Comment by gwern | Hacker News Reader

Comment by gwern | Hacker News Reader

OP is wrong. Weaver is (as usual) jumping to conclusions and sensationalizing (not that he did any of the work to turn up these search warrants or is deeply familiar with the topic matter... He predicted all the blackmarkets would be dead by now; how's that going?).

What we know, after I and Moustache and DeepDotWeb have gone through the warrants & complaints, is that a handful (~78) IPs were deanonymized as late as July 2014 after accessing the Silk Road 2 vendor .onion. This is almost certainly due to the UC account 'Cirrus' in some form, who was perfectly placed to de-anonymize the SR2 servers and insert a payload into the landing page. A former SR2 employee says they were even using crummy commercial software like 'DeskPro' on the SR2 servers.

In other words, right now the evidence is consistent with a Freedom Hosting redux scenario: the FBI has gotten another Tor Browser or other browser exploit and then phoned home. It could also be the big mysterious attack, but why would they do that when they had an insider who was involved in hiring additional employees? And also given that the SR2 vendor onion should have been seeing a lot of traffic from vendors who almost all preferred to use it due to better uptime, a mere 78 IPs sounds low.

Further reading:

- https://www.reddit.com/r/DarkNetMarkets/comments/2sppy0/sr2_...

- https://www.reddit.com/r/DarkNetMarkets/comments/2t30hs/the_...

The conclusion is being jumped to because the timeline of the attack described in the July Tor blog post matches perfectly with the timeline of the investigation described in the SR2 court docs.

It seems very plausible to me.

To distill 'gwern's comment even further:

He's saying that warrants and filings show that FBI had an insider positioned to subvert SR2's servers. If you have that vantage point, a worldwide traffic confirmation attack on Tor is a oddly elaborate way to scoop up SR2 vendors. Why not just use the SR2 servers to trick the vendors?

Observe that the relay-early traffic confirmation attack would be a technical effort unprecedented for the DoJ, whereas implanting a backdoor into a web app is already par for their course.

The Reddit threads 'gwern links to talk more about the implications of the timing. At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.

> Why not just use the SR2 servers to trick the vendors?

Thank you.

We must assume that the FBI is a rational and intelligent adversary (even if we have a difference of opinion on specific public decisions or press releases that impact our perception of their intelligence).

They're not going to expend the resources (or, as The Grugq might say, burn a valuable capability) to compromise a server when they already had a man on the inside (Cirrus).

I would be willing to accept that it's possible they were on a dragnet fishing expedition around the same time to see what they could sweep up, and they just happened to use this information to confirm the efficacy of their Tor attack. This would also explain Doxbin going down, but so would Doxbin and another target of theirs being on the same bare metal server.

> At first glance, it's an awfully big coincidence to write off, but there are mitigating factors.

Agreed. Given what is already public knowledge, it's far from the most likely explanation.

But they did burn that valuable capability. Did they do it for no gain?

How do you know who "they" is? The Tor project said it seemed like it could have been a research project.

Academics would have no such motivational constraints unless working for the feds. They burn capabilities with wild abandon and still serve their own self-interest.

I think a multi prong attack from independent teams is reasonable for such a high profile target.

Given a global deanon attack against Tor, the DoJ absolutely would have rounded up the members of the dozens of child abuse related hidden services. The fact that only a single site was compromised indicates it was most likely an insider attack against the SR2 servers.

It sounds like running the server on a heavily un-trusted and sandboxed machine would prevent this class of attacks, right?

I mean a machine set up so that even if attacker gets root, they can still only send Tor traffic.

That is also not surprisingly best practice, according to the Tor documentation.

You shouldn't trust it completely since there are always escapes from virtual environments but there's no reason not to.

Best practices would include a setup like Whonix with a gateway machine that only allows Tor connections by your protected machine.

But this would not have helped against the attack described here: https://blog.torproject.org/blog/tor-security-advisory-relay... Once a malicious relay becomes an entry guard for a hidden service, it's game over.

What about the "parallel construction" scenario whereby NSA uses their alleged attack against Tor to deanonymize SR2, and the Cirrus UC is simply a construction?

Can this be ruled out or unlikely?

We can't rule it out, no. Just comment that it does not seem necessary at this point: Moustache's doxing of scout/Cirrus shows that she could have been easily busted, we know that she was subverted early on (it was rumored at the time, in fact - 'emailgate'), once the account was taken over, then it is perfectly capable of de-anonymizing a server (de-anonymizing is really easy; I've de-anonymized or helped de-anonymize at least 2 blackmarkets myself, and actually, just today someone has found another way SR1 could have been de-anonymized easily, although I can't go into details), and currently the seller/employee busts are consistent with the Freedom Hosting attack, which no one needs to ascribe to parallel construction (since we know it was an obsolete NSA attack which got reused).

What if any steps do you take after de-anonymizing a black market?

If the operators seem reasonable, you contact them privately with the IP and point out the implications. If they don't seem reasonable, you post it on Reddit and destroy their reputation. Unfortunately, quite a few operators are fools, knaves, or both.

Based on the current public info, nothing can be confirmed completely or discounted completely.

Currently there are only two pieces that points towards the Sybil attack being used against Tor:

1. Some Tor Hidden Services were uncovered

2. The dates just happen to match dates a research project were running

But there is a lot more pointing away from it: the main points are:

1. The FBI already had a source in SR 2.0

2. It is easier to uncover hidden services using endpoint hacks rather than global deanon

3. Given the ability to deanon parts of the Tor network, the feds would have targeted the larger markets and got a lot more arrests. It isn't a coincidence they just happen to take down the sites with the worst software stacks, security architectures and operational techniques.

Reply on news.ycombinator.com