all connections. 2. A server running multiple hidden services…

Wasn't this 2013??

Its 2020 now so much has to have changed. Tor sucked 7 years ago.

Re: A dark web tycoon pleads guilty, but how was he caught?

#102

Post by ChrisCinelli » Mon, Feb 10, 2020, 11:04 PM UTC

homonculus1 wrote: post #83

ChrisCinelli wrote: post #79

Earlier quoted context omitted.

If the values of a person are "achieving personal power" in first position and "respect others" in last, that person may be ok to steal. I hear some people arguing that in business "not breaking the laws" is not the problem unless they get caught and even in that case, it is a problem only if the consequences end up costing more than the gain they receive in doing it. So a person with those value may end up breaking…

There are numerous unjust laws that infringe on the rights of the individual. Not only is it morally defensible to break such laws, but it is a good for respectable people to do so in order to reclaim behavioral territory and psychological freedom from the police state. This demonstrates to others that being a "criminal" is not a moral status but a legal one. It may even be a social duty.

It is a dangerous ground thought... Who decide what is just or unjust?

Different people have different values and believes in what is just or unjust. I agree that some laws may need to be changed. But should we not have discussions on changing the laws instead of breaking them?

This obviously implies a good democratic system so it may be different is some nations.

Re: A dark web tycoon pleads guilty, but how was he caught?

#103

Post by pests » Mon, Feb 10, 2020, 11:04 PM UTC

dmos62 wrote: post #96

heartbeats wrote: post #94

Earlier quoted context omitted.

It's not so simple. Why do we have education? Firstly, because there's needed some way to filter people. If you get 100 applicants, you can't make a detailed consideration. But if only 30 have degrees, it's much easier. So there is a signalling effect. But secondly, and more importantly, because you need somewhere to have these kids. If there's ten million jobs and ten million two hundred thousand jobs, you'll get pr…

You might be responding to the wrong post.

I think he's responding correctly but just doesn't touch on any topics in the GPs post besides the prison topic and completely misses the point.

Re: A dark web tycoon pleads guilty, but how was he caught?

#104

Post by dontbenebby » Mon, Feb 10, 2020, 11:16 PM UTC

ohmygodel wrote: post #46

Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here's why: 1. Each hidden service chooses a "guard" relay to serve as the first hop for all connections. 2. A server running multiple hidden services…

I always assumed the issue was not just finding the servers, but that they are often in countries that are hostile to US law enforcement.

You can do fancy attacks all you want, if the server is in Russia they're probably not going to be honoring any MLATs

Re: A dark web tycoon pleads guilty, but how was he caught?

#105

Post by ropiwqefjnpoa » Mon, Feb 10, 2020, 11:17 PM UTC

I mean, it's not like he's just some TOR user they were after, he ran a huge dark web hosting service. There's so much traffic and data to work with, it was just a matter of time.

Re: A dark web tycoon pleads guilty, but how was he caught?

#106

Post by ohmygodel » Mon, Feb 10, 2020, 11:19 PM UTC

rolltiide wrote: post #101

ohmygodel wrote: post #46

Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here's why: 1. Each hidden service chooses a "guard" relay to serve as the first hop for all connections. 2. A server running multiple hidden services…

Wasn't this 2013?? Its 2020 now so much has to have changed. Tor sucked 7 years ago.

Tor has made some improvements that would reduce the threat of deanonymizing an onion service, but none affect the above analysis (or rather, the above analysis has taken them into account). The main improvements, in my opinion, have been:

1. The biggest improvement is that (in 2014 or 2015?) they reduced the number of entry guards from 3 to 1 [0], reducing the risk of a malicious guard by a factor of 3.

2. The time until a guard choice expires was increased from 2–3 months to 3–4 [1] (this maybe happened 3 years ago?). This increases by ~40% the expected time an adversary would need to passively wait to have his relay selected as a guard by a victim.

3. The bandwidth threshold to become a guard relay was raised from 250KB/s to 2000KB/s [2] (looks like in 2014). However, 2000KB/s=16Mbit/s is still a very low bar, and, moreover, for an adversary that can run relays above the threshold, this change increases the adversarial guard fraction as there are fewer guards above the threshold to compete with.

4. A new guard-selection algorithm was implemented that prevents a denial-of-service attack from forcing a large number of guards (i.e. > 20) from being selected in a short period of time [3]. I believe this merged in 2017. If an adversary can force guard reselection by an attack, you are still extremely vulnerable, though, as a limit of 20 still provides a 20x risk multiple.

[0] https://trac.torproject.org/projects/tor/ticket/12688

[1] https://trac.torproject.org/projects/tor/ticket/8240

[2] https://trac.torproject.org/projects/tor/ticket/12690

[3] https://trac.torproject.org/projects/tor/ticket/19877

Re: A dark web tycoon pleads guilty, but how was he caught?

#107

Post by dontbenebby » Mon, Feb 10, 2020, 11:24 PM UTC

pier25 wrote: post #3

OTOH if these techniques and vulnerabilities were made public it would benefit cybercriminals as they could defend themselves better.

> OTOH if these techniques and vulnerabilities were made public it would benefit cybercriminals as they could defend themselves better.

That same logic applies to any sort of forensic technique, but it's a basic precept of the US justice system that an accused can see and respond to the evidence against them, including questioning the scientific validity of how that evidence was gathered.

Just because a technique is "cyber" doesn't mean an accused magically doesn't have a right to know the chain of custody, techniques used etc.

Re: A dark web tycoon pleads guilty, but how was he caught?

#108

Post by kebman » Mon, Feb 10, 2020, 11:26 PM UTC

heartbeats wrote: post #94

ChrisCinelli wrote: post #81

Earlier quoted context omitted.

As a side note: Promise (YC startup) was also saying that 70% of people in jails are waiting for judgement or are in for a technical violation (ex: did not show up to a hearing). And being in jails they end up losing their job, eventually they lose their house etc. This is a space with a lot of low hanging fruits. And minor fixes may end up doing a lot of good.

It's not so simple. Why do we have education? Firstly, because there's needed some way to filter people. If you get 100 applicants, you can't make a detailed consideration. But if only 30 have degrees, it's much easier. So there is a signalling effect. But secondly, and more importantly, because you need somewhere to have these kids. If there's ten million jobs and ten million two hundred thousand jobs, you'll get pr…

The assumption that unenmployed causes all sorts of trouble, and thus should rather be in jail... Sure doesn't sound like a country that values freedom.

Re: A dark web tycoon pleads guilty, but how was he caught?

#109

Post by stock_toaster » Mon, Feb 10, 2020, 11:31 PM UTC

ohmygodel wrote: post #92

stock_toaster wrote: post #84

Earlier quoted context omitted.

Interesting. Looking for more info on what you were talking about (with regard to "guards"), I dug up this post[1] which has some info too. [1]: https://blog.torproject.org/announcing-vanguards-add-onion-s...

The page you link describes "vanguards" which apply the guard logic to positions beyond the first hop. They are only available as a plug-in that you must separately download and configure. My understanding is that no plans currently exist to integrate vanguards into Tor due to cost of engineering challenges that appear if everybody were to use them (including especially how they would affect load balancing).

Thanks for the follow up info and additional explanation!

Re: A dark web tycoon pleads guilty, but how was he caught?

#110

Post by hatmatrix » Mon, Feb 10, 2020, 11:38 PM UTC

agoristen wrote: post #38

Causality1 wrote: post #10

It's strange to me that people who make a habit of doing fantastically illegal things on the internet are always so sloppy about it. Even if they don't have the technical ability to break into their neighbor's wifi or set up a long range antenna to connect to an open access point they can still get a burner smartphone and drive to a Starbucks. Back when I used to torrent my TV shows I didn't even let my piracy laptop…

We don't actually know for sure that he was doing "illegal things". He was running a hosting company ("Ultra Host") on the public facing web and later launched Freedom Host as a side business, or perhaps better described as a charitable hosting service to contribute to the Tor network. Freedom Host offered FREE hosting to people on the Tor network. What liability does he have if other people use his host for illegal…

According to [1]

> Freedom Hosting has long been notorious for allowing child porn to live on its servers. In 2011, the hactivist collective Anonymous singled out the service for denial-of-service attacks after allegedly finding the firm hosted 95 percent of the child porn hidden services on the Tor network. In the hearing yesterday, [FBI Agent] Donahue said the service hosted at least 100 child porn sites with thousands of users, and claimed Marques had visited some of the sites himself.

[1] https://www.wired.com/2013/09/freedom-hosting-fbi/