Topic: The Great Silk Road Crash of 20** ...? - page 15. (Read 37096 times)

There are six nodes involved in a hidden service request. Three chosen by the client, and three chosen by the server. None of them know they are participating in a circuit that ends up at Silk Road.

It's a real shame they can't all be smart, like you.

Getting back on point.....

The question wasn't about how SR is taken down nor was it about strengths and weaknesses of Tor. It was about what happens to the bitcoin economy when a major marketplace driving the economy goes away.

If the CMU research is to be believed, and there are many flaws with their research (which they admit in the paper if you actually read the whole paper), SR contributes a non-trivial amount to the bitcoin economy.

The question is one none can answer reliably (only estimate based on similar situations in other economies). Empirical evidence once SR goes away will be interesting.

I'd argue that the largest losers are the exchanges of global currencies to btc and back to global currencies.

Farmers market got busted because they were idiots and used payment methods such as paypal. You just lost all your credibility in my eyes and I don't see the point continuing the discussion with trolls who throw stupid claims around without doing even basic research.

No, no, no, I meant no matter how carefully you use it, there's huge problems with it regardless.  Yeah, guard your plugins but what are you going to do about rigged nodes, enter-exit attacks, etc?  So just don't pretend it's perfect.

wow, it's been like 2 minutes and I thought of another potential attack vector against silkroad this is so hard lol.  There are sources, intermediary nodes, exit nodes, and target websites in that order then the response is sent in reverse order.  Intra-Tor websites like silkroad obviously do not exit.
You're probably already thinking what I'm thinking.  Tor nodes do not know if the next link up in the chain for the traffic they're carrying is another node or an exit node so when they receive the response back, they don't know if it's from a fake tor-hosted website and the data never left the tor network, right?  Wrong.

If you receive the response within 10ms from the same IP you just passed it to, there's 1 reason for that because a hop to an exit node, getting a response, and a hop back to you would never have been that fast.  It's virtually impossible.  What is solely possible is you're the 2nd to last link in the chain and that's their silkroad server your node is talking to that's responding that fast with data that pretends it left the network and came back.

yeah, they could add a built in delay to fake it but they're not that smart

Isn't it a case of FBCAK though? i.e. it works as advertised as long as you're really cautious?

Just pointing out that Tor is horribly imperfect in many, many ways.

Nobody in this thread is claiming tor is invulnerable, but the ideas you've proposed are not at all sound.  Now if you had said something like, hidden services can be revealed by a malicious node which advertises infinite bandwidth, causing the hidden service to preferentially route through it, you might have more credibility, though this attack can be mitigated by specifying a strict list of entry nodes.  Which I'm sure the SR crew are aware of, given the ease of this potential attack and their history of continuing to operate despite the yelling about them in Congress.

Someone may compromise SR, but I think it far more likely to get infiltrated, or discovered through old fashioned sleuthing, or to have been a honeypot operation from the beginning, than through a known technical flaw.


This was not an exact clone of SR.  The operators used hushmail and paypal, both of which rolled over for the feds, as anyone would have predicted.  You're not even reading your own links now!  FUD indeed.

This site had a history of being hosted on the clearnet and accepting payment via PayPal and others. This was how they were caught. Them having moved to Tor by the time law enforcement got to them has nothing to do with it. This site was nothing like Silk Road. You're a buffoon.

Again, I don't know much about tor personally, but you are offering an explanation of how to stop people connecting to tor
 to support an argument that it's easy to find silkroad. I don't see the connection?


Edit - sorry I'm behind in the conversation.

I don't doubt that someday someone connected with silkroad may slip up, however they do seem to be doing ok so far with regard to online anonymity, and I doubt I'd be the only interested party to see you point out any flaws

Okay yeah, very very difficult unless you operate a ton of rigged exit nodes.  Then it's simple if you control all the country's ISPs like China does  Classic entry-exit attack.
Ohhhhhhhhhhhhhh that's right.  I almost forgot about Operation Adam Bomb.  Just kidding, I knew about it the whole time and just wanted all the arrogant, fake, know it all haters here to show how clueless they are first.
Anyway, mega lolz at everyone who's like "nah ah, silkroad is invincible!  2 years is like...FOREVER!  NOBODY could ever find it and shut it down!"

This article is titled:
"Feds shutter online narcotics store that used TOR to hide its tracks" <-- lol
http://arstechnica.com/tech-policy/2012/04/feds-shutter-online-narcotics-store-that-used-tor-to-hide-its-tracks/

Super short summary: an exact clone of silkroad got shut down despite existing only in Tor.  Oops, Des was right again.  I guess computers connected to the internet can be found after all! lol.

Blocking is relatively easy, but spying is lot harder. Tor depends on publicly listed nodes (relays). To block tor, basically you just need to block traffic to these public nodes. However there are some additional features (bridges etc) which allow better connectivity, even these are not perfect.

Anyway, blocking tor is not related any way to spying on tor.

On unrelated note, someone needs to develop bitcoin-vpn automated marketplace.

Btw here's how China has almost complete control over blocking and spying on your perfect little invincible magic Tor network

http://www.cs.kau.se/philwint/pdf/foci2012.pdf

same here, but less boring writing:
http://www.technologyreview.com/view/427413/how-china-blocks-the-tor-anonymity-network/

Ugh, some of the general tactics I threw out there for getting the server to cough up its info may have slight catches and flaws but the idea here is sound.  You're all saying they exist in happy magic land and nobody will ever catch them.  Well guess what, their web server is a computer and it's sitting somewhere connected to the internet with an ISP or host and an IP address.  That means someone could find it out.

Obviously they set up their server(s) so perfectly that it's not exactly easy but if you think it's impossible to find out the server's true info, you're dreaming.

Oh, here's the short version of why the FBI hasn't caught them: when has the FBI ever been able to stop anything illegal anywhere outside the US?  I guarantee it's not hosting inside the US, lol.  So they could have the IP, mac address, name, and an 8.5x11" glossy framed photo of the server and if it's in some European or Asian country, good luck getting the plug pulled on it.  Go ask the MPAA how hard it is to get other countries to comply with their takedown requests.

I'm with the nay sayers as far as it burning the crypto economy. and for that matter being shut down. It's hard to even speculate on the who, what and where are they. who knows how powerful the operators are... it could be a handful of people like for example pirate bay... Or it could be hundreds of people.. I'm surely believeing there is a quantity of heartbeats behind it.

I've had deeper discussion with people concerning the actual TOR software comming under government attack. It is after all a creation by several governing bodies. but still. nothing stops another TOR project from aiding civilians to reach this portion of the internet.

I guess bottom line is if someone has the willpower it will get done no matter how hard of a crackdown world politics brings.

I think as well, the crypto economy will slowly begin to be adopted by more and more "legal" services. thus allowing for a split of the market. So as long as the current community can prove that with a little brains one can actually make rather then lose

And if that IP address is 10.30.100.10, it doesn't help you much.

There is no exit involved in hidden services, so that attack does not help you much.

But if you want to believe that the FBI is stupid, ignorant and does not have authorization to investigate an online marketplace of hard drugs and that Silk Road will execute PDF scripts you upload to it and load images externally and is run by idiots and none other than you have any sort of understanding of how Tor works even if you just learned that there is such a thing as hidden services, then go ahead, I guess.

If you could be arsed to take your own advice and read some docs, you'd know that there is no exit node involved in accessing a hidden service.

The government uses tor for its own purposes, so it has little incentive to ddos nodes.


SSL traffic is normal traffic.  If an ssh tunnel is employed, there are no files to look at.  You're grasping at straws in order to avoid admitting that you don't know enough about your topic.


This would be a stupid thing to allow.  I'd be surprised if this was possible on SR.  Even beyond disallowing such an attack, the web server could easily be prevented from connecting anywhere without tor, a step that I doubt the SR admins have neglected to take.

By the way, you are mistaken about the "direct server to server link up"; you wouldn't catch the server's IP this way, only that of improperly configured SR users (more likely, just that of a tor exit node).  Your server logs would only contain the hidden service hostname as the referer.


This is so naive it's cute.

He is talking trolling about embedded images that are server-side. Even if this is possible somehow (I doubt it) then the server will fetch the image using Tor network and our "genius" will see Tor exit node's IP address in his logs. His posts at the end sound hillarious. How can someone know about all this stuff and have completely wrong understanding even in the basics? Maybe he is a so called "white hat" who just finished 5 year training in computer security?

I don't know much about the technical side of hosting tor websites, but on the client side the browser bundled with the tor distro is locked down and designed to explicitly notify you if there's embedded content from another website on the page you are viewing, asks you if you want to run javascript on a page by page basis etc. etc. and silkroad doesn't raise any alerts. So looking at it from the Tor web-browser, which is designed to tell you if there is a breach of anonymity I trust its security.

I see You are a survivor from prime days of lobotomy! You mention many technical aspects but understand none of them in this and subsequent posts. All you mention such as offsite loading, embedding, plugins etc are taken care of. You did not even seen Silk Road page? LOL! Security "expert" who is afraid from .en extension in Tor Project homepage and is talking about Tor vulnerabilities in same time. You are retard, tell your handler The Suit that You failed!

Seriously?  I don't even know where to start with that one, lol.  Ummm...it is connected to the internet or nothing else could reach it.  Everything on the internet has an IP address or nothing else could reach it.  The IP address is accessible about a hundred different ways once you're talking about an application with a script inside it (flash or PDF) that's running on the server locally.  You could read it out the system summary info on most linux OSes, among tons of other way

And they haven't been caught because the FBI is stupid, isn't allowed to do stuff like that anyway, probably doesn't know how TOR works, failed to go to Google and search "tor weaknesses" , and they don't have sufficient coordination to do an enter-exit attack nor would they be allowed to DDOS other people's TOR nodes and mount their own rigged ones to get to a sufficient control level for other attack methods.  That's like 1/10th of the reasons lol.

Oh and a server that receives 99.99999% SSL traffic and no normal traffic, that could happen in certain somewhat common normal circumstances but it would be at least suspicious enough that that would be the server a hosting company would look at to see if it contains things like text saying "silkroad."

plus, what if 1 single offsite image is posted as a link like as a product or something.  I've never seen a silkroad page obviously but if it's like other CMS or forum software, images could be embedded and read by the server, not the browser, especially if it's a PHP page or uses certain types of frames.  It takes some tricking and SQL-injection style HTML coding but once the block of HTML or PHP is uploaded and the server is tricked into serving it up as is, tada.  Then the server holding the image would get a direct server to server link up, revealing its IP address.  If it was a standalone, trap image for tracking purposes (something I've used many, many, many times on other people's websites), I'd check the log on my server hosting the image for what what IP address attempted to read the file.

There's like 100 ways to catch these assholes, just most are seriously illegal so nobody's done it yet.