Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

wired.com

Post reply on HN
Print view View original

41–50 of 136 posts

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#41

Post by emidln »

devconsole wrote: post #32
bhouston wrote: post #5

I think that TOR should no longer be considered secure in the wake of so many busts. Either it isn't secure by some flaw, or it is too easy to fingerprint visitors, or some other work around.

There are some interesting theories being tossed around. I'd like to add one more. The common thread across all darknet websites is the fact that they generally run from datacenters. Most people don't host websites from their residence. Further, most people don't colocate servers anymore. I would be surprised if any of the 414 websites operated on boxes that had been colocated. However I won't rule out that colocatin…

Requesting an image of a paranoid person's server isn't necessarily that great. When I worked for a run-of-the-mill cybersecurity firm, our simulator products were protected with full disk encryption using run-of-the-mill open-source software + light patches and keys bound to specific hardware, software, and configuration states via the TPM. This is for fully automated boot up. If you can accept the risk of needing to be physically close to a machine, you can generate random bytes and store those into your TPM and require both the hardware/software/configuration to be correct as well as knowing your key. This would incidentally also prevent you from being able to give law enforcement the key to an image of your computer (this is actually impossible, you don't know the key).

If you're doing this under a warrant, you could just request that the server's operator unlock the machine. Whether you comply is a legal situation that varies from jurisdiction to jurisdiction (in the US, it seems that you might be held indefinitely in jail if you refuse to divulge your key). The thing is, you should be able to make an extremely strong case (possibly with the EFF's help) that any warrant is false. Anonymous traffic itself should not be enough to compel you to divulge your secrets without other evidence pointing to your machines (standard IANAL, but this seems consistent from everything I've read).

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#42

Post by [deleted] »

downandout wrote: post #17

Lessons learned: 1) Don't engage in businesses that make you a target of the world's best-funded law enforcement agencies. 2) If ignoring lesson 1, don't access servers directly, from home, and don't pay for said servers with personal credit card. 3) Don't pay for your $130K Tesla using BTC a month after you open up a massive illegal drug marketplace that runs exclusively on BTC. Someone may suspect something. 4) Whe…

[deleted]

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#43

Post by mike-cardwell »

gumber wrote: post #16
bhouston wrote: post #5

I think that TOR should no longer be considered secure in the wake of so many busts. Either it isn't secure by some flaw, or it is too easy to fingerprint visitors, or some other work around.

I refuse to believe that the FBI is privy to a funamental TOR break that's completely eluded the cryptographic community, and they're risking revealing it with some darknet busts. If TOR was broken, they'd be encouraging its use while secretly mining it for parallel construction opportunities across the board. Instead, we get warning shots. TOR is fine, but now that we know that the FBI has its tendrils everywhere pe…

They don't have to break Tors crypto to figure out where hidden services are. They just need to identify which IPs are consistantly connected to the Tor network, and then prod them and see if the hidden service goes offline.

That is one of the reasons why you're absolutely not supposed to run a relay from the same IP that you run a hidden service from. Because your IP is published if you do that.

If I were to run such a service, I would want to make sure that the IP that the hidden service is running from has as little connection to me as possible.

[edit] If it were my full time job to locate Tor hidden services, I'm pretty sure I could make a decent go of it. Certainly for a lot of them. Given the resources the NSA and GCHQ have, I have to believe that they can do a much better job of it.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#44

Post by devconsole »

emidln wrote: post #41
devconsole wrote: post #32

Earlier quoted context omitted.

There are some interesting theories being tossed around. I'd like to add one more. The common thread across all darknet websites is the fact that they generally run from datacenters. Most people don't host websites from their residence. Further, most people don't colocate servers anymore. I would be surprised if any of the 414 websites operated on boxes that had been colocated. However I won't rule out that colocatin…

Requesting an image of a paranoid person's server isn't necessarily that great. When I worked for a run-of-the-mill cybersecurity firm, our simulator products were protected with full disk encryption using run-of-the-mill open-source software + light patches and keys bound to specific hardware, software, and configuration states via the TPM. This is for fully automated boot up. If you can accept the risk of needing t…

It's an interesting idea. I think physically shipping a server to a datacenter is precarious. Remember, it is known that your server is hosting a darknet website. You can't really hide this fact. Timing correlations make it possible to figure out which server is doing what. The reason that Tor users are generally safe from this is because they're not constantly connected, and an adversary generally can't cause a client to issue a web request on demand. But a webservice is constantly connected, and any adversary can cause it to issue responses since it's a webservice. Whether it's a timing correlation from a global passive adversary, or it's simply noticing that "silk road is extremely popular and this webserver in this datacenter seems to be hosting a huge amount of Tor traffic," you have to assume that it's known that the location of your server is compromised.

And if you assume that, then it suddenly becomes very, very bad if you've personally shipped a computer to the datacenter, colocation-style. First, clever hardware won't protect you if it's a running box. But beyond that, you can be traced simply by the components that you've assembled. You have to order those components from somewhere. You have to assume the worst: that authorities will take your box using a power adapter that lets them physically remove the computer from the datacenter without turning it off (such things exist), dump an image of your server while it's running (so that encryption keys won't help you), and then dismantle your server and trace the origin of the components. Congratulations: you're caught.

I think the model of "rent a bunch of servers using opsec" is also precarious, but less precarious than relying on hardware protections to save you.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#45

Post by JoeAltmaier »

devconsole wrote: post #44
emidln wrote: post #41

Earlier quoted context omitted.

Requesting an image of a paranoid person's server isn't necessarily that great. When I worked for a run-of-the-mill cybersecurity firm, our simulator products were protected with full disk encryption using run-of-the-mill open-source software + light patches and keys bound to specific hardware, software, and configuration states via the TPM. This is for fully automated boot up. If you can accept the risk of needing t…

It's an interesting idea. I think physically shipping a server to a datacenter is precarious. Remember, it is known that your server is hosting a darknet website. You can't really hide this fact. Timing correlations make it possible to figure out which server is doing what. The reason that Tor users are generally safe from this is because they're not constantly connected, and an adversary generally can't cause a clie…

I'm probably naive, but any computer a crack-head customer can find, can not be rocket science for the FBI to find. Right?

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#46

Post by angch »

jordanbaucke wrote: post #25

I think it will be very interesting to see the correlation of "discovery vectors" these LE's purport to have used in locating these services.

I wonder how hard it is to cause a very spiky, targeted temporary network outage (DDoS, etc) and use it to correlate with which Dark web sites relies on which physical network. With enough random events, it's probably possible to pin down the location, unless you have more than a host or move around a bit.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#47

Post by devconsole »

JoeAltmaier wrote: post #45
devconsole wrote: post #44

Earlier quoted context omitted.

It's an interesting idea. I think physically shipping a server to a datacenter is precarious. Remember, it is known that your server is hosting a darknet website. You can't really hide this fact. Timing correlations make it possible to figure out which server is doing what. The reason that Tor users are generally safe from this is because they're not constantly connected, and an adversary generally can't cause a clie…

I'm probably naive, but any computer a crack-head customer can find, can not be rocket science for the FBI to find. Right?

It's an open question whether Tor has been compromised to the point that it's now trivial for authorities to locate where darknet websites are hosted. I'm simply making the observation that if your opsec is good enough, you shouldn't need Tor's hidden webservice capability to protect you. You could simply run your website as a standard .com website, except for the fact that authorities can take the .com domain from you.

Or, put another way, if you're relying on Tor's hidden webservice capability as your sole defense, then you're in a bad position.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#48

Post by Renaud »

devconsole wrote: post #32
bhouston wrote: post #5

I think that TOR should no longer be considered secure in the wake of so many busts. Either it isn't secure by some flaw, or it is too easy to fingerprint visitors, or some other work around.

There are some interesting theories being tossed around. I'd like to add one more. The common thread across all darknet websites is the fact that they generally run from datacenters. Most people don't host websites from their residence. Further, most people don't colocate servers anymore. I would be surprised if any of the 414 websites operated on boxes that had been colocated. However I won't rule out that colocatin…

> Here's how the attack may have happened: Step one, collect data about which computers are sending and receiving large amounts of Tor bandwidth. Step two, if the server resides in a datacenter, request an image of the server. Step three, you now know whether the server is a darknet website.

This in itself is not sufficient: there are thousand of Tor bridges, relays and exit points. All of them carry lots of traffic and all of them could be hosting hidden services as well. The total traffic in itself doesn't necessarily show that a server hosts hidden services. It could also me masked by generating fake traffic to/from the server.

Knowing that Tor traffic comes and goes through a server isn't enough. Most data centers would not just hand over disk images just because a server is running Tor and a hidden service. You would need good evidence that the particular hidden service you seek is hosted at that particular data center.

You still need detective work to pinpoint the location of the datacenter. This could come from timing attacks or an unrevealed weakness in the Tor protocol itself, but it's more likely that they noticed suspicious activity in real life (large purchases, people already known to be involved in drugs), infiltrated some markets, managed to get some people to talk, ... Once you suspect a particular person and they are under surveillance, you can catch them paying for servers with their CC, connect to their server directly, or watch their BTC transactions.

They would certainly need the cooperation of the involved data centers at some point, but neither Europol nor the FBI can just walk into any data center and request images of any server that handles Tor traffic without a warrant, which would require some tangible evidence to support its release, lest it becomes inadmissible in court.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#49

Post by waterlesscloud »

rglover wrote: post #20

“This is something we want to keep for ourselves,” he said. “The way we do this, we can’t share with the whole world, because we want to do it again and again and again.” That is so freaking evil.

So much for responsible disclosure.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#50

Post by devconsole »

Renaud wrote: post #48
devconsole wrote: post #32

Earlier quoted context omitted.

There are some interesting theories being tossed around. I'd like to add one more. The common thread across all darknet websites is the fact that they generally run from datacenters. Most people don't host websites from their residence. Further, most people don't colocate servers anymore. I would be surprised if any of the 414 websites operated on boxes that had been colocated. However I won't rule out that colocatin…

> Here's how the attack may have happened: Step one, collect data about which computers are sending and receiving large amounts of Tor bandwidth. Step two, if the server resides in a datacenter, request an image of the server. Step three, you now know whether the server is a darknet website. This in itself is not sufficient: there are thousand of Tor bridges, relays and exit points. All of them carry lots of traffic…

Agreed, but the sheer scope of this operation forces us to consider whether the authorities are playing by all of the rules. Since we don't know which rules are still reliable, the best defense is simply to assume your server is compromised from the start. And, incidentally, your support staff.

By the way, I'd also like to thank everyone for the thoughtful responses. It's great that people are thinking about this problem.

Post reply on HN