US: Alaska man busted with 10,000+ child sex abuse images despite his many encrypted apps
arstechnica.comAll the recent dark net arrests seem to be pretty vague on how the big bad was caught (except the IM admin’s silly opsec errors) In the article they say he clicked on a honeypot link, but how was his ip or any other identifier identified, why didnt tor protect him.
Obviously this guy in question was a pedophile and an active danger, but recently in my country a state passed a law that can get you arrested if you post anything the government doesnt like, so these tools are important and need to be bulletproof.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.82K Posts
- 70.8K Comments
- Modlog
Why wouldn’t tor be compromised?
I would assume that because it is a popular open source software relied upon by millions that it theoretically shouldn’t?
It’s just that if I were the FBI, or the CIA, or a large criminal organisation, why wouldn’t I be putting a lot of money and the best people I could find on sneaking backdoors for tor into the onion somehow. What a treasure trove of the most potent information there is there! If you can crack tor, you own the keys to the underworld and enough blackmail fodder to get you almost anything you want.
In this comment section: S P E C U L A T I O N, presented as fact.
All the crypto in the world won’t help if you do stupid stuff and have crap OPSEC.
A big part of that is stay under the radar. If I were NSA I’d be running a great many TOR nodes (both relay nodes and exit nodes) in the hope of generating some correlations. Remember, you don’t need to prove in order to raise suspicion.
So for example if you have an exit node so you can see the request is CSAM related, and you run a bunch of intermediate nodes and your exit nodes will prefer routing traffic through your intermediate nodes (which also prefer routing traffic through your other intermediate nodes), you can guess that wherever the traffic goes after one or two relay hops through your nodes is whoever requested it.
If you find a specific IP address frequently relaying CSAM traffic to the public Internet, that doesn’t actually prove anything but it does give you a suspicion ‘maybe the guy who owns that address likes kiddy porn, we should look into him’.
Doing CSAM with AI tools on the public Internet is pretty stupid. Storing his stash on cell phones was even more stupid. Sharing any of it with anyone was monumentally stupid. All the hard crypto in the world won’t protect you if you do stupid stuff.
So speaking to OP- First, I’d encourage you to consider moving to a country that has better free speech protections. Or advocate for change in your own country. It’s not always easy though, because sadly it’s the unpopular speech that needs protecting; if you don’t protect the unpopular stuff you jump down a very slippery slope. We figured that out in the USA but we seem to be forgetting it lately (always in the name of ‘protecting kids’ of course).
That said, OP you should decide what exactly you want to accomplish. Chances are your nation’s shitty law is aimed at public participation type websites / social media. If it’s important for you to participate in those websites, you need to sort of pull an Ender’s Game type strategy (from the beginning of the book)- create an online-only persona, totally separate from your public identity. Only use it from devices you know are secure (and are protected with a lot of crypto). Only connect via TOR or similar privacy techniques (although for merely unpopular political speech, a VPN from a different country should suffice). NEVER use or allude to your real identity from the online persona. Create details about your persona that are different from your own- what city you’re in, what your age and gender are, what your background is, etc. NEVER use any of your real contact info or identity info.
Feasibility aside, the shitty laws in question attacks content hosting platforms first(safe harbor laws). So no matter how many vpns i hop through, the site would simply limit the visibility of my post in the region and go about their day.
Yes exactly. This is a big part of why some repressive countries are starting to require identity registration in order to participate in social media. Arresting people is unnecessary if you can simply stamp out non-preferred speech at the point of discussion.
I went one step further than OP and actually read the article.
…
All the privacy apps in the world won’t save you if you’re uploading pics to a subscription cloud service.
Tor was always comrpomised, the point has never been to be uncrackable, the point is that tracking down an induvidual user is enough effort that it can’t just be done on mass like with normal internet traffic. If you draw direct attention to yourself then it isn’t going to save you.
Exactly. Tor was originally created so that people in repressive countries could access otherwise blocked content in a way it couldn’t be easily traced back to them.
It wasn’t designed to protect the illegal activities of people in first world countries that have teams of computer forensics experts at dozens of law enforcement agencies that have demonstrated experience in tracking down users of services like Tor, bitcoin, etc.
Welp repressive countries have more stringent teams of computer forensics experts now. Though compared to our neighbours i wouldn’t call my country repressive(yet)
Tor cant save you from bad opsec.
No
Any even if it were what else would you use? There is no other software that comes close
I2P?
I2p has some weaknesses
everything has some weaknesses
In this case it is worse than Tor can be. In the future it is likely to get better but for now it is vulnerable to De-Anonymization attacks. Also it is very easy to see if someone is using i2p and that alone can get you into trouble.
the same can be said for tor
Tor isn’t perfect. Nothing is
The problem with i2p is that it could put people in serious danger if you live in a country with aggressive anti free speech and privacy laws
NSA in Amerikkka has been targeting the tor browser and flagging tor traffic for a long time. They will toss intercepts to law enforcement occasionally to be used through parallel construction. They’re fond of backdooring security software and hardware and sneaking it into the supply chain.
How hard is it to implement a backdoor in a fully opensource project? (Assuming the project in question has a lot more eyes on it then an overworked developer)
Hard but not impossible. It’s been done. XZ Utils, phpmyadmin, OpenBSD’s IPSEC stack
Pretty much impossible, especially with so many eyes on the project. It is possible to intentionally introduce vulnerabilities into open source code and use that as a backdoor but for projects like tor keeping that hidden for long periods of time is incredibly difficult due to the number of people independently auditing the code.
Let’s see here…
Potato Chat - This is the first I’ve heard of it so I can’t speak to it one way or another. A cursory glance suggests that it’s had no security reviews.
Enigma - Same. The privacy policy talks about cloud storage, so there’s that. The following is also in their privacy policy:
So, plaintext abounds. Definite OPSEC problem.
nandbox - No idea, but the service offers a webapp client as a first class citizen to users. This makes me wonder about their security profile.
Telegram - Lol. And I really wish they hadn’t mentioned that hidden API…
Tor - No reason to re-litigate this argument that happens once a year, every year ever since the very beginning. Suffice it to say that it has a threat model that defines what it can and cannot defend against, and attacks that deanonymize users are well known, documented, and uses by law enforcement.
mega.nz - I don’t use it, I haven’t looked into it, so I’m not going to run my mouth (fingers? keyboard?) about it.
Web-based generative AI tools/chatbots - Depending on which ones, there might be checks and traps for stuff like this that could have twigged him.
This bit is doing a lot of heavy lifting in the article: “…created his own public Telegram group to store his CSAM.”
Stop and think about that for a second.
This question gets asked every year and every time it turns out to be an OPSEC mistake instead
It’s like being surprised that body armor doesn’t help against being gassed.
And hopefully will continue to be asked, because one day it may not be poor OPSEC.
Well OPSEC is the stated cause. Who knows how the person was initially identified and tracked. For all we know he was quickly identified through some sort of Tor backdoor that the feds have figured out, but they used that to watch for an unrelated OPSEC mistake they could take advantage of. That way the Tor backdoor remains protected.
Hopefully it will be asked by the very smart people who actually develop TOR, and not just paranoid Internet randos like OP.
Honestly i believe there is no point in speculating whether there are backdoors installed in popular privacy and encryption apps; for all we know, the powers that are may already have a digital fortress’esque quantum computer decrypting everything from your signal messages to onion sites in a matter of seconds.
I think(my personal headcanon) that there probably was a Manhattan project like top secret research project that has yielded some very fruitful results, now i guess we have to just wait for some whistleblower or a disgruntled employee to feed it a file that blows it up.
lmao, just now reading this incredible response to me calling you paranoid.
I didn’t deny it; its akin to a first year med student reading about all the subtle little ways that the body hints something is majorly wrong and noticing symptoms exhibit in them, I guess i am just not jaded enough to accept that online anons can just send a swat team to my house if i comment on the local weather online.
True - although just because you are paranoid, that doesn’t mean they aren’t out to get you…
As far as we know. Could be mitm servers
Reminds me of a few different darknet diaries episodes. https://darknetdiaries.com/transcript/24/
There are many ways your real IP can leak, even if you are currently using Tor somehow. If I control the DNS infrastructure of a domain, I can create an arbitrary name in that domain. Like artemis.phishinsite.org, nobody in the world will know that this name exists, the DNS service has never seen a query asking for the IP of that name. Now I send you any link including that domain. You click the link and your OS will query that name through it’s network stack. If your network stack is not configured to handle DNS anonymously, this query will leak your real IP, or that of your DNS resolver, which might be your ISP.
Going further, don’t deliver an A record on that name. Only deliver a AAAA to force the client down an IPv6 path, revealing a potentially local address.
Just some thoughts. Not sure any of this was applicable to the case.
There are many ways to set up something that could lead to information leakage and people are rarely prepared for it.
Does Tor have no protection against such a simple attack? I always thought any clearnet address i type in the browser (along with the dns query) hops 3 times.
I can’t answer this with confidence, but I was thinking the link in the email opened in the default browser, which wasn’t Tor in their case. Or something in the email client perhaps. Ultimately, I have no idea what happened and I was just speculating
It’s unlikely that the Tor browser is configured as the default browser, so when you click the link, it will open in something else
Then doesn’t that mean that the guy was somehow shortlisted and handpicked to be served that honeypot link?
You can do DNS in multiple ways. The question is what you try to do, or what your software tries to do.
The Tor network cannot protect against that, because the attack circumvents it. Certain tools, like the Tor browser, do have protection against it (as much as they can) when you use them correctly, but they cannot keep users from inadvertently opening a link in some other tool. Nor can they protect against other software on a user’s device, like a spyware keyboard or the OS provider working with law enforcement.
Mullvad is pretty good in this regard by forcing you to use their DNS. Though of course, you have to trust them.
Agreed. There are countermeasures to take against everything I mentioned. You just have to be aware and ideally not be a criminal in the first place.
Or use Tails which routes all network traffic through TOR
Tails is the best answer if you need protection
Isn’t that calculator photo app backdoored?
It could, but even without it’s very dumb to do such thing and think that you are safe
Compromised ? Maybe, but this guy doesn’t provide any evidence one way or the other. He’s using at least 7 other possible vectors (apparently Calculator Photo Vault just hides the gallery, no encryption, so it’s over right there) which is way too many for good opsec.
With Tor the question has always been compromised exit nodes as I understand it.
Doesnt the prevalence of https solve this issue?
I wouldn’t be surprised if more than one root CA was compromised… especially the free ones.
Not against a government that can compel the organizations who issue the https certificates and run the https servers. And not against leaks that occur outside of https.
The bro was really dumb to hide things behind an app like this…
In that article they provide a list of steps to follow to be safer on Tor. Is that a good list or is there anything else one can do to maintain their privacy?
No idea, I was just using it to illustrate the existence of compromised exit nodes, which to my mind are a pretty fatal flaw in TOR, perhaps someone knowledgeable can chime in.
I haven’t been following the DNM seen much. Are there any good sources on the recent busts?
Mental Outlaw and seytonic on YouTube usually provide pretty good coverage.