Live data from Hacker News

U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

antilop.cc

71–73 of 73 posts

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#71
post #36

From a legal perspective, why does it matter how the FBI got access to the server or determined it was a Silk Road server? I assume they got a warrant for the server itself, and therefore the evidence found on the server is a candidate for inclusion in the trial.

Yes, there was a warrant, but that warrant must be obtained based on legally obtained information, or else the warrant is invalid as is all information gathered through the execution of that warrant. Here's an example: Suppose you have drugs in your house, and no one knows that but you. The police may suspect that that's the case, but they need some kind of information that provides probable cause in order to obtain…

Parallel construction doesn't usually work that way. In 50+ years of heightened warrant requirements, the police and DoJ have learned lots of tricks. Helped along the way by various legal loopholes crafted by conservative Justices.

A better example (albeit more brazen than usual) would be the Federal government illegally breaking into your home. They find the cocaine. That means they can at least tell the local cops that they wouldn't be wasting their time by investigating you.

Perhaps they stumble upon a note on your kitchen table with the name John Garcia. The Feds might also tip off the police that they have reason to believe you may have working with a John Garcia. Maybe the look at the cellular location logs of your cellphone and John Garcia's. They notice that you're both in an abandoned warehouse on the first Sunday of each month. So they tip off the police that they might want to double their previously non-existent patrols in that area on Sundays.

When you eventually get popped, all the evidence presented at trial looks to be on the up-and-up. An officer patrolling the warehouse district noticed two suspicious men meeting regularly and exchanging boxes. When they ran the license plates, they found that your name came up in the files of some other drug investigation. They had no reason to suspect you personally at the time, but with the suspicious rendezvous they decided to put a tail on you, which doesn't even require probable cause. Eventually, given your pattern of behavior, colored by their expert experience chasing bad guys, they can convince a judge to issue a search warrant.

If their local judges aren't sufficiently pliable, maybe they pop a known drug user who may have crossed your path. They ask him if he knows you. They make sure to tell him that they know you're a drug dealer (the scope of the lies cops can tell is for all practical purposes limitless), and if he tells them about you, they'll be lenient with him. So he lies and says he knows you're a drug dealer. So the cops go back to the judge for a search warrant, telling the judge that an informant has fingered you.

_That_ is parallel construction. The government has very limited resources. It's immensely useful even when all the FBI or NSA does is point the cops in the right direction. It can be so incredibly subtle and indirect that many judges, convinced it happened, still might not consider it to violate 4th Amendment warrant restrictions.

And it's plausible that this is what happened here. The NSA decided to point the FBI in the right direction. They could have even done it through an "informant"--e.g. tipped off a hacker working with the FBI. There are myriad ways to do it. And because the defense has very limited resources, it's almost always impossible to trace the origins of tips all the way back to their source. Eventually the paper trail ends at the footsteps of somebody with a fuzzy memory. What can you do?

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#72

Quite an interesting read. Summary? Silk Road used a pair of nginx servers, one as front-end, one as back-end. The server images (captured forensically) show that the then-in-place configuration made it impossible for the FBI agent to do what he claims, that is, connect to the back-end by using the server's IP address (the allow/deny settings forbade this). The log files on the servers lack entries to support FBI cla…

The nginx conf for the .49 server[1] has a bug. The location entries are exclusive[2].

[1] http://krebsonsecurity.com/wp-content/uploads/2014/10/70-6.p... [2] http://nginx.org/en/docs/http/request_processing.html#simple...

Re: U.S. v. Ross Ulbricht: Declaration of Joshua J. Horowitz [pdf]

#73

Earlier quoted context omitted.

I also have an idea to stop the FBI from gaining any meaningful information via Javascript exploits: PGP or Ed25519 sign all .js files and have a browser that only executes signed code. Not only do you need to obtain access to the server, you also need the private key of its operator. (Which should be kept offline for signing.) If they don't surrender the key, then you cannot compromise their visitors. This can also…

It's an interesting idea, but currently quite impractical as there's no infrastructure for it. The most secure way right now is to isloate your Tor browsing activities to a virtual machine which is only able to access the internet via Tor. Create a VM to act as a middle node with 2 NICs, the first of which will connect to the internet and the second of which will connect to the other VM. Disable any unnecessary servi…

You mean some people use Tor differently than as you suggest?

Why?

I had assumed that everyone would be either on the 'net with their 'net computer or on tor with their tor computer.

Doing both with one computer obviously defeats the purpose, doesn't it?

...Also, the chances of breaking out of a VM into the host are non-zero. Just sayin'.

Post reply on HN