5 ms·

They located Silk Road 2.0's server in an unspecified way, not directly related to their undercover agent on the support staff. Given that two other darknet mar

They located Silk Road 2.0's server in an unspecified way, not directly related to their undercover agent on the support staff. Given that two other darknet markets (Black Market and Cloud9) have been shut down today, and they didn't specify how they located the SR2 server, it seems plausible that law enforcement have a vulnerability to locate servers over the Tor network. From the complaint: "In or about May 2014, the FBI identified a server located in a foreign country that was believed to be hosting the Silk Road 2.0 website at the time. On or about May 30, 2014, law enforcement personnel from that country imaged the Silk Road 2.0 Server and conducted a forensic analysis of it. Based on posts made to the SR2 Forum, complaining of service outages at the time the imaging was conducted, I know that once the Silk Road 2.0 server was taken offline for imaging, the Silk Road 2.0 websites went offline as well, thus confirming that the server was used to host the Silk Road 2.0 website."[1] Then, as a result of extremely poor OpSec (Benthall accessed the server directly, used his real email for registering the server), they got his IP's and, well, you know where it goes from there. 1. https://pdf.yt/d/RpyX9_xmapTkhmkb https://pdf.yt/d/RpyX9_xmapTkhmkb (Complaint)

DNM_throwaway 12y ago
Since the bigger markets (Evo and Agora) aren't down (as of yet) I think it's probably not a general vulnerability that works for every site. If it did I would assume they would go after the biggest markets too, not the smaller ones who were already mostly dead.
- haakon 12y ago
  They could have located the servers, but not the administrators because they don't do stupid stuff like connect to their servers directly. Perhaps they're just waiting for the admins to make a mistake. Taking down the servers without arresting anyone just isn't the same.
  - acveilleux 12y ago
    The servers may also be located somewhere that is less friendly and will not image the server for them?
    - pcthrowaway 12y ago
      I would argue that makes them more friendly. You would think someone who works for SpaceX would have better sense than to administer is darknet server using his real email address though...
- duaneb 12y ago
  They could even be on the server—knowing where it is doesn't help prosecute those who run it.
deleted 12y ago
[deleted]
celticninja 12y ago
Also given the recent decision in the Ulbricht case that their method of obtaining the server location and contents was not enough to throw out the case may have given them confidence to use the same tactic again. Now they know the law does not apply to them they almost have free reign to bust these markets with whatever resources they have at their disposal.
yourad_io 12y ago
I don't think a single-server hidden service is meant to protect against a global, active adversary. If you think it does I would love to hear your thoughts on my question[1] [1] https://news.ycombinator.com/item?id=8568667 https://news.ycombinator.com/item?id=8568667
jamesbrownuhh 12y ago
> service outages at the time the imaging was conducted That whole "correlation is not causation" maxim comes to mind here.
- sliverstorm 12y ago
  It's part of a greater collection of evidence. Evidence doesn't have to be mathematical proof. A common theme (from what I can tell in law) is that something can never be proven to the rigor of a mathematician, so what happens is you build up piles of "coincidences" until a reasonable person would be hard-pressed to believe they are only coincidence.
  - goatforce5 12y ago
    Hence the idea of reasonable doubt which has a specific meanings in various jurisdictions: http://en.wikipedia.org/wiki/Reasonable_doubt http://en.wikipedia.org/wiki/Reasonable_doubt None of the items taken by themselves are enough to convict (e.g., other people would be tweeting about Silkroad 2 at the same time), but you add it all together (server in his name, piles of unexplained cash and large purchases, tweeting about it, accessing the servers from his machine, etc., etc.) and it starts to look really bad. Plus he's also confessed, apparently.
- diminoten 12y ago
  Evidence is all about correlation. You won't ever find direct causation in a court case. That's what a jury is for.
- gwern 12y ago
  This seems like an excellent example of a 'natural experiment' where the FBI's imaging request serves as an instrumental variable.
NoMoreNicksLeft 12y ago
> it seems plausible that law enforcement have a vulnerability to locate servers over the Tor network. They've bugged nearly all of the entrance and exit nodes. This allows them to do trivial traffic analysis. Parallel construction hides the method from the courts which would be reluctant to rule against anyway.
- typedweb 12y ago
  Or they were just in on it from day 1: https://news.ycombinator.com/item?id=8568765 https://news.ycombinator.com/item?id=8568765 The failures of modern crypto (and historical) are almost always usage bugs, not the technology itself.
- emcrazyone 12y ago
  This may be true but it doesn't seem necessary if you believe this: During the Government’s investigation, which was conducted jointly by the FBI and HSI, an HSI agent acting in an undercover capacity (the “HSI-UC”) successfully infiltrated the support staff involved in the administration of the Silk Road 2.0 website, and was given access to private, restricted areas of the site reserved for BENTHALL and his administrative staff. By doing so, the HSI-UC was able to interact directly with BENTHALL throughout his operation of the website.
  - higherpurpose 12y ago
    Let's see if they take down any more markets, and if all of them have "undercover agents". If not, then it should be clear that wasn't the main method of catching them, but just one to flaunt in front of the press for doing things "old school", and not NSA-style (or with NSA's help).
882542F3884314B 12y ago
Interesting read, some highlights from the complaint: "40. Based on a review of records provided by the service provider for the Silk Road 2.0 Server (the “Provider”), I have discovered that the server was controlled and maintained during the relevant time by an individual using the email account “blake@benthall.net” (“Benthall Email Account-1")." "b. I have also reviewed a publicly available profile of “Blake Benthall” on Twitter, another social networking website, which includes a photograph of BENTHALL as the user of the account, depicting the same individual associated with the GitHub account, discussed above. I have reviewed a post on that Twitter profile, dated on or about November 6, 2013, the date when Silk Road 2.0 was publicly launched, stating: “All this talk about the #SilkRoad being back up makes me want to watch ThePrincessBride.”" "a. I have reviewed records provided by a U S.-based Bitcoin exchanger (“Exchanger-1"), for an account registered under the name “Blake Benthall” and linked to Benthall Email Account-1 (“Bitcoin Account-1”). According to transaction records for Bitcoin Account-1, BENTHALL engaged in his first Bitcoin transaction with Exchanger-1 on or about November 7, 2013, the day after Silk Road 2.0 was publicly launched. The transactional records reflect that, since that date, BENTHALL has received a total of approximately 575.58 Bitcoins into the account through on or about October 28, 2014, and that BENTHALL has exchanged approximately 543.63 of those Bitcoins for United States currency, totaling $273,626.60" "c. I have reviewed emails from Benthall Email Account-1 reflecting that BENTHALL purchased a luxury vehicle with Bitcoins in late January 2014 - approximately one month after Defcon assumed control of Silk Road 2.0. Specifically, email correspondence indicates that, in or about late January 2014, BENTHALL made a down payment of approximately $70,000 in Bitcoins towards the purchase of a Tesla Model S, worth approximately $127,000 in United States currency." "b. Records provided by Exchanger-1 regarding Bitcoin Account-1 indicate that on the same date, BENTHALL logged into Bitcoin Account-1, using the identical combination of software: Google Chrome web browser version 35.0-1910.3 and the Apple OS X operating system, version 10.9.0. "c. According to publicly available information, on or about April 6, 2014, Google Chrome version 35 O.1910.3 was a beta version of the browser,L2 and Apple OS X version 10.9.0 was outdated.B Thus, based on my training and experience, this particular combination of software versions would not have been common among Internet users at the time. The information available to the HSI-UC indicates that Defcon was not using Tor to access the customer support interface at the time, which would have caused Defcon’s browser and operating system to appear differently."
emcrazyone 12y ago
yea, but, there is this tid-bit: "During the Government’s investigation, which was conducted jointly by the FBI and HSI, an HSI agent acting in an undercover capacity (the “HSI-UC”) successfully infiltrated the support staff involved in the administration of the Silk Road 2.0 website, and was given access to private, restricted areas of the site reserved for BENTHALL and his administrative staff. By doing so, the HSI-UC was able to interact directly with BENTHALL throughout his operation of the website." I realize it's vague but seems conceivable this level of access would allow you to connect the dots. No?
- legalbeagle 12y ago
  But how could they know what support staff to infiltrate if they hadn't identified the server? The first step was locating the server. The second step was identifying the individuals and getting evidence against them. The undercover operation couldn't happen (except by accident) until step 2.
  - thefreeman 12y ago
    It seems you read this as support staff for the underlying webhost. However I get the impression the undercover agent had a role akin to an admin or moderator on other user content generated sites. If that was the case, they didn't need to know where the server is hosted. And the "private" parts of the back end very likely opened up methods of code execution on the underlying host (eg. editing php templates, etc.)
fleitz 12y ago
In this case it appears that they have an insider, however, given the ability to analyze internet traffic, and given the ability to DDOS a hidden service which apparently happens quite frequently when new sites appear, with sufficient network analysis it should be possible to determine the end point of the hidden service. Understanding of Tor 1. Hidden services can only exist on one node. 2. That node has a single IP or few IP addresses. How to locate a hidden service given understanding of Tor. 1. Send pulses of traffic to the hidden service (DDOS) 2. Comb through internet traffic logs to identify which IPs saw traffic pulses. 3. Reduce to a few statistically probable nodes matching the pulsed traffic pattern 4. Pulse hidden service again to see if it matches the probable nodes.
deleted 12y ago
[deleted]

DNM_throwaway 12y ago

Since the bigger markets (Evo and Agora) aren't down (as of yet) I think it's probably not a general vulnerability that works for every site. If it did I would assume they would go after the biggest markets too, not the smaller ones who were already mostly dead.

haakon 12y ago
They could have located the servers, but not the administrators because they don't do stupid stuff like connect to their servers directly. Perhaps they're just waiting for the admins to make a mistake. Taking down the servers without arresting anyone just isn't the same.
- acveilleux 12y ago
  The servers may also be located somewhere that is less friendly and will not image the server for them?
  - pcthrowaway 12y ago
    I would argue that makes them more friendly. You would think someone who works for SpaceX would have better sense than to administer is darknet server using his real email address though...
duaneb 12y ago
They could even be on the server—knowing where it is doesn't help prosecute those who run it.

deleted 12y ago

[deleted]

celticninja 12y ago

Also given the recent decision in the Ulbricht case that their method of obtaining the server location and contents was not enough to throw out the case may have given them confidence to use the same tactic again. Now they know the law does not apply to them they almost have free reign to bust these markets with whatever resources they have at their disposal.

yourad_io 12y ago

I don't think a single-server hidden service is meant to protect against a global, active adversary. If you think it does I would love to hear your thoughts on my question[1] [1] https://news.ycombinator.com/item?id=8568667 https://news.ycombinator.com/item?id=8568667

jamesbrownuhh 12y ago

> service outages at the time the imaging was conducted That whole "correlation is not causation" maxim comes to mind here.

sliverstorm 12y ago
It's part of a greater collection of evidence. Evidence doesn't have to be mathematical proof. A common theme (from what I can tell in law) is that something can never be proven to the rigor of a mathematician, so what happens is you build up piles of "coincidences" until a reasonable person would be hard-pressed to believe they are only coincidence.
- goatforce5 12y ago
  Hence the idea of reasonable doubt which has a specific meanings in various jurisdictions: http://en.wikipedia.org/wiki/Reasonable_doubt http://en.wikipedia.org/wiki/Reasonable_doubt None of the items taken by themselves are enough to convict (e.g., other people would be tweeting about Silkroad 2 at the same time), but you add it all together (server in his name, piles of unexplained cash and large purchases, tweeting about it, accessing the servers from his machine, etc., etc.) and it starts to look really bad. Plus he's also confessed, apparently.
diminoten 12y ago
Evidence is all about correlation. You won't ever find direct causation in a court case. That's what a jury is for.
gwern 12y ago
This seems like an excellent example of a 'natural experiment' where the FBI's imaging request serves as an instrumental variable.

NoMoreNicksLeft 12y ago

> it seems plausible that law enforcement have a vulnerability to locate servers over the Tor network. They've bugged nearly all of the entrance and exit nodes. This allows them to do trivial traffic analysis. Parallel construction hides the method from the courts which would be reluctant to rule against anyway.

typedweb 12y ago
Or they were just in on it from day 1: https://news.ycombinator.com/item?id=8568765 https://news.ycombinator.com/item?id=8568765 The failures of modern crypto (and historical) are almost always usage bugs, not the technology itself.
emcrazyone 12y ago
This may be true but it doesn't seem necessary if you believe this: During the Government’s investigation, which was conducted jointly by the FBI and HSI, an HSI agent acting in an undercover capacity (the “HSI-UC”) successfully infiltrated the support staff involved in the administration of the Silk Road 2.0 website, and was given access to private, restricted areas of the site reserved for BENTHALL and his administrative staff. By doing so, the HSI-UC was able to interact directly with BENTHALL throughout his operation of the website.
- higherpurpose 12y ago
  Let's see if they take down any more markets, and if all of them have "undercover agents". If not, then it should be clear that wasn't the main method of catching them, but just one to flaunt in front of the press for doing things "old school", and not NSA-style (or with NSA's help).

882542F3884314B 12y ago

Interesting read, some highlights from the complaint: "40. Based on a review of records provided by the service provider for the Silk Road 2.0 Server (the “Provider”), I have discovered that the server was controlled and maintained during the relevant time by an individual using the email account “blake@benthall.net” (“Benthall Email Account-1")." "b. I have also reviewed a publicly available profile of “Blake Benthall” on Twitter, another social networking website, which includes a photograph of BENTHALL as the user of the account, depicting the same individual associated with the GitHub account, discussed above. I have reviewed a post on that Twitter profile, dated on or about November 6, 2013, the date when Silk Road 2.0 was publicly launched, stating: “All this talk about the #SilkRoad being back up makes me want to watch ThePrincessBride.”" "a. I have reviewed records provided by a U S.-based Bitcoin exchanger (“Exchanger-1"), for an account registered under the name “Blake Benthall” and linked to Benthall Email Account-1 (“Bitcoin Account-1”). According to transaction records for Bitcoin Account-1, BENTHALL engaged in his first Bitcoin transaction with Exchanger-1 on or about November 7, 2013, the day after Silk Road 2.0 was publicly launched. The transactional records reflect that, since that date, BENTHALL has received a total of approximately 575.58 Bitcoins into the account through on or about October 28, 2014, and that BENTHALL has exchanged approximately 543.63 of those Bitcoins for United States currency, totaling $273,626.60" "c. I have reviewed emails from Benthall Email Account-1 reflecting that BENTHALL purchased a luxury vehicle with Bitcoins in late January 2014 - approximately one month after Defcon assumed control of Silk Road 2.0. Specifically, email correspondence indicates that, in or about late January 2014, BENTHALL made a down payment of approximately $70,000 in Bitcoins towards the purchase of a Tesla Model S, worth approximately $127,000 in United States currency." "b. Records provided by Exchanger-1 regarding Bitcoin Account-1 indicate that on the same date, BENTHALL logged into Bitcoin Account-1, using the identical combination of software: Google Chrome web browser version 35.0-1910.3 and the Apple OS X operating system, version 10.9.0. "c. According to publicly available information, on or about April 6, 2014, Google Chrome version 35 O.1910.3 was a beta version of the browser,L2 and Apple OS X version 10.9.0 was outdated.B Thus, based on my training and experience, this particular combination of software versions would not have been common among Internet users at the time. The information available to the HSI-UC indicates that Defcon was not using Tor to access the customer support interface at the time, which would have caused Defcon’s browser and operating system to appear differently."

emcrazyone 12y ago

yea, but, there is this tid-bit: "During the Government’s investigation, which was conducted jointly by the FBI and HSI, an HSI agent acting in an undercover capacity (the “HSI-UC”) successfully infiltrated the support staff involved in the administration of the Silk Road 2.0 website, and was given access to private, restricted areas of the site reserved for BENTHALL and his administrative staff. By doing so, the HSI-UC was able to interact directly with BENTHALL throughout his operation of the website." I realize it's vague but seems conceivable this level of access would allow you to connect the dots. No?

legalbeagle 12y ago
But how could they know what support staff to infiltrate if they hadn't identified the server? The first step was locating the server. The second step was identifying the individuals and getting evidence against them. The undercover operation couldn't happen (except by accident) until step 2.
- thefreeman 12y ago
  It seems you read this as support staff for the underlying webhost. However I get the impression the undercover agent had a role akin to an admin or moderator on other user content generated sites. If that was the case, they didn't need to know where the server is hosted. And the "private" parts of the back end very likely opened up methods of code execution on the underlying host (eg. editing php templates, etc.)

fleitz 12y ago

In this case it appears that they have an insider, however, given the ability to analyze internet traffic, and given the ability to DDOS a hidden service which apparently happens quite frequently when new sites appear, with sufficient network analysis it should be possible to determine the end point of the hidden service. Understanding of Tor 1. Hidden services can only exist on one node. 2. That node has a single IP or few IP addresses. How to locate a hidden service given understanding of Tor. 1. Send pulses of traffic to the hidden service (DDOS) 2. Comb through internet traffic logs to identify which IPs saw traffic pulses. 3. Reduce to a few statistically probable nodes matching the pulsed traffic pattern 4. Pulse hidden service again to see if it matches the probable nodes.

deleted 12y ago

[deleted]