|
|
|
|
|
|
by jim_dnaley
4238 days ago
|
|
|
IIRC, Silk Road 1.0 (is this what we're calling it now?) had mirroring servers. As we know, somehow the IP of the main server was leaked, whether through the CAPTCHA or by other means. Security by obscurity always fails - especially against the FBI. Given that Tor is essentially an obscuring mechanism for servers that have to function to some degree on the clearnet, if the FBI really wants to find a hidden service there are apparently many points of failure to exploit. However, given that Ulbricht and now Benthall both had poor OpSec, criminals on the internet have as a last resort the ability to have no identifying information on their servers, even if their servers get owned. |
|
|
Based on the info and understanding I currently have, the only information that can be used to track a hidden service is, basically, uptime* . If you own a significant percentage of both the network (Tor), and its carrier (Internet), you can start introducing latencies at will to exclude routes. That will basically allow you to find the IP by elimination.
As a passive adversary, you have to do the above passively - meaning loads of accurate uptime/time data for the hidden service, which you'd then have to correlate with known outages in various sections of the internet, yada yada. Passively it could take forever.
Security by obscurity is when the process being kept secret is the duct tape making it "secure" (think XORing against a fixed key and calling it "encryption"). This clearly not the case here, but rather that the protocol cannot protect a single server hidden service on an adversarial carrier network.
I can't imagine a HS with mirrors in 10-20 different DCs would be susceptible even with active capabilities.
> have to function to some degree on the clearnet
How so? They certainly don't have to, and AFAIK "marketplaces" don't.
* I'm obviously not counting leaking the native IP through the app layer, which is what the FBI claims happened with "Silk Road 1.0" (yes, I think this is what it's called now. Who got dibs on the silk road 2.0 name, and how?)
If not eliminate to just one IP, at least eliminate to few enough that you can DDoS them and see what happens to the HS.