Comment by crazypyro | Hacker News Reader

Comment by crazypyro | Hacker News Reader

I think this is the money quote:

"During the Government’s investigation, which was conducted jointly by the FBI and HSI, an HSI agent acting in an undercover capacity (the “HSI-UC”) successfully infiltrated the support staff involved in the administration of the Silk Road 2.0 website, and was given access to private, restricted areas of the site reserved for BENTHALL and his administrative staff. By doing so, the HSI-UC was able to interact directly with BENTHALL throughout his operation of the website."

So I assume this means they were able to infiltrate the community and there was possibly no unauthorized break necessary on the actual technology stack. It does lead one to question how they drew the final line between Benthall and his online persona, unless the undercover agent was also given access to financial information or other personally identifiable info. Maybe they even placed a malicious program on the server to target Benthall after they had control of a support backend. Interesting to see if that is all that comes out....

This sounds no different than the undercover police, detective work the FBI has been doing since its establishment. Infiltrate the perp, take him down.

They used the same tactics on gangs, mobs, etc. Now violent crime is slowing, but they have hoardes of agents trained in these protocols, so they're redirecting energy into catching so called "cybercriminals."

A bunch of people who infiltrated the mob are now infitrating groups of nerds in basements. It's frustratingly hilarious.

By the way: If the FBI is so successful using traditional police tactics to infiltrate "cybercrime syndicates," why do they need a "front door" to our devices?

Unless that's what they want us to think. If it was just this undercover agent, how did they shut down the other unrelated markets?

I think we've learned from the Dread Pirate Roberts case that what FBI says they did to catch these guys is a lie. They caught them some other way - either in an illegal way or through some method they intend to use in the future and don't want to disclose now. Either way, chances are it didn't happen the way they say it did.

Or, they just executed the same plan repeatedly. Clearly most people opening these markets are not as smart as they think they are. I would not be surprised if undercover police tactics succeeded across multiple markets, and the FBI simply timed the shutdowns to coincide. In fact I remember reading an interview with a market founder in cryptonews, where he mentioned the difficulty in finding and trusting support staff. That's all the more reason to listen when the FBI comes knocking, asking to help with support.

A bunch of people who infiltrated the mob are now infitrating groups of nerds in basements. It's frustratingly hilarious.

Why? Generally speaking, crime is crime, whether or not you wear a trenchcoat & fedora.

There is perhaps some humor in operatives who went up against the mob now going after small fish which must seem like easy pickings to them, but it's the "frustrating" part that I don't follow.

Because basement nerd isn't violently murdering anyone. Basement nerd is making a violent drug market civil and non violent.

Except when basement nerd tries to take a hit out on someone.

Allegedly.

Those charges were dropped, and no one really knows why.

http://www.dailydot.com/crime/silk-road-murder-charges-ross-...

They were dropped because hit was on one undercover agent and was contracted to another undercover agent.

> By the way: If the FBI is so successful using traditional police tactics to infiltrate "cybercrime syndicates," why do they need a "front door" to our devices?

Just like the old-fashioned police work they did here which you mentioned, the FBI in the past has been able to use warrants to obtain unilateral access to safe deposit boxes, drill open personal safes stored at home, search through a person's desks, closets, bedrooms, etc. for particular items, and more.

That is the level of access FBI Director Comey is saying that they need (the ability to enforce warrants for the same types of searches required for "papers and effects") for the same reasons that the FBI has needed such access for investigations in the past.

He isn't asking for the ability to conduct passive or mass surveillance, or even the ability for FBI to unilaterally enforce a warrant. He's asking for the ability of the device manufacturer themselves to be able to comply with a warrant if one is offered up. The cryptographic technology necessary to do so already exists, in a way that would limit access to the manufacturer, so that's not the issue.

> The cryptographic technology necessary to do so already exists, in a way that would limit access to the manufacturer, so that's not the issue.

This is a genuine question: Does it really? Everything I've read on the topic has shown that that's not really the case, at least not without implementing it in such a way that it has some rather serious human weaknesses anyway. However, I'm rather ignorant on the topic, so I'm genuinely curious.

Easy mode is to encrypt the device key for each individual device, store it only with the manufacturer. Make it more difficult by requiring m-of-n agreement (probably via a parity block scheme) between HSMs to derive the key if you wish (with the key material being guarded on separate stores so that an insider can't simply hack into access), but that's not that difficult in comparison to what we're talking about.

Even easier might be to have the device itself store an encrypted version of the data storage key, encrypted to a PKI private key that only the manufacturer controls (i.e. leave a GPG-encrypted file accessible in an unencrypted partition that unlocks the rest of the storage). Since we're assuming that skilled hackers will forcibly encrypt sensitive data anyways by jailbreaking if needed, it's not that much of an additional stretch to leave the key on the device itself, and FBI can still get warrants served on the 99.9% of accused criminals who can't be arsed to figure out that their iPhone can be unlocked.

I'm not even close to a crypto expert either, someone with deep insight into the crypto literature (I hear NSA has a few of those...) could undoubtedly point to more applicable research that would be useful here.

> A bunch of people who infiltrated the mob are now infitrating groups of nerds in basements. It's frustratingly hilarious.

I'm a little skeptical of this whole shtick that online criminals are just "nerds in basements." A nerd can do a lot more damage to your life with a computer than your average petty criminal.

True, but that doesn't necessarily mean they will. One of the smarter things about Silk Road in my view was the nominal policy of disallowing trade in child pornography, criminal services, stolen credit card data and so on, ie illicit things that also have (or are intended to have) victims who are necessarily injured as a condition of production. There's no economic tipping point at which the consumption of child pornography could justify the abuse perpetuated in its production, for example.

While the drug trade can cause people to become victims (just as the legal trade in alcohol or cigarettes or many other commodities), such victimhood is incidental to the production and consumption of the illicit good rather than inherent to it. I think this distinction between what sorts of contraband could be traded on Silk Road (even if it was not adhered to in practice) is a big part of why many people were/are sympathetic towards Silk Road.

One of the most astonishing parts of dark markets is that it flips the drug-dealing paradigm. Instead of watered-down product sold by unsavory people only motivated by profit, we now have what are essentially drug aficionados who are earnestly interested in selling the best possible product.

Which isn't to say they're allergic to profit, but since its closer to an open-market they can no longer rely on being the only game in town. Testimony from buyers on the dark markets shows that some dealers even include free drugs, which is completely unheard of.

If the cocaine cowboys of the 70s and 80s were the first wave and the crack kingpins of the 90s were the second wave, then the cyber vendors are the third wave drug dealers.

That's a little bit hyperbolic. I bet if you took the last 12 months, the average petty criminal has done more genuine experiential damage to people's lives than even the most intense nerd/hacker.

Its been hinted that they'll be busting other Tor marketplaces in the next day or so. I wonder if they were similarly infiltrated and what effect that will have on the community.

On the community I have no idea, but I imagine the next reincarnation of these type of markets will have to be managed by lone wolfs out of a cave in Afghanistan.

in all seriousness perhaps iranian hosts would be a viable route

In all seriousness, is there any legal precedent for seizing/shooting down satellites?

Space law tends to be extrapolated from maritime law as many of the legal condundrums are similar. So if you had a pirate satellite then it could probably be seized under a letter of marque. It's a fun question, I'll look into it.

I am not sure you want to stare down the Iranian justice system.

The US would never extradite to Iran, so unless you are so desperate to open a "dark net market" that you move to Iran, you will stare down the US justice system, not the Iranian tribunals.

If you don't live in Iran, staring down the Iranian justice system [given the lack of love other nations have for them] is pretty easy.

Tbh tho, I wouldn't be surprised if you setup an Iranian site that you weren't accused of "funding terrorist operations" and the trial gets replaced with a US drone strike.

To my knowledge, there have not been any drone missile strikes in Iran. That would likely constitute an act of war. Iran did shoot down a spy drone back in 2011.

Point taken, though.

> If you don't live in Iran.

As in, you live somewhere else out of reach of the Iranian and US justice systems. But you host the site in Iran.

@opendais: I'm still confused where the drone strike is happening.

Let us say you decide to hide out in Cambodia while operating servers in Iran.

The point is where isn't important. Given a large enough market, the US would do whatever was needed to catch you. :P

This is perhaps pedantic, but the US is also not going to order a drone strike in Cambodia.

You'd probably fall afoul of sanctions law if you tried that.

Cloud9 and Hydra are now displaying seizure notices as well.

Perfect cover to run away with everyones funds :)

Apparently Cloud9 went down four minutes before SR2.

So it's unlikely to be a false flag.

Yes, it seems the feds had a blast, taking down darknet markets.

Or maybe someone is trying to get out of the market and pocket all of the wallet funds sitting on another marketplace.

Seriously, if you were running a Tor marketplace and one of your competitors goes down, it is a perfect cover for running away with everyone's bitcoins and disappearing.

"successfully infiltrated the support staff" - This doesn't rule out that they didn't sniff out their credentials and logged in as them.

This implies an agent established a direct connection to a server in Benthall's C&C chain. Once there, they simple hacked (or subpoena or Mutual Legal Assistance Treatied) their way back to him.

Reply on news.ycombinator.com