Feds found Silk Road 2 servers after a six-month attack on Tor?

http://www.theverge.com/2015/1/21/7867471/fbi-found-silk-road-2-tor-anonymity-hack

by kryptiskt • 12 years ago

194 85 12 years ago

Zikes9• 12 years ago

So the FBI knowingly attacked a civilian communications network, potentially causing a great deal of harm to the entire network in order to catch a few bad apples.

Like nuking a city because you're pretty sure you'll get a few bad guys.

tptacek10• 12 years ago

If the network can't ensure anonymity against bad actors, it was already fatally broken. If the consequence is improvements in Tor that break the attack, and the cost is a prosecution against someone breaking black-letter law, the result are a net-positive for civil liberties.

Zikes9• 12 years ago

We can't ignore the potential collateral damage. Even the attempt, due to its inherently indiscriminate nature, is a violation of citizens' fourth amendment rights.

By your reasoning we should expect that they can kick in every door in a city looking for a suspect, then blame the doors for being too weak.

jes• 12 years ago

I agree with your last sentence, as long as the black-letter law that is being violated is itself moral. I question the morality of many drug laws, however.

__xtrimsky• 12 years ago

nuking kills. slowing down a network you are not forced to use? fine by my standards.

Zikes9• 12 years ago

This isn't about the performance of the network. They could've brought it offline and that wouldn't have been as egregious an affront. They willfully subverted the network to invade the privacy and anonymity of the people using it. Regardless of the purpose, the potential damage to the people using it for any reason is too great to ignore. Political dissidents, whistleblowers, journalists, lots of people rely on Tor, and who knows how much of their information was exposed as a result.

rosser• 12 years ago

In the case of political dissidents in repressive regimes, compromising Tor can also kill.

JohnTHaller2• 12 years ago

Over 80% of Tor hidden service visits are related to child pornography.* A 'few bad guys' is stretching things a bit. Additionally, they didn't nuke anything, Tor continued to function, albeit with a wide open security flaw that multiple actors besides the ones mentioned here were exploiting.

* http://www.wired.com/2014/12/80-percent-dark-web-visits-rela...

gwern4• 12 years ago

Under a very uncertain traffic measurement methodology which plausibly biases towards very evanescent .onion addresses.

Zikes9• 12 years ago

And over 70% of emails are spam[1], so we should route every email we send through the FBI/NSA?

That other 20% of Tor usage may very well be political dissidents, whistleblowers, or average Joes that just don't want half the world watching everything they do and say online.

[1] http://www.kaspersky.com/about/news/spam/2013/Spam_in_Q2_201...

lucastx• 12 years ago

The title of this Wired article is somewhat over the top. It is about a (then) upcoming Gareth Owen's presentation on 31C3.

I just watched it [1] yesterday, and Gareth Owen himself says that this number is the count of a certain kind of hidden service request that should not be confused with "visits" or "visitors", for a number of reasons. The main ones I remember are:

- The specific kind of request measured is the first step towards connecting to the service, but may not always represent a complete connection that can be mapped to a individual

- Various anti-childporn organizations crawl the dark web constantly searching and indexing child pornography hidden services

[1] http://media.ccc.de/browse/congress/2014/31c3_-_6112_-_en_-_...

ineedtosleep• 12 years ago

Over 90% of public roads service drunk drivers, drug dealers and most known and unknown criminals.

All users of such roads should be searchable at any given moment.

lotsofmangos• 12 years ago

Tor is hardly a civilian network. It is quick and dirty secure communications for intelligence agents, developed by the Naval Research Laboratory. The civilians on tor are doing the useful job of adding routing complexity, which is probably why it was publicly released in the first place, as if it was only agents on there it would be useless for the job.

higherpurpose• 12 years ago

Billions are "collateral damage" in US government's "cyberwar". We even know now that NSA routinely captures botnets and "repurposes" them - anyone remember the Wikileaks DDoS? That one was quite obviously done by the NSA/FBI, but they may do it against other targets as well, in a much more subtle way or even blame it on someone else.

gwern4• 12 years ago

OP is wrong. Weaver is (as usual) jumping to conclusions and sensationalizing (not that he did any of the work to turn up these search warrants or is deeply familiar with the topic matter... He predicted all the blackmarkets would be dead by now; how's that going?).

What we know, after I and Moustache and DeepDotWeb have gone through the warrants & complaints, is that a handful (~78) IPs were deanonymized as late as July 2014 after accessing the Silk Road 2 vendor .onion. This is almost certainly due to the UC account 'Cirrus' in some form, who was perfectly placed to de-anonymize the SR2 servers and insert a payload into the landing page. A former SR2 employee says they were even using crummy commercial software like 'DeskPro' on the SR2 servers.

In other words, right now the evidence is consistent with a Freedom Hosting redux scenario: the FBI has gotten another Tor Browser or other browser exploit and then phoned home. It could also be the big mysterious attack, but why would they do that when they had an insider who was involved in hiring additional employees? And also given that the SR2 vendor onion should have been seeing a lot of traffic from vendors who almost all preferred to use it due to better uptime, a mere 78 IPs sounds low.

Further reading:

- https://www.reddit.com/r/DarkNetMarkets/comments/2sppy0/sr2_...

- https://www.reddit.com/r/DarkNetMarkets/comments/2t30hs/the_...

praptak• 12 years ago

It sounds like running the server on a heavily un-trusted and sandboxed machine would prevent this class of attacks, right?

I mean a machine set up so that even if attacker gets root, they can still only send Tor traffic.

xorcist• 12 years ago

That is also not surprisingly best practice, according to the Tor documentation.

You shouldn't trust it completely since there are always escapes from virtual environments but there's no reason not to.

guelo2• 12 years ago

The conclusion is being jumped to because the timeline of the attack described in the July Tor blog post matches perfectly with the timeline of the investigation described in the SR2 court docs.

It seems very plausible to me.

tptacek10• 12 years ago

To distill 'gwern's comment even further:

He's saying that warrants and filings show that FBI had an insider positioned to subvert SR2's servers. If you have that vantage point, a worldwide traffic confirmation attack on Tor is a oddly elaborate way to scoop up SR2 vendors. Why not just use the SR2 servers to trick the vendors?

Observe that the relay-early traffic confirmation attack would be a technical effort unprecedented for the DoJ, whereas implanting a backdoor into a web app is already par for their course.

The Reddit threads 'gwern links to talk more about the implications of the timing. At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.

na85• 12 years ago

What about the "parallel construction" scenario whereby NSA uses their alleged attack against Tor to deanonymize SR2, and the Cirrus UC is simply a construction?

Can this be ruled out or unlikely?

gwern4• 12 years ago

We can't rule it out, no. Just comment that it does not seem necessary at this point: Moustache's doxing of scout/Cirrus shows that she could have been easily busted, we know that she was subverted early on (it was rumored at the time, in fact - 'emailgate'), once the account was taken over, then it is perfectly capable of de-anonymizing a server (de-anonymizing is really easy; I've de-anonymized or helped de-anonymize at least 2 blackmarkets myself, and actually, just today someone has found another way SR1 could have been de-anonymized easily, although I can't go into details), and currently the seller/employee busts are consistent with the Freedom Hosting attack, which no one needs to ascribe to parallel construction (since we know it was an obsolete NSA attack which got reused).

nikcub2• 12 years ago

Based on the current public info, nothing can be confirmed completely or discounted completely.

Currently there are only two pieces that points towards the Sybil attack being used against Tor:

1. Some Tor Hidden Services were uncovered

2. The dates just happen to match dates a research project were running

But there is a lot more pointing away from it: the main points are:

1. The FBI already had a source in SR 2.0

2. It is easier to uncover hidden services using endpoint hacks rather than global deanon

3. Given the ability to deanon parts of the Tor network, the feds would have targeted the larger markets and got a lot more arrests. It isn't a coincidence they just happen to take down the sites with the worst software stacks, security architectures and operational techniques.

mrb• 12 years ago

Edit: Ars Technica also published a nice article about the attack today: http://arstechnica.com/tech-policy/2015/01/did-feds-mount-a-...

My technical summary is that we now think it is the feds who initiated this 6-month long attack [1] which consisted in them using "a combination of two classes of attacks: a traffic confirmation attack and a Sybil attack." They ran many (115 to be exact) non-exit Tor relays on 50.7.0.0/16 and 204.45.0.0/16 (Sybil attack) to increase their chances of controlling both ends of a Tor circuit: the first relay (entry guard) reached by the SR2 server and the last relay used as a hidden service directory where the service is published. The feds' relays then actively modified traffic to inject a signal into the Tor protocol headers (bits encoded as a sequence of "relay" and "relay early" commands) to help them correlate traffic from one end of the circuit with the other end (traffic confirmation attack). So whenever the SR2 hidden service was being published (which happens whenever the server reconnects to the Tor cloud?) the last relay knew it was for the SR2 service (but didn't know the server IP), and could correlate it with the entry guard which knew the IP address (but didn't know the service name). Once they knew the SR2 server IP, the game was over.

[1] https://blog.torproject.org/blog/tor-security-advisory-relay...

at-fates-hands2• 12 years ago

I remember seeing a Def Con presentation about this by the guy who founded Derby Con. Can't find it right now, but will post it if I can find it again.

at-fates-hands2• 12 years ago

Not sure why I can't edit my original comment, but whatever.

Here is the presentation Adrian Crenshaw gave at DefCon 22 called "Dropping Docs on Darknets: How People Got Caught"

Great presentation: https://www.youtube.com/watch?v=eQ2OZKitRwc

Zikes9• 12 years ago

I'm getting some surprisingly mixed messages on here because I've come into the discussion with a couple of assumptions, so I'd like to try to clear those up.

1. Do we have the right to private, secure, anonymous communications?

2. If yes, do we have the right to be outraged when our government attempts to subvert our private communications, most especially with broadly-scoped warrants or tactics that can expose your communications to any potential listeners?

diminoten• 12 years ago

You have a right to be outraged over anything you like, one does not follow from the other.

However outrage doesn't do anything. It's not useful. What's useful is a better service for obtaining #1.

nickysielicki2• 12 years ago

Let me rephrase for him,

"Is it reasonable to be outraged..."

tedunangst5• 12 years ago

If nobody is trying to subvert your private communications, you don't need secure private communications in the first place. If you assume you need secure comms, you should assume people will try to subvert and break your secure comms.

nickysielicki2• 12 years ago

"If nobody is trying to search your home, you don't need locks in the first place."

kilovoltaire• 12 years ago

"Silk Road 2 wasn't vulnerable to the same CAPTCHA attack that gave away location of the first Silk Road's servers"

In case I'm not the only one who hadn't read about how the first Silk Road got caught, it's simple but interesting:

http://krebsonsecurity.com/2014/09/dread-pirate-sunk-by-leak...

nikcub2• 12 years ago

It also isn't true:

https://www.nikcub.com/posts/analyzing-fbi-explanation-silk-...

Krebs also posted an update (which he should probably link to from his 'leaky captcha' post):

http://krebsonsecurity.com/2014/10/silk-road-lawyers-poke-ho...

geographomics• 12 years ago

We know that a global adversary exists, and that Tor is vulnerable to certain types of attacks by such an adversary (e.g. [1,2]). Given that the list of relays is public by design, that their (albeit encrypted) communication can be monitored by the adversary, that popular hidden services will be moving a significant amount of traffic to and from a single static IP address in a manner modifiable by any user of it, and that there are known methods of disrupting hidden services to effect a global change in this [3] - it follows that such hidden services are rather more vulnerable to deanonymisation, compared to most other users. Seems like running one is an incredibly risky thing to be doing.

[1] http://cryptome.org/2013/08/tor-users-routed.pdf

[2] https://mice.cs.columbia.edu/getTechreport.php?techreportID=...

[3] http://donncha.is/2013/05/trawling-tor-hidden-services/

Feds found Silk Road 2 servers after a six-month attack on Tor?

Related Stories