Live data from Hacker News

The FBI Identified a Tor User

vice.com

301–310 of 367 posts

Re: The FBI Identified a Tor User

#301
post #177

Earlier quoted context omitted.

Not if you brought your cellphone on the trip. Or used a car that has a built-in SIM card and cellular modem. Or you bought that laptop from a supplier that registers all MAC addresses of sold devices. Or that laptop had Computrace or some other firmware-based anti-theft mechanism.

Even if you had a car without a cell connection, license plate readers and cameras make it easy for anyone with access to replay and reverse any traveling you do with any car.

This is basically how the prosecutor in the Idaho case is putting Kohberger at the scene. They've also used where his cell phone was pinging during the night of the murders as additional evidence he was there.

Meanwhile, detectives scoured video footage from cameras in the area and picked out a white Hyundai Elantra driving past the house three times before stopping on the fourth pass shortly after 4am. The car left 16 minutes later “at a high rate of speed”, according to Payne

Meanwhile, FBI investigators trawled through Kohberger’s cellphone records and discovered that he turned it off shortly before the attack, perhaps thinking it would help him to avoid detection. The phone springs to life again at 4.48am on a road out of Moscow.

The records also showed that Kohberger was in the area near the house at least a dozen times in the months before the attack, usually in the early morning or late evenings. Investigators said they were examining whether he “conducted surveillance on the King Road residents and was in contact with any of the victim’s associates before or after the alleged offense”.

Re: The FBI Identified a Tor User

#302
post #257

Earlier quoted context omitted.

Why wouldn't parallel construction be perjury, even if the real search was legal?

Why would it be? The purpose of laws like the 4A is to prevent the police from harassing innocent people by going on fishing expeditions. The purpose of the poisoned tree doctrine is to prevent the police from committing crimes as part of their work. But if a plains-clothes police officer sees you load a kilo of cocaine into your car every Tuesday, on the same street corner, there's nothing illegal or immoral about h…

in your analogy, plains-clothes officer breaks into the private property without leaving a trace, by using unknown vulnerabilities in security of the place, leaves with evidence without being noticed gives that evidence to a supposedly uninformed cop, and development of that case leads to prosecution of the property owner. And you are saying there is nothing sketchy about that?

Re: The FBI Identified a Tor User

#303

Earlier quoted context omitted.

I read the doc and it seems like the case is built on information gathered by the government but they won't say how. They don't want to say how because it's supposed to be a national security issue, which is understandable but not how our legal system works (or should work). They are saying that they got his IP via tor and that that IP address went to ISIS websites, but again they won't say how they have this informa…

> I'm saying that if they had targeted this individual, the feds thought he was up to something but had no real evidence, it would be really easy to find this guys IP address and then say he went to X website and he needs to go to jail -but we can't tell you how we found this out. Do you see where the problem is? We still have due process in this country or at least we're supposed to. Yeah, it's been a problem for a…

TDIL -parallel construction

Re: The FBI Identified a Tor User

#304

I have second hand knowledge of lawsuits that have been dropped by the FBI during discovery because it would require them revealing zero days they have on Tor. Recently this has started getting increasing levels of press exposure[1] including in CSAM cases. The FBI has also continued to run CSAM websites after takeover to collect intel, and likely run honeypots for other content. If your adversary is a state actor, p…

Is there really any way to hide from a motivated state actor? Asking about it on HN is definitely not one. Relevant xkcd: 538 [1] [1] https://xkcd.com/538/

What about www.bitmessage.org ?

Re: The FBI Identified a Tor User

#305

Earlier quoted context omitted.

the malicious process had tor as a parent process/uid. Which makes me say it was definately the tor server that had some rce.

It is really hard to believe that a malicious actor is throwing expensive tor 0-days at random onions.. or your website to "discuss geopolitics with friends" was a bit greater. In both cases you could run a honeypot to catch 0-days.

the webserver was a simple nanohttp hackup on the oracle jvm, so Ill take some convincing java has an rce in its network stack, and they disguised it by spawning a process on the tor user after hacking the OS and covering that up sufficiently to leave no other evidence.

The only reason I spotted it was because I was checking for compromise by comparing any file/process changes every few weeks.

It was a few years ago, my guess back then was tor is the honeypot, given what happened recently with encrochat I wouldnt be surprised if a few years down the line it turns out it was.

Or maybe I misconfigured the server, or maybe the binary I used for tor was compromised, it was as much a test for whether I could trust tor as anything else and it failed. delete, move on.

Re: The FBI Identified a Tor User

#306
post #3

Original article this is referencing: https://www.vice.com/en/article/z34dx3/fbi-wont-say-hacked-d... And the relevant court document: https://www.documentcloud.org/documents/23569961-motion-to-r...

Ok, we've changed the URL to that from https://www.schneier.com/blog/archives/2023/01/the-fbi-ident.... Schneier's title seems more HN-friendly so I've kept it.

Re: The FBI Identified a Tor User

#307

I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connect…

Is bandwidth profiling not used? Can't an agency on the scale of FBI, provided they can control the website contents or at least see the access logs, determine from passive observing of end user connections, who downloaded the website?

Re: The FBI Identified a Tor User

#309
post #257

Earlier quoted context omitted.

Why would it be? The purpose of laws like the 4A is to prevent the police from harassing innocent people by going on fishing expeditions. The purpose of the poisoned tree doctrine is to prevent the police from committing crimes as part of their work. But if a plains-clothes police officer sees you load a kilo of cocaine into your car every Tuesday, on the same street corner, there's nothing illegal or immoral about h…

in your analogy, plains-clothes officer breaks into the private property without leaving a trace, by using unknown vulnerabilities in security of the place, leaves with evidence without being noticed gives that evidence to a supposedly uninformed cop, and development of that case leads to prosecution of the property owner. And you are saying there is nothing sketchy about that?

> And you are saying there is nothing sketchy about that?

It all hinges on whether or not they had a warrant to surveill the ISIS site.

If the police have a warrant to plant a hidden camera at a crackhouse, I don't see why they would have to reveal its existence, when they later stop and search a car full of drugs at a perfectly legal search at a border checkpoint. If they didn't have a warrant... That's an ethical problem, and it runs afoul of the fruit of the poisoned tree.

Likewise, if there's an informant or a mole at the crackhouse, do you think the police are obliged to notify the world of his identity, every time they arrest someone he tips them off to?

Re: The FBI Identified a Tor User

#310

I think a lot of this has been covered elsewhere before: - when using tor you should disable javascript because a malicious or compromised site can use javascript to do non-tor stuff that potentially compromises your location. (can be a big pill to swallow, web without javacript is very 90s) - Run torbrowser within a secure VM or separate device using Tails to minimize your activity footprint - Use a VPN when connect…

> Use a VPN when connecting to TOR You should not do this. It is at best useless, at worst strictly negative. A VPN tunnels all your traffic through their own servers, so they are a single point of failure roughly equivalent to your ISP. Anyone with access to the VPN servers could spy on all of your traffic, completely bypassing Tor. If you pay for the VPN with a credit card, you can be easily identified.

> Anyone with access to the VPN servers could spy on all of your traffic, completely bypassing Tor.

Hmm, can you explain how this could possibly be true? I think the VPN couldn't see any more than your ISP could have.

Post reply on HN