16

On October 2, 2013 Ross William Ulbricht was identified by FBI as the Silk Road black market website owner and was arrested. Silk Road was operated as a hidden service on the Tor network.

See also: USA Today: Feds seize 'Silk Road' drug site, arrest operator, Time: Feds Raid Online Drug Market Silk Road, BBC News: FBI arrests Silk Road drugs site suspect

Is it known if deanonymization of the Tor communication played role in this operation? If yes, is it known which techniques of attacking Tor anonymity were used?

Improve this question
3
  • We all just read the same news as you do. (Also, you might want to rephrase your question subject line to be a bit more coherent :)
    – weasel - Peter Palfrader
    Commented Oct 3, 2013 at 9:51
  • 2
    There is a post about this on the Tor blogs: blog.torproject.org/blog/tor-and-silk-road-takedown, indicating no real Tor involvement in the case.
    – zhenech
    Commented Oct 3, 2013 at 9:58
  • @PeterPalfrader: Coherency of the subject: I have discovered the mistake. I also tried to make it a little bit shorter. I am open to other ideas. :) Regarding the availability of information: I think it would be useful to have the information here even if the useful information appear later in the future. I must admit that I forgot about the blog :)
    – pabouk - Ukraine stay strong
    Commented Oct 3, 2013 at 12:37

3 Answers 3

Reset to default
15

From the criminal complaint, it is fairly clear that this isn't an issue with de-anonymizing Tor. If you look under Volume of Business Activity Reflected on Silk Road Servers, on page 14 it states that on or about July 23, 2013 an image of the SR web server was made and provided to the FBI (presumably by the hosting company.)

They don't mention how they located the servers or hosting company but they had so many other avenues to find them that it seems hacking Tor would be one of the harder routes. For instance, the Dread Pirate Roberts has several accounts on bitcoin forums, and even a Stack Overflow account where he used his real name then changed it to frosty.

He also had a small administration staff that he transferred money to. He engaged in other illegal activity and from time to time was in contact with other SR members.

Update

I have 2 videos that go over this and other Tor related arrests, the first covers this case, How Tor Users Got Caught and How Tor Users Got Caught Part 2

There is a Meta.SE disscusion titled, Did the Stack Exchange staff members assist in the apprehension of Ross Ulbricht? That may be an interesting read. DPR's question on SO now has a Staff Note above it, How can I connect to a Tor hidden service using curl in php?

Improve this answer
3
  • OK, I get it. He was sloppy. They got a server image. Although the complaint says nothing about encryption, the hosting provider could have bypassed that so easily that it's irrelevant. Securely hosting a hidden service is very difficult. I'll say more in my question.
    – mirimir
    Commented Oct 3, 2013 at 22:29
  • 3
    The Maryland complaint is very clear. An FBI undercover agent (UA) contacted him, wanting to sell bulk cocaine. He found a buyer, and delegated details to an employee (Fool). Fool had full admin access to SR servers. Fool provided his ACTUAL PHYSICAL ADDRESS to UA. UA mailed 1 Kg (very highly cut) cocaine to Fool, who was arrested on receipt. Fool told FBI all he knew about SR. Now FBI had access to SR servers. There's no reason to suspect that they needed to compromise Tor to gain access.
    – mirimir
    Commented Oct 4, 2013 at 4:49
  • 1
    I guess no one here has heard of parallel construction before.
    – Darius Jahandarie
    Commented Nov 1, 2013 at 4:19
10

Tor's announcement over the matter states:

So far, nothing about this case makes us think that there are new ways to compromise Tor (the software or the network). The FBI says that their suspect made mistakes in operational security, and was found through actual detective work.

So in answer to your question, no, deanonymization did not play a role.

Improve this answer
0
6

Based on the case reports they were able to trace the SR to him. That does not mean that he was initially found out because of a tor compromise. If such a compromise existed, they would have had to create a parallel construction to hide the fact the compromise existed, which would had been trival once they found their target.

Yes, he may have gotten sloppy, and that will be used as evidence against him, but that does not mean that is how he was initally discovered. That would only be known by the investgator, and the disclosed discovery may have been just to cover up the actual methods.

Basically, we know the offical report, but there is no way to validate its truth, and we are likely never going to know. It is interesting that following this another sting happened that brought down a huge number of other CP and other hidden service type sites. The timing is quite tight, so there is a likely tie between the two.

To answer your actual questions: Is it known if deanonymization of the Tor communication played role in this operation?

It is unknown, and to say that it wasn't deanonymization of tor with any sureness is misguided.

If yes, is it known which techniques of attacking Tor anonymity were used?

The only hope we have is that our hackers are better than ours and that the open source community has found problems to fix better than the NSA. I have a fair amount of confidence that we have more eyes and more quality eyes looking at the problems, but then again, mistakes have been made.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .