Live data from Hacker News

Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

wired.com

81–90 of 136 posts

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#81

Lessons learned: 1) Don't engage in businesses that make you a target of the world's best-funded law enforcement agencies. 2) If ignoring lesson 1, don't access servers directly, from home, and don't pay for said servers with personal credit card. 3) Don't pay for your $130K Tesla using BTC a month after you open up a massive illegal drug marketplace that runs exclusively on BTC. Someone may suspect something. 4) Whe…

Also trust no one and don't give other people you don't know access to your personal details or the server that hosts the website. They could be (and in this case were) Law Enforcement.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#82

Earlier quoted context omitted.

Then the authorities trace the server component to the person who sold it on Craigslist. And if your opsec isn't perfect, you're busted right there: Did you forget to set up a new email account for all of your craigslist transactions? Did you forget to set them up and connect to them only through Tor? Did the person you met with write down your license plate number? Seem unlikely? Think again. Cameras write down your…

> Then the authorities trace the server component to the person who sold it on Craigslist. And if your opsec isn't perfect, you're busted right there: Did you forget to set up a new email account for all of your craigslist transactions? Did you forget to set them up and connect to them only through Tor? If your opsec isn't perfect you are busted anyway. You already said that in the OP. ;) > Did the person you met wit…

This is a perfect illustration of how to get busted. For example, the whole idea of "How can I acquire a burner phone?" is misguided, because as soon as you speak into a burner phone, your voiceprint alone is enough to identify you.

Various assumptions like "I doubt it's that easy" are also the road to getting busted.

Trying to forge or steal legal documents, let alone a license plate that you drive around with and which officers can notice at any time, is also how to get busted.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#83
post #73
post #20

“This is something we want to keep for ourselves,” he said. “The way we do this, we can’t share with the whole world, because we want to do it again and again and again.” That is so freaking evil.

Revealing the trick and giving illegal ops a hint on what not to do would be much much more stupider, innit?

Depends. What if they're using vulnerabilities that affect a wide variety of sites?

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#84
post #77
post #72

Earlier quoted context omitted.

Don't think that'd add anything. The people investigating you would presumably look at your network traffic and see all of the non-anonymized TLS packets traveling between your VPS and the real server. And they shouldn't need to bring the VPS down to get an image of its disk (or its RAM).

Of course tho' I doubt it be enough for evidence in court especially if everything is bought with fake aliases. And the saving memory contents (could hold config files on tmpfs for example) seems to be a difficult process, from wikipedia "Holding unpowered RAM below −60 °C helps preserve residual data by an order of magnitude, improving the chances of successful recovery. However, it can be impractical to do this dur…

They could just write the memory to disk. https://www.suse.com/documentation/sles11/book_kvm/data/sec_...

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#85
As much as this story interests me on deeper levels, my brain keeps wanting to think of it as a misspelled or mispronounced "Operation Ominous" rather than subtracting the "an-" prefix to negate "anonymous" (which they undoubtedly thought was very clever).

And I do find it very ominous that apparently the only way that I can speak and act freely over the Internet is to maintain absolutely perfect operational security across an entire group of individuals that I already know enough to trust, thanks to out-of-band signaling.

While I don't really have anything to plan or discuss that would be considered threatening to any current regime, I also know that regimes change and evolve, and the Internet is rather capricious with regard to what it forgets. I have to wonder if someday even my posts on HN will be used against me at a time when prison, or execution, or even just denial of a benefit is a possibility.

Right now, they are busting folks for trading contraband and criminal services. But it somehow feels like the evidence of massive surveillance and interdiction is more threatening to me personally than the existence of the online black markets. Perhaps I'd just like to pretend that in theory, I could defy an objectionable government edict and not get squashed like a bug. I'd like to believe that the spirit of rebellion still lives among the people, and that the underdog can still put up a good fight, even if they can't actually win.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#86

Lessons learned: 1) Don't engage in businesses that make you a target of the world's best-funded law enforcement agencies. 2) If ignoring lesson 1, don't access servers directly, from home, and don't pay for said servers with personal credit card. 3) Don't pay for your $130K Tesla using BTC a month after you open up a massive illegal drug marketplace that runs exclusively on BTC. Someone may suspect something. 4) Whe…

Also trust no one and don't give other people you don't know access to your personal details or the server that hosts the website. They could be (and in this case were) Law Enforcement.

Forgot to mention bragging, that is one thing people like that tend to do, in due time.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#87
post #60
post #48

Earlier quoted context omitted.

> Here's how the attack may have happened: Step one, collect data about which computers are sending and receiving large amounts of Tor bandwidth. Step two, if the server resides in a datacenter, request an image of the server. Step three, you now know whether the server is a darknet website. This in itself is not sufficient: there are thousand of Tor bridges, relays and exit points. All of them carry lots of traffic…

>This in itself is not sufficient: there are thousand of Tor bridges, relays and exit points. All of them carry lots of traffic and all of them could be hosting hidden services as well. The total traffic in itself doesn't necessarily show that a server hosts hidden services. It could also me masked by generating fake traffic to/from the server. Relays (exit and non-exit relays) are listed in the consensus, so you can…

> but now, the only thing necessary to get someone to kill someone else is a stern command. If you don't believe me, look up the Milgram experiments

I think you're being a bit hyperbolic here.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#88

Earlier quoted context omitted.

They don't have to break Tors crypto to figure out where hidden services are. They just need to identify which IPs are consistantly connected to the Tor network, and then prod them and see if the hidden service goes offline. That is one of the reasons why you're absolutely not supposed to run a relay from the same IP that you run a hidden service from. Because your IP is published if you do that. If I were to run suc…

Actually a relay will be awesome way to mask a hidden service, if TOR encryption holds.

No, it is an extremely bad idea to do that:

http://cybermashup.com/2013/09/04/dont-run-a-tor-router-and-...

And something a little more "official" from https://www.torproject.org/docs/tor-hidden-service.html.en -

"It is generally a better idea to host hidden services on a Tor client rather than a Tor relay, since relay uptime and other properties are publicly visible."

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#89
post #60

Earlier quoted context omitted.

>This in itself is not sufficient: there are thousand of Tor bridges, relays and exit points. All of them carry lots of traffic and all of them could be hosting hidden services as well. The total traffic in itself doesn't necessarily show that a server hosts hidden services. It could also me masked by generating fake traffic to/from the server. Relays (exit and non-exit relays) are listed in the consensus, so you can…

> but now, the only thing necessary to get someone to kill someone else is a stern command. If you don't believe me, look up the Milgram experiments I think you're being a bit hyperbolic here.

Look up the Milgram experiments and tell me I'm being hyperbolic.

Re: Global Web Crackdown Arrests 17, Seizes Hundreds Of Dark Net Domains

#90

Earlier quoted context omitted.

It's an interesting idea. I think physically shipping a server to a datacenter is precarious. Remember, it is known that your server is hosting a darknet website. You can't really hide this fact. Timing correlations make it possible to figure out which server is doing what. The reason that Tor users are generally safe from this is because they're not constantly connected, and an adversary generally can't cause a clie…

I'm probably naive, but any computer a crack-head customer can find, can not be rocket science for the FBI to find. Right?

Learn about Tor. A key distinction is that the "crackhead" Alice is only communicating with the "pusher" Bob, but the location of Alice and Bob is a secret.

http://en.m.wikipedia.org/wiki/Tor_(anonymity_network)

Post reply on HN