Live data from Hacker News

Running a Dark Web pedophile honeypot

geekslop.com

11–20 of 185 posts

Re: Running a Dark Web pedophile honeypot

#11
post #8

> On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. The FBI twice rejecting a set of information that could have reasonably led to the arrest of several pedophiles seems like a big mistake.

"full sets of data" seem to include Tor exit node IP addresses (public information that you can obtain from the Tor directory service) and a few possible real IP addresses—but not ones he can directly tie to any actual CP. As he says, "Admittedly, after introducing the security scanner, traffic patterns changed. Scans on the server dropped and some of the users who opted to run the software appeared to be government or private researchers. Most visitors were reluctant to run the security scanner." Later he says that between 4 and 7 percent of his registered users ran the scanner. He never says how many registered users he had, and never said how many uploaded child porn or could be directly connected to it (and how many of those ran the scanner)

I'm not surprised the FBI turned him down.

Re: Running a Dark Web pedophile honeypot

#12
post #8

> On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. The FBI twice rejecting a set of information that could have reasonably led to the arrest of several pedophiles seems like a big mistake.

Personally I'm glad some random guy can't hand off a whole bunch of IPs to the FBI and tell them they're all pedophiles. I'm sure it would cost thousands of dollars to sift through the data too, and would be pretty useless seeing as the guy wasn't hosting child porn.

Besides, taking down these pedophiles might be "fun" to some people, but if you really want to help children you need to go after the people producing/hosting child pornography.

Re: Running a Dark Web pedophile honeypot

#13
"pedophiles use encryption, so encryption is the devil." seems to be where this is going. That's a slippery slope and a bit unethical to use pedophiles to push an authoritarian political agenda. I bet it's fun to call all his critics pedophile sympathizers and sit upon a moral high-horse of self-righteousness while pushing his authoritarian ideology under the guise of social justice.. That's the thing about these people, they take on social issues for which they can't be criticized without the criticizer looking like a pedophile, racist, or a misogynist. I guess it gives them a sense of power.

Re: Running a Dark Web pedophile honeypot

#14
post #2

Is it just me, or the rhetorical question in the title ("why I now think Tor is the devil") never got answered? Also not clear whether the Dark Web spider project was just to later seed the honeypot sites to appear legit, or was it a project on its own? The quote "The reports are published nightly on a hacker-related Dark Web site that I am involved with" hints at the latter, and then I'd double don't understand why…

The crawler project was a project on its own but after discovering that the many of the discovered sites were pedophile-related, I started to shut down the spider. Then I figured, what the heck, maybe I can hack around on Tor and see how close I can come to determining their real identity. For those that chose to run the scanner, their identity was revealed (name, IP, and enough of a hardware footprint to identify their machine).

Re: Running a Dark Web pedophile honeypot

#15
post #12
post #8

> On two different occasions I contacted the FBI about the project and offered to provide full sets of data that I had collected. The FBI twice rejecting a set of information that could have reasonably led to the arrest of several pedophiles seems like a big mistake.

Personally I'm glad some random guy can't hand off a whole bunch of IPs to the FBI and tell them they're all pedophiles. I'm sure it would cost thousands of dollars to sift through the data too, and would be pretty useless seeing as the guy wasn't hosting child porn. Besides, taking down these pedophiles might be "fun" to some people, but if you really want to help children you need to go after the people producing/h…

> In this particularly disturbing case, a father of three hints that he is willing to share pictures of his children.

> npt@hotmail.com: hi im a married dad of 3, i prefer girls from pt to jb. I’m looking forward to joining in and sharing in the community

A little later in the article there is an entire section devoted to his findings that many visitors of the site were predators seeking to do more than look at photographs. In addition,

> Many visitors offered photos from their “private collection” as a means to bribe me for entrance to the website. They took care to note that the material they were offering me was original.

Re: Running a Dark Web pedophile honeypot

#16
As a father of a little girl, this is a depressing read for me. Yes in the back of my mind I know this stuff is going on but it's really sad seeing the collection of data showing people who are partaking in this stuff.

Also this gave me a nasty flashback of looking at filenames (never content) of deleted files in the process of gathering evidence against a family member who now sits on the registered sex offender list...

Re: Running a Dark Web pedophile honeypot

#18
post #10
post #7

Some of the technical points of this article are simply wrong... > The exit node IP address of the user was easily obtained using the two different methods discussed briefly above. This is really not a vulnerability but simply how tor, and the internet at large, works - hidden services by design protect the service not the user (the user is protected by tor by default) - what the author actually did here was "leak" t…

The author appears to believe that "Tor is the devil" because "4,000-5,000 hidden services are running at any given time. Secondly, the content served by these sites is almost universally illegal or immoral (by my definition anyway). A conservative estimate would be maybe 1 out of 200 or so hidden service websites contain content I would deem worthy of the protection an anonymous network provides. Sites featuring fre…

Are knives the devil, because knives can be used to kill people?

Re: Running a Dark Web pedophile honeypot

#19
post #12

Earlier quoted context omitted.

Personally I'm glad some random guy can't hand off a whole bunch of IPs to the FBI and tell them they're all pedophiles. I'm sure it would cost thousands of dollars to sift through the data too, and would be pretty useless seeing as the guy wasn't hosting child porn. Besides, taking down these pedophiles might be "fun" to some people, but if you really want to help children you need to go after the people producing/h…

> In this particularly disturbing case, a father of three hints that he is willing to share pictures of his children. > npt@hotmail.com: hi im a married dad of 3, i prefer girls from pt to jb. I’m looking forward to joining in and sharing in the community A little later in the article there is an entire section devoted to his findings that many visitors of the site were predators seeking to do more than look at photo…

Isn't that pretty much what the author was doing? Offering child porn to people on tor? How do we know the people contacting him weren't trying to honeypot him?

Re: Running a Dark Web pedophile honeypot

#20
post #2

Is it just me, or the rhetorical question in the title ("why I now think Tor is the devil") never got answered? Also not clear whether the Dark Web spider project was just to later seed the honeypot sites to appear legit, or was it a project on its own? The quote "The reports are published nightly on a hacker-related Dark Web site that I am involved with" hints at the latter, and then I'd double don't understand why…

Yeah this is clearly by someone who doesn't really understand how Tor works. Revealing exit node IP addresses is completely useless—this is a fundamental tenant of Tor's security. In fact, I believe that at any given time you can easily query the network for a list of all Tor exit nodes. I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm…

It was 4-7%. I pre-wrote the article estimating the final numbers and then shut down the site two days early. Traffic dropped suddenly leading me to believe something was up.

The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities.

My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.

Post reply on HN