Large Number of Tor Sites Seized by the FBI were Clone or Scam Sites

https://www.nikcub.com/posts/onymous-part1/?resub=1

by nikcub • 12 years ago

99 19 12 years ago

kissickas• 12 years ago

This is quite interesting. It's initially unclear exactly what the angle of this research is, but I think that reflects the uncertainty that still surrounds this operation.

Most notable to me was that the jihad-funding site was left up while its clone was taken down. Does that mean they couldn't locate the server, or that it's controlled by the FBI?

userbinator3• 12 years ago

Most notable to me was that the jihad-funding site was left up while its clone was taken down. Does that mean they couldn't locate the server, or that it's controlled by the FBI?

I was wondering the same thing - and this line from the article too:

In a number of cases the FBI has seized the clone or scam version of a site while leaving up the real site.

Is it because all the clone/scam sites were hosted on the same set of servers, or do the FBI know where the real ones are already but are deliberately leaving it up (and just removing the fakes since they're presumably interfering with their surveillance)?

yc1010• 12 years ago

"The slapshot nature of how sites were seized suggests that rather than starting with an onion address and then discovering the host server to seize, this campaign simply vacuumed up a large number of onion websites by targeting specific hosting companies. We have tracked down the hosting companies affected and the details will be published in a follow-up."

Very interested to see the list of hosting companies that were targeted.

nikcub• 12 years ago

It is the reason why we're asking for administrators of sites that were seized or those at hosting companies to come forward.

Have already spoken to a number of people and got a full list of the hosts involved, but we need a secondary confirmation, or details we can make public, on some of sites and hosts.

Looking at what the seized sites had in common, in terms of host, configuration, etc. narrows down the methods that might have been used to uncover the hidden sites and provides a clearer picture of what went on.

cesarb4• 12 years ago

The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar?

Hosting a hidden service by itself does not mean doing something illegal, even Facebook hosts a hidden service nowadays. The only valid justification for the seizure would be if they had traced an illegal hidden service to that host, but from what I have read this seizure sounds too indiscriminate for that to be the case (IIRC even some pure relays, which don't host anything at all, were seized).

forgottenpass• 12 years ago

The most interesting question to me would be, does this means that the server administrators now have a "get out of jail free card" due to the "fruit of the poisoned tree" doctrine or similar?

That would require the defendant's rights to have been violated. I'm no doctor of law, but even if they were slipshod enough to violate rights in investigation regarding the datacenters, I'd be surprised if the defendants rights were the ones violated (3rd party doctrine and all).

comboy• 12 years ago

I'll just leave it here. For years I've never had any issues with hetzner (having few dedicated boxes in different DCs). Few weeks prior to seizure there were suprisingly long downtimes in a few DCs due to "router issues", and then some with kind of "power outage?".

It is far fetched but if is anything close to truth I cannot imagine how US gov can influence company based in Germany so strongly that it would cost it a lot of reputation and lost clients.

monort2• 12 years ago

Tor TLS traffic can be distinguished by random domain in SNI during handshake (https://news.ycombinator.com/item?id=5505056).

If FBI can sniff all traffic originating from hosting provider, then it seems to be trivial to detect all Tor servers and go through them manually?

userbinator3• 12 years ago

SNI is an extension, it's not required and makes for the traffic to be easily distinguishable, so what's the reason for Tor to send an SNI?

monort2• 12 years ago

Probably it will be even easier to detect Tor nodes - just look for IPs which never receive SNI in TLS exchange on 443 port.

cesarb4• 12 years ago

SNI is optional for clients only in theory. In practice, since there is no way of knowing whether a server needs the SNI hostname to select the correct server certificate, current browsers always send the SNI extension.

Therefore, since Tor tries to mimick common browsers and servers, it must always send a SNI extension.

MisterNegative• 12 years ago

Well this is to be expected if they can force a hosting company to report when servers connect to public tor nodes for a considerable amount of traffic.

Large Number of Tor Sites Seized by the FBI were Clone or Scam Sites

Related Stories