The Great Silk Road Crash of 20** ...?

[salty]

can anyone explain how an entire site can exist inside TOR?  I mean I read that it's like a fake TLD that's correctly translated but wouldn't the creators of the TOR software have to manually code the software to accept and properly route fake TLDs?  So pull the plug on that idiotic feature!  I'm still not convinced they designed it that way in the first place but I can't imagine how else someone could set up a website that exists only in TOR and have it actually work.

Btw with all the 3rd party code and direct to browser scripts and FTP operations and stuff, any web server sitting only in the TOR network would get identified and found out in like a day.  So if those idiots think they're safe, they're not.

I don't know much about the technical side of hosting tor websites, but on the client side the browser bundled with the tor distro is locked down and designed to explicitly notify you if there's embedded content from another website on the page you are viewing, asks you if you want to run javascript on a page by page basis etc. etc. and silkroad doesn't raise any alerts. So looking at it from the Tor web-browser, which is designed to tell you if there is a breach of anonymity I trust its security.

[MysteryMiner]

He is talking trolling about embedded images that are server-side. Even if this is possible somehow (I doubt it) then the server will fetch the image using Tor network and our "genius" will see Tor exit node's IP address in his logs. His posts at the end sound hillarious. How can someone know about all this stuff and have completely wrong understanding even in the basics? Maybe he is a so called "white hat" who just finished 5 year training in computer security?

[unicron]

And they haven't been caught because the FBI is stupid, isn't allowed to do stuff like that anyway, probably doesn't know how TOR works, failed to go to Google and search "tor weaknesses" , and they don't have sufficient coordination to do an enter-exit attack nor would they be allowed to DDOS other people's TOR nodes and mount their own rigged ones to get to a sufficient control level for other attack methods.  That's like 1/10th of the reasons lol.

If you could be arsed to take your own advice and read some docs, you'd know that there is no exit node involved in accessing a hidden service.

The government uses tor for its own purposes, so it has little incentive to ddos nodes.

Oh and a server that receives 99.99999% SSL traffic and no normal traffic, that could happen in certain somewhat common normal circumstances but it would be at least suspicious enough that that would be the server a hosting company would look at to see if it contains things like text saying "silkroad."

SSL traffic is normal traffic.  If an ssh tunnel is employed, there are no files to look at.  You're grasping at straws in order to avoid admitting that you don't know enough about your topic.

plus, what if 1 single offsite image is posted as a link like as a product or something.

This would be a stupid thing to allow.  I'd be surprised if this was possible on SR.  Even beyond disallowing such an attack, the web server could easily be prevented from connecting anywhere without tor, a step that I doubt the SR admins have neglected to take.

By the way, you are mistaken about the "direct server to server link up"; you wouldn't catch the server's IP this way, only that of improperly configured SR users (more likely, just that of a tor exit node).  Your server logs would only contain the hidden service hostname as the referer.

There's like 100 ways to catch these assholes, just most are seriously illegal so nobody's done it yet.

This is so naive it's cute.

[capsqrl]

Everything on the internet has an IP address or nothing else could reach it.

And if that IP address is 10.30.100.10, it doesn't help you much.

and they don't have sufficient coordination to do an enter-exit attack

There is no exit involved in hidden services, so that attack does not help you much.

But if you want to believe that the FBI is stupid, ignorant and does not have authorization to investigate an online marketplace of hard drugs and that Silk Road will execute PDF scripts you upload to it and load images externally and is run by idiots and none other than you have any sort of understanding of how Tor works even if you just learned that there is such a thing as hidden services, then go ahead, I guess.

[Darktongue]

I'm with the nay sayers as far as it burning the crypto economy. and for that matter being shut down. It's hard to even speculate on the who, what and where are they. who knows how powerful the operators are... it could be a handful of people like for example pirate bay... Or it could be hundreds of people.. I'm surely believeing there is a quantity of heartbeats behind it.

I've had deeper discussion with people concerning the actual TOR software comming under government attack. It is after all a creation by several governing bodies. but still. nothing stops another TOR project from aiding civilians to reach this portion of the internet.

I guess bottom line is if someone has the willpower it will get done no matter how hard of a crackdown world politics brings.

I think as well, the crypto economy will slowly begin to be adopted by more and more "legal" services. thus allowing for a split of the market. So as long as the current community can prove that with a little brains one can actually make rather then lose

[Desolator]

Ugh, some of the general tactics I threw out there for getting the server to cough up its info may have slight catches and flaws but the idea here is sound.  You're all saying they exist in happy magic land and nobody will ever catch them.  Well guess what, their web server is a computer and it's sitting somewhere connected to the internet with an ISP or host and an IP address.  That means someone could find it out.

Obviously they set up their server(s) so perfectly that it's not exactly easy but if you think it's impossible to find out the server's true info, you're dreaming.

Oh, here's the short version of why the FBI hasn't caught them: when has the FBI ever been able to stop anything illegal anywhere outside the US?  I guarantee it's not hosting inside the US, lol.  So they could have the IP, mac address, name, and an 8.5x11" glossy framed photo of the server and if it's in some European or Asian country, good luck getting the plug pulled on it.  Go ask the MPAA how hard it is to get other countries to comply with their takedown requests.

[Desolator]

Btw here's how China has almost complete control over blocking and spying on your perfect little invincible magic Tor network

http://www.cs.kau.se/philwint/pdf/foci2012.pdf

same here, but less boring writing:
http://www.technologyreview.com/view/427413/how-china-blocks-the-tor-anonymity-network/

[kangasbros]

Btw here's how China has almost complete control over blocking and spying on your perfect little invincible magic Tor network

http://www.cs.kau.se/philwint/pdf/foci2012.pdf

same here, but less boring writing:
http://www.technologyreview.com/view/427413/how-china-blocks-the-tor-anonymity-network/

Blocking is relatively easy, but spying is lot harder. Tor depends on publicly listed nodes (relays). To block tor, basically you just need to block traffic to these public nodes. However there are some additional features (bridges etc) which allow better connectivity, even these are not perfect.

Anyway, blocking tor is not related any way to spying on tor.

On unrelated note, someone needs to develop bitcoin-vpn automated marketplace.

[Desolator]

Okay yeah, very very difficult unless you operate a ton of rigged exit nodes.  Then it's simple if you control all the country's ISPs like China does  Classic entry-exit attack.
Ohhhhhhhhhhhhhh that's right.  I almost forgot about Operation Adam Bomb.  Just kidding, I knew about it the whole time and just wanted all the arrogant, fake, know it all haters here to show how clueless they are first.
Anyway, mega lolz at everyone who's like "nah ah, silkroad is invincible!  2 years is like...FOREVER!  NOBODY could ever find it and shut it down!"

This article is titled:
"Feds shutter online narcotics store that used TOR to hide its tracks" <-- lol
http://arstechnica.com/tech-policy/2012/04/feds-shutter-online-narcotics-store-that-used-tor-to-hide-its-tracks/

Super short summary: an exact clone of silkroad got shut down despite existing only in Tor.  Oops, Des was right again.  I guess computers connected to the internet can be found after all! lol.

[salty]

Btw here's how China has almost complete control over blocking and spying on your perfect little invincible magic Tor network

http://www.cs.kau.se/philwint/pdf/foci2012.pdf

same here, but less boring writing:
http://www.technologyreview.com/view/427413/how-china-blocks-the-tor-anonymity-network/

Again, I don't know much about tor personally, but you are offering an explanation of how to stop people connecting to tor
 to support an argument that it's easy to find silkroad. I don't see the connection?


Edit - sorry I'm behind in the conversation.

I don't doubt that someday someone connected with silkroad may slip up, however they do seem to be doing ok so far with regard to online anonymity, and I doubt I'd be the only interested party to see you point out any flaws

[capsqrl]

Super short summary: an exact clone of silkroad got shut down despite existing only in Tor.

This site had a history of being hosted on the clearnet and accepting payment via PayPal and others. This was how they were caught. Them having moved to Tor by the time law enforcement got to them has nothing to do with it. This site was nothing like Silk Road. You're a buffoon.

[unicron]

Ugh, some of the general tactics I threw out there for getting the server to cough up its info may have slight catches and flaws but the idea here is sound.  You're all saying they exist in happy magic land and nobody will ever catch them.  Well guess what, their web server is a computer and it's sitting somewhere connected to the internet with an ISP or host and an IP address.  That means someone could find it out.

Nobody in this thread is claiming tor is invulnerable, but the ideas you've proposed are not at all sound.  Now if you had said something like, hidden services can be revealed by a malicious node which advertises infinite bandwidth, causing the hidden service to preferentially route through it, you might have more credibility, though this attack can be mitigated by specifying a strict list of entry nodes.  Which I'm sure the SR crew are aware of, given the ease of this potential attack and their history of continuing to operate despite the yelling about them in Congress.

Someone may compromise SR, but I think it far more likely to get infiltrated, or discovered through old fashioned sleuthing, or to have been a honeypot operation from the beginning, than through a known technical flaw.

This article is titled:
"Feds shutter online narcotics store that used TOR to hide its tracks" <-- lol
http://arstechnica.com/tech-policy/2012/04/feds-shutter-online-narcotics-store-that-used-tor-to-hide-its-tracks/

Super short summary: an exact clone of silkroad got shut down despite existing only in Tor.  Oops, Des was right again.  I guess computers connected to the internet can be found after all! lol.

This was not an exact clone of SR.  The operators used hushmail and paypal, both of which rolled over for the feds, as anyone would have predicted.  You're not even reading your own links now!  FUD indeed.

[Desolator]

Btw here's how China has almost complete control over blocking and spying on your perfect little invincible magic Tor network

http://www.cs.kau.se/philwint/pdf/foci2012.pdf

same here, but less boring writing:
http://www.technologyreview.com/view/427413/how-china-blocks-the-tor-anonymity-network/

Again, I don't know much about tor personally, but you are offering an explanation of how to stop people connecting to tor
 to support an argument that it's easy to find silkroad. I don't see the connection?


Edit - sorry I'm behind in the conversation.

I don't doubt that someday someone connected with silkroad may slip up, however they do seem to be doing ok so far with regard to online anonymity.

Just pointing out that Tor is horribly imperfect in many, many ways.

[salty]

Btw here's how China has almost complete control over blocking and spying on your perfect little invincible magic Tor network

http://www.cs.kau.se/philwint/pdf/foci2012.pdf

same here, but less boring writing:
http://www.technologyreview.com/view/427413/how-china-blocks-the-tor-anonymity-network/

Again, I don't know much about tor personally, but you are offering an explanation of how to stop people connecting to tor
 to support an argument that it's easy to find silkroad. I don't see the connection?


Edit - sorry I'm behind in the conversation.

I don't doubt that someday someone connected with silkroad may slip up, however they do seem to be doing ok so far with regard to online anonymity.

Just pointing out that Tor is horribly imperfect in many, many ways.

Isn't it a case of FBCAK though? i.e. it works as advertised as long as you're really cautious?

[Desolator]

No, no, no, I meant no matter how carefully you use it, there's huge problems with it regardless.  Yeah, guard your plugins but what are you going to do about rigged nodes, enter-exit attacks, etc?  So just don't pretend it's perfect.

wow, it's been like 2 minutes and I thought of another potential attack vector against silkroad this is so hard lol.  There are sources, intermediary nodes, exit nodes, and target websites in that order then the response is sent in reverse order.  Intra-Tor websites like silkroad obviously do not exit.
You're probably already thinking what I'm thinking.  Tor nodes do not know if the next link up in the chain for the traffic they're carrying is another node or an exit node so when they receive the response back, they don't know if it's from a fake tor-hosted website and the data never left the tor network, right?  Wrong.

If you receive the response within 10ms from the same IP you just passed it to, there's 1 reason for that because a hop to an exit node, getting a response, and a hop back to you would never have been that fast.  It's virtually impossible.  What is solely possible is you're the 2nd to last link in the chain and that's their silkroad server your node is talking to that's responding that fast with data that pretends it left the network and came back.

yeah, they could add a built in delay to fake it but they're not that smart

[kangasbros]

Super short summary: an exact clone of silkroad got shut down despite existing only in Tor.  Oops, Des was right again.  I guess computers connected to the internet can be found after all! lol.

Farmers market got busted because they were idiots and used payment methods such as paypal. You just lost all your credibility in my eyes and I don't see the point continuing the discussion with trolls who throw stupid claims around without doing even basic research.

[teamhugs]

Getting back on point.....

The question wasn't about how SR is taken down nor was it about strengths and weaknesses of Tor. It was about what happens to the bitcoin economy when a major marketplace driving the economy goes away.

If the CMU research is to be believed, and there are many flaws with their research (which they admit in the paper if you actually read the whole paper), SR contributes a non-trivial amount to the bitcoin economy.

The question is one none can answer reliably (only estimate based on similar situations in other economies). Empirical evidence once SR goes away will be interesting.

I'd argue that the largest losers are the exchanges of global currencies to btc and back to global currencies.

[capsqrl]

What is solely possible is you're the 2nd to last link in the chain and that's their silkroad server your node is talking to that's responding that fast with data that pretends it left the network and came back.

There are six nodes involved in a hidden service request. Three chosen by the client, and three chosen by the server. None of them know they are participating in a circuit that ends up at Silk Road.

yeah, they could add a built in delay to fake it but they're not that smart

It's a real shame they can't all be smart, like you.

[teamhugs]

wow, it's been like 2 minutes and I thought of another potential attack vector against silkroad this is so hard lol.

Please. Take down Silk Road. You will be a hero to the DEA and many other national law enforcements agencies all over the world. If it is so easy, please do it. Prove us idiots. Prove yourself a god. Victory is yours. The press will love you. You may get a parade in your honor.










of course, watch out for the drug cartels and users of SR, they may kill you soon after it goes away.

Hugs.

[salty]

I'd argue that the largest losers are the exchanges of global currencies to btc and back to global currencies.

And people providing local anonymous exchange services will take a hit too. I do face to face currency exchanges locally, and while I'm not nosey enough to ask, I would bet about 1/2 of my exchanges have been with silkroad customers.