Harvard Student Charged In Bomb Hoax

http://boston.cbslocal.com/2013/12/17/harvard-student-charged-in-bomb-hoax/

by physicsistic • 13 years ago

19 49 13 years ago

boston.cbslocal.com

Torgo2• 13 years ago

http://www.scribd.com/doc/192157170/Eldo-Kim-Complaint

It sounds like they determined from the email provider that the message came from a Tor exit node, then from there they looked for who had made a connection on Harvard campus to known Tor relays. He had, so they interviewed him and he confessed to everything. I don't see any strong indication of a weakness in Tor from this, but it's a bit concerning that you could be interviewed for having used Tor at the same time as something like this. I run a relay full-time, I don't know if this is better or worse for me.

jpwright2• 13 years ago

This basically adds no new information about Tor, except what we already knew -- that you should really have a private bridge, and that Tor traffic is readily discernible from normal traffic (hence, avoid using it on networks where authorization is linked to your identity!). The affidavit doesn't say how they linked the GuerillaMail address to Tor, presumably they used a subpoena.

He could have easily avoided detection (not to say that would have been a good thing) by using something like SkypeMorph (https://crysp.uwaterloo.ca/software/CodeTalkerTunnel.html)

moloch• 13 years ago

Or just not confessed; him using TOR around the same time is not going to be enough to convict him.

quantumpotato_• 13 years ago

Interesting. Isn't Skype owned by M$ though.. ?

beerme• 13 years ago

The GuerrillaMail to Tor link is explained by the last line in GuerrillaMail's TOS (https://www.guerrillamail.com/tos), which says that they inject your IP address into the email's headers. So there was no subpoena required. The use of GM was a no-op in this case.

toki52• 13 years ago

It's not damning at all to have used Tor around that time, but it's not a huge leap of logic, either.

ericcumbee2• 13 years ago

Running TOR at the same time the message was sent. Plus The police do not have to have probable cause to speak to you. Of course what you say back is entirely up to you.

Crito7• 13 years ago

In addition, I imagine a list of students who had finals in those buildings around that time also entered into the equation. Talking to the guy using tor at the time, who had finals at the time, is a no brainer.

throwaway_yy2Di3• 13 years ago

Serious question: why do people talk so highly of a security protocol which even Harvard students fail hard at actually using in real life? If people who are the global 99.999'th percentile of tech literacy lose their lives and careers relying on this stuff, in what way is it a meaningful solution to third-world victims of repressive governments?

I'm assuming at this point that thousands of Syrian, Egyptian, Iranian, Chinese, etc. dissidents are dead from misplaced trust in Tor and other crypto magic, and no one's the wiser.

toki52• 13 years ago

The "failure" you mention here is his confession.

If all they had to go on was what's in the article -- that "the person who used Guerilla Mail used Tor to access it" and "[Kim] used Tor around the same time the e-mails were sent" -- that's not enough to charge him with a crime.

It's enough to go and talk to him about it, but if he had wanted to, he could have protected his identity (but possibly prolonged the investigation, depending on what other resources the agent had) by simply denying that he had anything to do with it.

Torgo2• 13 years ago

I see your point because the fact he used Tor at all led them to him. But it sounds to me like he cracked under police pressure, otherwise they might not have had anything at all on him.

vezzy-fnord• 13 years ago

How did you arrive at the conclusion that because someone is a Harvard student, they're at an intellectual pinnacle and more specifically, are the global 99.999'th percentile of tech literacy?

mindslight5• 13 years ago

Well, it starts with being one of the best tools we currently have to preserve freedom of communication, so getting it in wider use is a good thing. But it's hard to get across the necessity of general free communication to most people basically by definition - otherwise they'd just fix things by voting and technical approaches would be unnecessary. But the democratic mob isn't looking to protect individuals from its wrath, and nuanced arguments about assigning an appropriate context to messages from a public communications network haven't had legs either. So the go-to politically acceptable narrative becomes the standard US callous altruism of undermining other governments.

And yes, by the time you're on a short "of interest" list, you're fucked. (with the only real solution to the traffic fingerprinting being to get peer-talking encryption software in widespread use for everyday tasks).

lvs• 13 years ago

Just to be clear, coming up with this pretty obvious hoax to get out of a final exam isn't a good sign of brilliance. Let's not fool ourselves about the population distribution of intelligence at any institution, and the fact that that distribution must have tails.

alphonse234• 13 years ago

so why didn't he go to starbucks or something to do this, I would have anticipated all this. I guess he was running out of time, and under the pressure he made a careless split second decision.

tedunangst• 13 years ago

As the very first bullet point on the tor project homepage says, "Tor prevents people from learning your location or browsing habits." Why bother going to Starbucks when using tor means you're safe?

anigbrowl4• 13 years ago

I don't think Tor is suspicious as such, it's just that it's sufficiently unusual as to be worth following up for statistical reasons. By consumer standards it's pretty obscure; the same would be true of PasteBin or many other sites where someone might conceivably make a hoax claim.

jpwright2• 13 years ago

Why bother risking expulsion/FBI charges/a tainted professional reputation for the rest of your life for more time on a test? Even if he succeeded, I doubt anyone could pull something like that off and then focus on schoolwork for the next day or two. Plus, <insert snarky comment about Harvard grade inflation here>.

Crito7• 13 years ago

Stress can make people pretty irrational I guess.

I wonder if there is any sort of correlation between the prestige of a school and how often someone calls in a threat or pulls a fire alarm. I had a fire alarm go off while I was taking a final twice when I was in university. Seems like it is probably a semi-frequent occurrence.

alphonse234• 13 years ago

I feel bad for him, 20 years old, got in to Harvard -- had a pretty bright future ahead of him -- he's never going to live this down.

rjbwork• 13 years ago

Firstly, this dude made an incredibly stupid decision to even go through with his plan to get some extra time on a test. Secondly, the way he actually went about doing it was completely asinine. He did it from his own machine on the school's network.

No matter the nature of your activity, if you're trying to obfuscate your identity using systems like TOR and GuerillaMail, you probably shouldn't do it on the network of the people you're attempting to hide your identity from...

koenigdavidmj• 13 years ago

Seems similar to how Jeremy Hammond was caught: they suspected that he was a particular IRC user, and correlated his login/logout times with actual comings and goings from his residence.

Techskeptic• 13 years ago

Did anyone really think this was anything other than a kid not wanting to take a final? Seriously, this was happening at my high school. Ffs.

belluchan• 13 years ago

Seems like all he had to do was say nothing and all they would have had on him is access to tor.

Aqueous• 13 years ago

Looks like he succeeded in delaying his final exam, potentially for many years

Harvard Student Charged In Bomb Hoax

Related Stories