Hacker News Reader

Comment by TheCapn | Hacker News Reader

At this point I feel I'm missing something as we now have two legal documents going "Nuh uh!" - "Yuh huh!"

FBI's Explanation[1] states (Page 4, Footnote #5) that the admin himself kept logs explaining that there were frequent IP leaks due to misconfiguration of the web server.

At this point aren't we lead to believe that he showed multiple cases of mismanagement. From this can we not call bullshit on the very definitive declaration by the defense that the webserver was explicitly configured to deny external connections?

    [1] https://www.scribd.com/doc/238844570/FBI-Explanation-of-Silk-Road-vulnerability

View on HN

Well, that's the thing - they are not providing packet traces even though they were doing a forensic investigation, putting their methodology into doubt. Also, there are no logs indicating that they were successful in what they were trying to do. Even if they were successful, they said that "headers of some of the packets"..." as the source" contained the ip of the server. If it was coming from the TOR network, that would not be the case. Furthermore, since HTTP is a request and response protocol, a request would first have to have been made to the host. A reply would not come without first making the request. That being said, supposedly it was the captcha box. However, that server was only setup to reply to 127.0.0.1 and the backend server. There's no way they would have gotten access to it from the regular web without going through tor, by the methods they describe. You can see the last date the files were modified, and since the "investigator" told what time they accessed the server, we can see that the server was configured not to allow access except through tor. Since he had made a log of ip leaks, I'm pretty sure the guy was on top of security issues, as this is not something he'd overlook.

Considering the FBI's explanation didn't make any sense to begin with this isn't that surprising. How were they getting non-Tor traffic out of the server at all? The IP leaks were never a result of Tor misconfiguration but were instead due to things like exploits allowing examination of PHP variables storing internal information. There is no reason to believe the FBI could have gotten the IP of any of the servers by looking at packet headers as they've claimed.

Reply on news.ycombinator.com