Hacker News Reader

Comment by davmre | Hacker News Reader

Apparently the FBI managed to track down the actual server running the site:

  During the course of this investigation, the FBI has located a
  number of computer servers, both in the United States and in
  multiple foreign countries, associated with the operation of Silk
  Road. In particular, the FBI has located in a certain foreign
  country the server used to host Silk Road's website (the "Silk
  Road Web Server"). Pursuant to a Mutual Legal Assistance Treaty
  Request, an image of the Silk Road Web Server was made on or
  about July 23, 2013 and produced thereafter to the FBI.

This server image seems to have been the source of a lot of the evidence leading to the arrest warrant: the IP logs that matched his location, an account name that matched his StackOverflow account, and of course all the private messages and chat logs regarding his personal location (messages indicating Pacific time), operation of the site (payments to other admins), and the extortion attempt/attempted hit.

What the complaint doesn't specify is how the FBI managed to locate the Silk Road server. It's possible that they already had some suspicion of DPR's identity, and managed to bug his computers or otherwise track his activity well enough to figure out what systems he was logging into. But given how coy the complaint is about this, I wonder if in fact this is the result of a sophisticated analysis of Tor network traffic (possibly in collaboration with the NSA?). If that's the case, it betrays a level of capability that ought to be frightening for the operators of other anonymous Tor services. Anyone with more Tor expertise want to comment on how likely this is?

Edit: the excerpt quoted is from the (now unsealed) FBI complaint, first linked elsewhere in this thread: http://krebsonsecurity.com/wp-content/uploads/2013/10/Ulbric.... The whole thing is pretty interesting reading.

View on HN

Haven't finished the complaint yet, but it looks to me like the FBI found a security vulnerability in the Silk Road website itself. More specifically, it looks like they found a way to have the PHP source code sent as an HTTP response rather than have that PHP code executed and send its output. From page 27 of the complaint:

  Further, based on forensic analysis of the Silk Road
  Web Server, I know that the server includes computer
  code that was once used to restrict administrative
  access to the server, so that only a user logging
  into the server from a particular IP address,
  specified in the code, could access it.

The report later goes on to say that they mapped that IP address to a VPN provider whose account was set up from an internet cafe near the house of a friend of DPR.

It looks like they first started suspecting Ulbricht when one of the forum account usernames he used to market Silk Road, "altoid", posted the GMail address "rossulbricht@gmail.com" when looking for technical help. From page 26 of the complaint:

  From further reviewing the Bitcoin Talk forum,
  Agent-1 located another posting on the forum by
  "altoid," made on October 11, 2011, approximately
  eight months after his posting about Silk Road.
  In this later posting, made in a separate and
  unrelated discussion thread, "altoid" stated that
  he was looking for an "IT pro in the Bitcoin
  community" to hire in connection with "a venture
  backed Bitcoin startup company." The posting
  directed interested users to send their responses
  to "rossulbricht at gmail dot com" - indicating
  that "altoid" uses the e-mail address 
  "rossulbricht@gmail.com" (the "Ulbricht Gmail
  Account").

After DPR's mistake of using the same account to market Silk Road and solicit help with an email address, the FBI seems to have used good old-fashioned legwork to subpoena records and build a case against DPR.

Super interesting read!

Where in the complaint do you see evidence of a website vulnerability? The part you quoted just reads to me as describing DPR's use of a VPN, with the "forensic analysis" part referring to analysis of the disk image after the server had already been identified and imaged.

That said, a security vulnerability in the website does seem like a really plausible conjecture: it's hard to write that much PHP code and not screw up somewhere, especially given that he was probably doing most of it himself, without anyone to do independent QA. And even if the site code itself was fine, the Silk Road is a high-enough value target that the FBI might have thought it worth using a PHP 0-day. Once they're into the site, it's probably not hard to get it to dump an IP address or other externally identifying information.

Yeah, that was a bit of a logical leap. I can see that the code analysis was probably done after getting a disk image now. I think the original lead probably came from his second bitcointalk "altoid" post, though.

Don't forget there was a glitch with SR about 8 months ago where it was briefly returning the real IP address of the server on an error page.

> the FBI seems to have used good old-fashioned legwork to subpoena records and build a case against DPR.

That may be; or maybe they just Parallel Constructed a proper looking investigative trail.

I was thinking the exact same thing. +1 to you sir.

I was told their Apache's error pages leaked "too much information", including the server's IP address. Maybe no breach was needed if this is true.

I'm not super familiar with this case or the ATT vs weev one, but I thought I read that the prosecution in the weev trial made the argument that accessing information in the open, like that of server logs is hacking? If that precedent was set, wouldn't that have an effect on when a warrant is required or no? Just curious

No. A warrant means you can do extra special stuff, like search someone's house. With a warrant, you can search for whatever you like, however you like.

Told by who?

The FBI Complaint, for one.

  ... I know that, on May 24, 2013, a Silk Road user sent
  him a private message warning him that "some sort of
  external IP address" was "leaking" from the site, and
  listed the IP address of the VPN Server.

The Footnote labeled 4, bottom of page 28.

http://www1.icsi.berkeley.edu/~nweaver/UlbrichtCriminalCompl...

edit and off-topic rant: I really hate searching government PDFs.

There WAS such an issue generally with PHP installed as CGI: a query arg like ?-s would be passed as a command line -s switch to the PHP interpreter spawned. http://www.php-security.net/archives/9-New-PHP-CGI-exploit-C...

Well how about that. Thanks for the link.

I remember reading an article in 2600 where someone figured out that quite a few websites took a PHP filename as a query arg to be eval'd... and some subset of those had no mechanism in place to restrict it to local files. Needless to say, they could point that arg to example.com/malicious.php and have it run on the vulnerable box.

The best part was that they constructed a Google query to find sites that would eval remote PHP code. It was something else!

That was my first lesson in validating any external input. Learned the hard way, in my first six months of building websites professionally. Happily, the hosting provider put me onto a helpful tech guy who walked me through what I'd done and how to avoid it. There was a lot less 'common knowledge' and 'everyone knows' in 2001.

...a vulnerability that affected near zero actual servers. (I know because I scanned for it shortly after the announcement) Everyone uses FastCGI or mod_php and friends.

The agent is discussing source code he inspected likely after acquiring an image of the server. The vulnerability you described isn't how they got their information.

I'm reading through it now, but it's still not 100% clarified how they originally determined the true IP and provider of the server. There are a myriad of different ways, though.

Kind of shocking though if NSA didn't use a PHP vulnerability. PHP has more leaks than Chelsea Manning.

Care to name 5?

http://www.cvedetails.com/vulnerability-list/vendor_id-74/pr...

Actually, all of the severe bugs there are fixed and/or no longer apply.

Linking to ancient bugs that were fixed a long time ago is pointless, every popular piece of server software would have bugs.

So, care to name five?

Once bitten, twice shy.

Sure, do you have $50,000?

This is why you don't do an interview with Forbes and thumb your nose at the FBI when you're running an illegal operation. When I saw that interview, I knew his days were numbered.

http://www.forbes.com/sites/andygreenberg/2013/08/14/an-inte...

By the time that interview was posted in August, the FBI had already imaged the SR server (in July).

From the Forbes article: "So this was not merely a distributed denial of service attack? It was a zero day exploit? Did it gain access to any data or simply knock the site offline?

I’m not one hundred percent on this, but I don’t think it’s possible to do a DDoS over Tor, or at least it is much harder than doing it over the clear net. The effect of the attack was to block access to Silk Road. No data was leaked, in fact we’ve never had a data leak. "

Posted after the feds imaged the server. OOOPS. Hubris is dangerous.

If the guy had never talked to the press at all... you think the FBI and DEA would have just ignored a massive drug marketplace running essentially out in the open?

I think the point here is that, even though the letter agencies would not have ignored it... they surely got a lot more "incentives" internally to focus on SR when it got more mainstream attention. More analysts, more easily approved wiretapping/surveillance actions (not that they need approvals of any kind nowadays), essentially more money into it.

People slip, it's inevitable. How fast that happens probably got accelerated by SR's owner appearances and the dent it was making in the agencies' reputation.

This is like saying nana nana boo boo stick your head in doo doo. You can't run an illegal business and then vehemently flaunt it to a major news publication that gets read around the world essentially saying that your smarter than the government won't end well for anyone.

I'm going to assume the FBI (or DEA) were going after Silk Road, interview or not.

Rather, the type of person who was willing to engage in illegal activities while also doing a high-profile interview was unlikely to be the sort of person who was paranoid enough to cover their tracks (e.g., avoid re-using handles and other identifying information).

Not an expert, but I've heard a lot of people discussing how Tor can be compromised via timing analysis and owning enough exit nodes. Which is well within the capabilities of large nation-states' intelligence agencies.

It is a widely reported fact that the NSA will hand tips to the FBI/DEA/etc, which will then use "parallel construction" to reverse engineer legally admissible evidence once they have been tipped off to the guilty parties.

The silk road flew too close to the sun. As soon as they started getting in the news, and DPR started his libertarian manifesto-ing, it was just a matter of time. There are no old, bold crooks.

Silk Road is (was) a hidden service, internal to the Tor network, so controlling exit nodes wouldn't be relevant here. You'd need to actually be able to analyze traffic within the Tor network. Which still seems plausible, but maybe more difficult since the Tor network as a whole is a lot bigger than just the exit nodes, so it'd be harder to control a sizable fraction of it.

I would presume that, given that it's a persistent service, it'd be relatively straightforward to do a timing analysis, given that an FBI computer could ping the server at will, and then the server would reply from outside the network, via an exit node, which you could analyze if you had enough exit nodes.

Honestly, there might be even more exploits that I'm unaware of (still not an expert), given that the silk road server is probably doing a lot of tor traffic, which makes them an outlier, and it's tough for an outlier to blend into the background. Maybe tor can mitigate that though, don't know.

> an FBI computer could ping the server at will, and then the server would reply from outside the network, via an exit node, which you could analyze if you had enough exit nodes

Can you please explain in detail how one would do this to a hidden service?

I'm trying to determine if you just don't understand how hidden services work, or have found an actual vulnerability that needs to be addressed.

Here, a paper was written about it not too long ago: http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf

The same goes for end users: http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf

Hidden services are routed through ordinary Tor nodes. You're correct that they wouldn't have to control exit nodes explicitly, they'd just have to control the routing nodes along a specific chain that formed the connection to SR.

If you read the statements in the Freedom Hosting case you can see that the FBI managed to deanonymize the Tor network using browser tricks. Once you've got the network the rest is pretty straight forward tracking the bits I would suppose.

This also explains why the other market place shut down quickly, unlike DRP they apparently deduced it was only a matter of time before their location and identity was disclosed.

That isn't correct. The US placed a virus on the sourcecode of freedom hosting, either by seizing control of the servers, or by hacking, which exploited a vulnerability specific to version of firefox found in a popular all in one TOR access kit.

They did not compromise the network, they compromised an out of date version of firefox.

They might well be able to de-annonimize TOR, by monitoring traffic between a large enough proportion of TOR nodes. Given recent NSA/GCHQ long distance cable intercept stories, this is no longer unrealistic. But there is no direct evidence yet. It is also worth mentioning that the US has spent a lot of effort developing an attack capability, and probably hit enemies like Silk Road with attacks as sophisticated as Aurora or Stuxnet. Maybe we just don't hear about that, because of the beauty of parallel construction.

The US placed a virus on the sourcecode of freedom hosting, either by seizing control of the servers, or by hacking, which exploited a vulnerability specific to version of firefox found in a popular all in one TOR access kit.

I think we said the same thing, or at least if I interpret your statement correctly I meant the same thing. I said "browser tricks" and you said "vulnerability specific to firefox (a browser)" and I said "de-anonymized" (which was the analysis that most people pointed to as to why the FBI was collecting data from various hosts) and you described the same scenario " ... monitoring traffic between a large enough proportion of TOR nodes ..."

My interpretation of the events was, they got to Freedom hosting, they used that to exploit browsers into giving them correlating information about Tor endpoints, and using that traffic and resources in the already documented 'meta data snooping' programs that other parts of the government have and have made available, they figured out which servers were serving up the Silk Road web site, and by that (and a copy of the servers hard drives aka a server image) figured out who the guy was who was using the Dread Pirate Roberts moniker.

So is your understanding of how this went down different than that? And was that explanation different (other than detail) than my original comment which you assert was incorrect? Happy to be shown where I am wrong here, so I'm trying to figure out what what part you disagreed with.

Well, I read your comment as saying that TOR should be seen as compromised. Your comments about other market owners only seem make sense if that was what you were saying. I just pointed out that the previous attack you mentioned was a bit of a one off, and any repeat would need its own unique set of vulnerabilities. Hence so far as we know, no virus on SR.

Fair enough. Basically the attack is:

  1) Compromise a web server on Tor
  2) Buy a zero day browser exploit, create payload to expose
     data about endpoints and exits.
  3) Profit!

(Sorry the punchline is always Profit! but in this case it's probably "Seize!")

chuck, don't know whether you'll read this but in the light of subsequent tor nsa stories your comments were scarily prescient. congrats.

Let's also be clear that he solicited not one but two murders, and deposited money into bank accounts for those hits. Those transactions probably made him easier to identify as well.

http://arstechnica.com/tech-policy/2013/10/feds-silkroad-bos...

Apparently not, as he used Technocash to do it. He probably used fake ID to pay a bitcoin exchanger to send the money 3rd party.

It appears he was caught because he slipped up opsec confusing real and fake identities, he was being watched by homeland security because he stupidly tried to import 9 fake IDs to his residence, and he was logging into the server with a VPN, not SSH tunneled through Tor.

AFAIK it'd take some doing but it's not outside of the realm of possibility. If you can monitor enough of the Tor network's traffic, you can begin to make correlations.

This may not even require large-scale traffic analysis; I wonder if you configure your client to use a chain of 2 or 3 "known good" nodes, teach the nodes to block other potential users, and capture the traffic, if an effective timing attack could be done that way (request SilkRoad at 0:00, get back a page with the relevant contents at 0:01, and trace those lines through the nodes). It sounds like it'd be feasible to me, but I'm another amateur.

Running this kind of service becomes infinitely more difficult if you can't hide your hidden services.

Also I wonder how they got a server image without him noticing since it is typically something you'd need to shut down the machine for. Was the whole thing running off a hosting service?

It would be pretty impressive if he physically had servers in multiple countries. Just setting them up without involving other people seems difficult.

Edit: He did use hosting services which probably used virtualization so it is easy to clone drives for. The complaint has him buying fake ids (which were confiscated in transit!) in order to rent more servers.

If by "server image" they mean image(s) of the hard disk partition(s) (that's what I suspect they mean) -- easy. If the server is using LVM or some similar technology -- you can take a snapshot while the server is still running, no problem.

You can do `cat /dev/sda` on a live server (as root) without any special stuff like LVM or a hypervisor, it just isn't guaranteed to take a clean image, as it isn't a snapshot. In most cases you'd probably just need to run fdisk to tidy it up and get 99% of the data back in one piece.

You can't make any modifications for it to be admissible in court. This includes logging into a live server to take an image, or 'fixing' errors introduced during the copy.

Professional forensic investigators have what are called 'write blockers' that prevent all writes when drives are plugged in to be imaged.

It was in another country, and the image was provided by the other country. Not sure about the law/case-law around how that works with respect to chain-of-evidence.

I think a good defense lawyer should be able to get the server image thrown out. Fat lot that will do in light of everything else though.

They can create a hernetic environment to fsck a copy to find what files are on the original, and then copy the target file content from the discovered addresses.

Otherwise I could shred say some paper evidence, and the course would reject a taped-up copy that shows my original document. Which they wouldn't, of course.

Even if you don't use a snapshot, and get an inconsistent image, it's not like fsck isn't going to get you most if not all the data anyway. (Yay journaling)

>Also I wonder how they got a server image without him noticing since it is typically something you'd need to shut down the machine for. Was the whole thing running off a hosting service?

How often does one of your servers crash? I mean, it happens. I estimate maybe once a year/server, on average, assuming a 5 year lifecycle. (well, usually it's more like 'no crashes for the first three years, several crashes a year after' - hardware ages.)

Hell, whole racks lose power at times. Doesn't happen all that often, but it happens often enough that if your provider says "We blew breaker X" well, more often than not, it's a honest problem, and not the FBI yanking power to image a drive.

Or hell... what if it's a server with a mirrored drive? It'd be easy enough to pull half the mirror (the drive 'failed' right? Hell, you can say you let the salesguy into the co-lo and he bumped the hard drive release catch, or you sent in the new kid to swap a drive and they pulled the wrong one. These things aren't common, but they are way more common than the FBI.)

Hell, a drive could have legitimately failed and been sent back to seagate/wd by the provider (assuming he was renting servers) for warranty repair. The FBI could have intercepted the drive (or gotten it from the manufacturer) and run their own analysis.

So yeah. I totally believe that the FBI could get a reasonable image without DPR or anyone being the wiser.

"Hell, whole racks lose power at times. Doesn't happen all that often, but it happens often enough that if your provider says "We blew breaker X" well, more often than not, it's a honest problem, and not the FBI yanking power to image a drive."

Now you've got me wondering whether the apparent disparity between manufacturers claimed MTBF and what we see in failure rates in the real world, might plausibly be attributed to mysterious government agencies coercing data center owners into unexpected-but-plausible downtime. (four or five nines of power uptime might just mean the FBI/NSA need to batch server imaging and grab a whole bunch in a particular data center at once)

>Now you've got me wondering whether the apparent disparity between manufacturers claimed MTBF and what we see in failure rates in the real world, might plausibly be attributed to mysterious government agencies coercing data center owners into unexpected-but-plausible downtime. (four or five nines of power uptime might just mean the FBI/NSA need to batch server imaging and grab a whole bunch in a particular data center at once)

It's far more likely that people are idiots. How many hardware techs do you know who even own an ESD wrist strap? I get actively ridiculed when I pull mine out.

Next, the SLAs claimed by datacenters are usually bullshit on multiple levels.

First, the penalty is usually "we will refund you for the time you were down, if you ask." - which is fine, but a 5 minute power outage can be brutal to clean up after, while 5 minutes of your monthly bill is hardly worth asking for. I'd be happy to give people a 100% sla on those terms. I mean, obviously, the service isn't going to be up 100%, but the penalties are so low that who cares?

Then, well, even if the facility doesn't lose power, there are a hundred different ways a server or a rack can lose power.

Hell, even I let a guy into my co-lo who plugged in one of those ancient computers with a manual 110-240v switch. (everything made in the last decade auto-switches.) He plugged it into my 208v power, with the switch on 110, causing the fuses on my PDU to blow (and taking out the whole rack)

And power cords. Especially if you don't have dual power supplies, power cords get bumped. The mark of a honest sysadmin is that s/he admits it when they bump the cord[1]

So yeah, while it /could/ be the FBI, the vast majority of the time, well, someone fucked up.

[1]http://blog.prgmr.com/xenophilia/2013/06/more-downtime-on-ja...

(Adds lsc to the list of likely NSA collaborators…) ;-)

And yeah, you're right about hosting SLAs - I've got a hosting account which proudly advertises "100% uptime guarantee", which in the fineprint/t&cs offers "pro rata refunds for _twice_ your costs of any downtime!" – on a $48/year invoice - so if they go down for an entire _week_, they'll owe me not quite two whole dollars. Thanks...

Even the much more expensive/professional hosting I arrange for other clients always includes something like:

  Limitation of Damages

  Recovery of damages from $hostingCompany may not exceed
  the amount of fees it has collected on the account.

>(Adds lsc to the list of likely NSA collaborators…) ;-)

The interesting thing is that I haven't ever been served with a warrant. Which is weird, as I know much smaller competitors who have.

Of course, there's no reason why you should believe that statement.

The Silk Road has been notoriously unreliable. Constantly "Down for maintenance" and often just unresponsive for hours at a time. Besides the government it has also come under a number of malicious attacks from disgruntled users.

I imagine the DPR was logging in via VPN just to get some kind of consistent access to the site, even with I'm sure there were many times where the servers were unresponsive even to him.

Once the host was identified, obtaining an image of the running server is as simple as removing a disk from a RAID array and replacing it with a blank spare.

That's what I'm wondering. I would have thought someone running an operation like that would control their physical hardware.

You have to weight the pros and cons. Hosting yourself, means you have to get a proper location with power, internet connection, ect. You have to get and pay for this anonymously. You do have a greater control over it.

If it's colocated, you only have one type of payment to do, and I'm fairly sure it's easier to be anonymous. You have less control over this location, and have to worry about their logging of access and the like.

*> an image ... was made on or about July 23, 2013 ...

Perhaps a coincidence, but that's ~10 days before the guy who ran the Freedom Hosting gig was busted.

He also logged into his servers using clearnet/vpn they could trace. He had a degree in physics and a masters wtf was he doing playing gangster ordering hits and still running that site. Should have cashed out and fled to Brazil

If the FBI has been tracking down SilkRoad for years, I find it completely reasonable that they finally find the location of the server just based on traffic analysis. I'm sure that FBI or NSA runs number of exit and intermediate nodes to collect statistical correlations from traffic and track down hidden services given enough time (there is even public research that shows how it can be done: http://epub.uni-regensburg.de/11919/1/authorsversion-ccsw09....).

All that said, its even more likely that they found his identity other way. He seems to have slipped from time to time. I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online. It seems that the main theme in revealed identities seems to be reusing usernames or using the same email in two different contexts that link person to his anonymous identity.

Starting on page 24,

1) Located the first reference to "silk road" on the internet. You can find this yourself on Google: "silk road" site:shroomery.org Date range: Jan 1,2011 - Jan 31,2011 *

2) The same username, "altoid", showed up on a bitcointalk days later.

3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg5... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts.

That seems like more than enough for a warrant for this individual. Everything after that should be easy.

I've used Google before to locate when a particular word or phrase first appeared. Kind of surprising someone didn't figure this one out quicker.

* Obviously this is a common word, so either adding other keywords with it would be likely.

This does seem plausible, so I almost don't think this is worth mentioning, but don't forget about "parallel construction".

Having the world believe they can't reverse Tor would clearly be more valuable than having the world believe they can. Remember that Tor explicitly doesn't protect against a global passive adversary.

1984 wasn't supposed to be a manual god damn it! (This is how the main character was caught. He believed in a 'alternative' system. Much like how we like to pretend TOR is untouchable)

this has nothing to do with 1984 -- DPR was very sloppy, this is an indication that TOR works.

I'm betting a dozen entrepreneurs are looking at this right now thinking "I can do this better" and are designing their systems as this is happening.

That's what they want you to think, so they can snare you in their FBI ran honeypot...

All joking aside, I hope you're right, and that the next few SR alternative sites figure out how to get it right, and that Tor itself isn't fundamentally broken by the FBI.

Agreed - I'd like to think both this, and the Lavabit being coerced to hand over private SSL keys news elsewhere today - indicates that TOR and SSL are still "as secure as needed" against even targeted FBI attacks.

Unfortunately that all now needs to be viewed with the suspicion of "parallel reconstruction" - I'm somewhat less convinced that if the NSA targeted someone specific that SSL and TOR would resist their efforts (and that for something like Silk Road, that the NSA wouldn't happily break and read everything DPR did over his SSL secured TOR connections, and "share" just the right tidbits with the FBI for them to go and create a plausible explanation involving google searches and old forum posts).

Welcome to the post Snowden era - where we know that our governments not only don't have our best interests in mind, but have sophisticated programs in place to lie to us about how they arrive at the evidence they present (in those annoying occasions where they have to use courts who aren't just rubber-stamping everything they're told too).

(Edit: on reflection, it's kinda sad that this might well have been good detective work by diligent, talented, and persistent FBI investigators doing exactly what he taxpayer employs them to do - but that effort is now permanently under the dark cloud of suspicion of unconstitutional dragnet surveillance and morally corrupt processes like "parallel reconstruction".)

The question is - what was the service provided by Silk Road at the end of the day, and what can be decentralized?

The trust and review system, the search engine and the communication platform can all run independently and don't need to happen on the same platform.

The web interface can be provided by an open-source turn-key package, so the next DPRs only need to figure out the hosting.

The escrow system was probably the most critical service that SR provided. Unfortunately that seems to require a centralized model.

exactly what i was thinking, the amount of work involved despite some pretty horrendous slip-ups, implies TOR + basic common sense can be a pretty powerful thing

In principle I agree with what you're saying, but I think it's harder than you realize to maintain basic common sense all the time. People do irrational things, all the time. Even the normal ones.

Also anyone talking about it here on HackerNews is already failing at it.

Meh. The FBI and DEA can investigate my Silk Road seller account all they want and they won't find anything interesting.

http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa...

> Much like how we like to pretend TOR is untouchable

Who are you talking about? Everywhere I look people are saying tor is certainly broken, the NSA is watching us, etc.

We don't know that any "parallel construction" is at work here. It seems like most of the information stemmed from the discovery of the Silk Road web server, and I haven't seen how they were able to determine that. If this goes to trial, then the FBI will have to say how it got that information (assuming he has a competent defense team).

That's the thing though. We know that as of very recently the NSA is helping other alphabet agencies construct cases in parallel. If you knew the guy's name or handle or whatever information the NSA could have given the FBI then coming up with an alternate story of how they ID'd the guy (page 24 onwards in the criminal complaint) would be incredibly easy. The point is that we'll probably never know either way.

The point of parallel construction is that we don't know that it's at work.

True, and the next Silk Road owner will certainly take that point into account.

Obviously, the disappearance of such a site leaves a gaping hole on the Web:

Silk Road has proven that the demand/market is there, that people are willing to use the Web to acquire those goods, that they are willing to pay, that the whole transaction works and that this leads to a massive amount of cash.

So, make no mistake, the next Silk Road creator is certainly out there, probably technically more astute and careful, and already building.

The next Silk Road owner will call himself the "CEO" of his operation and won't do an interview with Forbes, but an AMA on Reddit. Strange times.

http://www.reddit.com/r/IAmA/comments/1fwi48/im_the_ceo_of_a...

> Q: How do you rate yourself compared to the road?

> A: The road has more users, but our service is better (to put it bluntly).

> [...] We have automated PGP encryption of messages for the members who refuse to send their messages using PGP.

Ouch.

Atlantis is pretty widely known to be either a honeypot or a scam.

Black Market Reloaded is the odds-on favorite to be the new Silk Road.

Drugs are bad, mm'kay?

...the next Silk Road creator is certainly out there, probably technically more astute and careful...

And almost as certainly: more experienced in the use of serious violence. The next guy won't be hiring hitters without introductions from fellow violent criminals. (Not that undercover cops have never been vouched for in such a manner, but it raises the stakes significantly.) Yay Drug War!

If they used parallel construction, then why didn't they list how they got the information about the location/IP of the Silk Road webserver? I would assume that they would have ParallelConstruction'd a reasonable way for them to have obtained that information, no?

Why would they show their hand before they need to, and give more opportunities for poking holes in it?

Because they are legally obligated to 'show their hand' when the defendant's legal representative asks for it?

You appear to be missing the point of parallel construction. The point is that they show a true, but-not-the-whole-truth "hand" (the parallel construction) while obscuring the full truth. That is, you spy on someone, and obtain a bunch of evidence, either illegally or that is fruit of the poisonous tree. From that knowledge, you construct a (fictitious or only partially fictitious, but plausible) story about how you gathered enough evidence to incriminate your victim, without revealing that you came across this evidence illegally. See http://en.wikipedia.org/wiki/Parallel_construction.

Yes, they are legally obligated to not lie about the true means of how they came to have the evidence. But if nobody can prove you're lying, they can't call you on it.

Gee, parallel construction sounds an awful lot like money laundering except with my bytes. :|

Few cases make it to trial, especially in the federal system. He's been charged with at least two capital eligible charges. They'll offer to plead down to life in prision (or 100+ years same difference) and he'll take it. We'll never see the government's full case.

It's already known that they have attacks against Tor (i.e. Flying Pig)

From the GP: "If that's the case, it betrays a level of capability that ought to be frightening for the operators of other anonymous Tor services."

Google searches and reading some public forum threads... Staggering sophistication!

Seems likely to me that NSA found the server and imaged it. FBI's job was pretty easy after that.

Someone asking for help on the bitcointalk forum for a new venture? Happens almost daily. Someone asking a question on SO about how to access Tor? Ditto.

You don't discover who "Dread Pirate Roberts" is from this. But you do discover these types of things pretty easily AFTER the NSA tells you who DPR is.

The Google searches give a hint at DPR's identity. They don't give you the location of the actual Silk Road server.

Obviously there's lots of ways that guessing DPR's identity might allow someone with the FBI's resources to unmask the Silk Road server, though I don't know enough to know whether the forum post on its own would be considered sufficient evidence for a warrant to bug all of Ross Ulbricht's online activities. A lot of the more damning evidence for Ross Ulbricht as DPR (IP logs, the connection to the counterfeit documents, hostname of his personal machine, etc) seems to come from forensics on the captured server image. Analysis of Tor traffic doesn't seem like an implausible hypothesis, especially because that's a capability we'd be expecting the FBI/NSA to be developing anyway.

Reminds me of the recent South Park episode on the NSA/public privacy.

> 3) Later in 2011 "altoid" made a post on bitcointalk with his email address, containing his real name, in it: https://bitcointalk.org/index.php?topic=47811.msg568744#msg5.... If you search the name on Google it doesn't show up, but if you look at the user's page you can see it in his posts.

And a few post below someone says:

> I'm interested Ross

Spy film discretion here.

Umm... that reply was posted TODAY, not back in October 2011.

To be fair, someone back in October 2011 could have made that comment too, as his name was in the email address that he gave.

>And a few post below someone says: >> I'm interested Ross >Spy film discretion here.

That post was made today.

That's not enough for a warrant. No way, I don't believe it.

It is definitely enough to have CBP flag any packages crossing the border that are associated with that name, for which no warrant is required. After that, well, I'm no lawyer, but I think intercepting a package full of fake IDs is enough to justify a broader criminal investigation.

Alone, no. Read the 10 pages of corroborating evidence following these initial steps and there's definitely enough for a warrant.

A warrant for search and seizure of his computers and everything in his apartment? Probably not.

A warrant to keep "pulling the string", issuing subpoenas, and compelling production of evidence from those who might have it? Absolutely!

What is the cut off for using pseudonyms on obtaining a warrant?

I assumed bitcointalk had a small member base when "altoid" joined. A quick look at their tables show 3,694 total new registered users through January 2011.

"altoid" registered on shroomery on January 27th 2011 and the "altoid" who revealed his name publicly registered on bitcointalk on January 29th 2011.

It's definitely enough to ask Google, and possibly his bank or credit card company (to see if he bought any servers recently).

adorable.

is there anyway to prove that the post in the forum occurred when alleged?

All it takes is just once. I saw a reddit comment that documented how one user determined the real-life identity of another user who was attempting to stay anonymous. The slip up? Two photos posted by the user under two different accounts shared the same background, and the user posted using both accounts in the same comment thread.

I dox'd a guy once knowing only the day that he earned his pilot license and the state he lived in. (FAA publishes a database that contains that info).

For me it was a first name (unusual) and two schools attended (this in the days when universities were much more liberal with posting their student directories.

Let's face it, at most one if your identities can be tied to your actual real-world activities. Otherwise people can find enough correlations to out you. Witness JK Rowling's new book.

JK Rowling's dox was a result of a member of the publishing house's solicitors telling his wife, who then told a close friend who provided the initial leak on twitter, which gave the newspaper breaking the story enough to go on to start drawing those conclusions.

Found the BBC story about this, if you're interested. http://www.bbc.co.uk/news/entertainment-arts-23366660

Meh, you lot will never figure out my real world identity!

If only I knew your phone number ...

I would have gotten away with it, if it weren't for you meddling kids!

The internet is full of smart individuals with an eye for detail.

Lesson learned, if trying to stay anonymous only use cat photos as profile pictures found on google images.

The lesson is that your ability to remain anonymous drops in almost direct proportion to the quantity of content you make available.

A careful user might have a more-shallow slope; they might be able to post more photos, if they're carefully scrubbing EXIF and being mindful of spillage (unintentional details in the frame). But every single posted photo is still inexorably eating away at their potential to remain anonymous.

After publishing the first picture, you might have to throw away the camera... You never know how much unique is the fingerprint of the camera. Might be very useful to crawl profiles to map photos and screen names.

You wouldn't have to throw it away, just label it with the identity that posts photos from it.

...and not use that camera for anything other than posts made with that identity.

I happen to know where the bad pixels are in one of my digital cameras. Not sure of the other.

Even when I take photos of interesting stuff, I'll find an alternate source rather than post mine.

Different cat photos!

Unless we all standardize on the same cat photo. officialcatavatar.com anyone?

Limecat. Been around for ages, ready for battle.

... from the most generic search term you can imagine.

Damnit, you're on to me, aren't you.

http://www.reddit.com/r/AskReddit/comments/1ndvh3/serious_wh...

ahh yes, the creepy gone wild stalker story

What's the full story?

It's funny, i so rarely browse reddit, but i somehow happened upon this story this week - i guess it came up in some kind of mega "what are you most ashamed of" thread or somesuch. Ultimately it was as GP described; a redditor researched one of 'gone wild' big 'stars', poured through her history ,ultimately found another reddit account of a selfie shot that had the same background as the 'gone wild' shot so concluded they were the same or friends, researched back that history and ultimately found her real identity.

Here's a link to it: http://www.reddit.com/r/AskReddit/comments/1ndvh3/serious_wh...

>>>> I think most people underestimate the amount of boring and tedious chores they must do year after year if they want to conceal their identity from FBI who is actively searching them online.

Most people don't realize the government can have an army of people working 24/7 to track you down while you're busy trying to cover your tracks. The odds are never in your favor.

Also, having an active social media presence doesn't help either. lol

This should be common sense, but as you stated, people seem to forget. We have supposedly spent a trillion dollars on the war on drugs, it seems silly for this guy to think he didn't warrant at least a multi-million dollar investigation.

From the time the silk road sold it's first product, it was only a matter of time before it's owner went to prison. If he were as smart as he thought he was, he would have gotten out of the business and the country shortly after he became a millionaire.

> If he were as smart as he thought he was, he would have gotten out of the business and the country shortly after he became a millionaire.

I believe this guy is the second owner. If I recall correctly, the first guy did pretty much exactly what you said.

The current owner stated this was the case in an interview he gave after the FBI had already found and imaged the server hosting Silk Road.

Given the information released today this claim seems to be false in every way.

Seriously? "I am not the first Dread Pirate Roberts" ?

The name itself indicates that.

https://en.wikipedia.org/wiki/Dread_Pirate_Roberts

If the FBI systematically performed traffic confirmation on the Tor network, this would be a rather sloppy sources and methods cover, as they would eventually be forced to disclose the existence of the traffic confirmation system.

If the servers' IPs were obtained as a result of a passive traffic confirmation system that breaks Tor's anonymity, I would expect a detailed parallel construction to demonstrate an alternate explanation for how they unmasked the servers.

Any defense attorney worth his salt is going to request the evidence relating to the method of de-anonymization of the Silk Road servers. If a traffic confirmation system was used, the prosecution would be forced to disclose that to the defense, which could very well raise a solid argument that it violated the defendant's Fourth Amendment rights.

My guess is that the FBI used the gmail account information and early public silk road advertisements to obtain a warrant from a friendly judge to remotely monitor DPR's computer, and waited until he connected to the server. It's also possible that they exploited the web server, as was the case with FreedomHost.

The server image was made July 23, his fake IDs were intercepted July 10.

I guess the investigation stemming from the IDs was probably where it started to come together.

Even after they rumbled his name, I wonder if he could have avoided direct culpability by keeping his net connection three hops away from the source systems, and using forged identity docs for anything official (mobile wifi connection and visa debit card)?

Reply on news.ycombinator.com