Hacker News Reader

Comment by jascii | Hacker News Reader

The central premise of the article is that there is no disclosure regarding the vulnerability used, suggesting the existence of some unknown zero-day exploit..

Various well documented analysis have linked this incident to "EgotisticalGiraffe", a well known -- and since fixed vulnerability.

FUD or lazy journalism? I mean, at least read the subjects Wikipedia page before publishing something..

View on HN

EgotisticalGiraffe was the JS embedded in Freedom Hosting's web pages, which is mentioned by the article. Are you saying they hacked the site and inserted the JS? I assumed that was inserted after de-anonymizing the server and seizing it.

A Wired article on it:

https://www.wired.com/2013/09/freedom-hosting-fbi/

Slides:

https://web.archive.org/web/20140413004837/http://cryptome.o...

A breakdown of the malware:

https://web.archive.org/web/20140417081750/http://ghowen.me/...

The article explicitly does mention "EgotisticalGiraffe" (the Firefox TBB exploit). But the point is that the exploit was dropped on all websites that Freedom Hosting was running, which raises the question that the article is really about, "how did they know where the hidden services were?"

Could they not purchase some “Freedom hosting” and upload a website with backdoor?

This seems like the easiest way to do it, so I would speculate that this is how it was done. All you have to do is put a website up and make the server phone home, revealing the hidden IP address. Some more speculation: the government is hiding this fact in order to deter criminal use of Tor.

Of course, I would still assume that other ways of discovering the location of hidden services have been found. I'm not convinced that onions can be hidden from an adversary with the resources of a US government agency, particularly in light of some of the posts that appeared on Hacker Factor recently.

How would they FBI know to purchase "Freedom hosting"?

I have searched and reread the article to find this "explicit mention" and have come up empty. Can you be more specific?

Ctrl+F Firefox in the article, there are a few paragraphs on that vulnerability and its role in the article. But that exploit, as I understand it, is not responsible for the first unmasking of Freedom Hosting which is the central question here.

Found it, thanks!

The concern seems to be more of a legal one than a technical one. Law enforcement in theory should always disclose how they collect evidence.

Should they? I know of no such law or theory. They have a burden of proof regarding the correctness of evidence and the defence can question the legality of collection methods if the evidence gets used in court. As far as I know, that's about it.

Does chain of custody have anything to do with this?

I know in some computer forensics work it is important to be able to prove evidence has not been tampered with.

So for example, cracking hashes instead of working with encrypted data can create safe space for non-leo to work without undermining an investigation.

For example, a case of illegal doping, the accused Pearson’s samples must be able to be shown to not have been tampered with.

It seems being able to prove the source of evidence would be the first step of this process.

Chain of custody is one tool used to satisfy part of the burden of proof regarding correctness of the evidence. There are others like sworn testimony or corroborating evidence.

This only is meaningful in a courtroom situation, a lot of "evidence" never sees the courtroom and is merely used as information to help the investigation.

It's crucial to prevent the police from using illegal means to gather evidence. There's a rather famous legal doctrine about it.

https://en.m.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

Reply on news.ycombinator.com