The Attack on the Dark Net Took Down a Lot More Than Child Porn

87.79K

Adrian Chen

08/09/13 04:45PM

Filed to: digital underground

On Sunday afternoon, large swaths of the so-called "dark net"—the network of web sites accessible only to people using the anonymity-enabling Tor software—went even darker than normal. The widespread blackout appears to be the result of an FBI sting, targeted at the trade of kiddie porn on the Tor Network. One cybersecurity researcher was watching the entire time, and offered Gawker a peek into one of the biggest attacks on the dark net in history.

The apparent sting has brought an unprecedented amount of attention to Tor, right as the world is mourning the death of privacy at the hands of the NSA. The Tor network is used by dissidents and journalists to evade government censorship and surveillance, and even the feds probably can't crack the underlying technology. But the sting highlighted another feature of the network, so-called "hidden services," which allow anyone to publish websites that hide both their creators' and visitors' identities. Browsing hidden services only requires downloading and installing an easy-to-use Tor Browser. From drugs to weapons to child porn, Tor has led to a black market e-commerce revolution.

Google doesn't index hidden services, so the Tor network has largely remained a web terra incognito to normal internet users. Explorers of the dark net usually have to rely on directory sites like The Hidden Wiki, which have spotty service and reliability. But an amateur computer security researcher who goes by the handle Gato Malo has been trying to map the contours of the dark net. Since March Gato Malo, who runs the blog USCyberLabs, and a partner have been running automated crawlers to harvest URLs and other data about Tor hidden services in order to create an easy-to-use search engine. They call their project "Artemis." Gato says Artemis has harvested around 55,000 URLs from about 6,700 different dark net websites. He estimates it's about 25% of all the hidden services on the dark net. "This is a tip of the iceberg," he said.

And it turns out Gato was running his crawlers last Sunday, right as huge swaths of the dark net went down. Sunday's blackout coincided with the arrest in Ireland on child porn charges of a man believed to run Freedom Hosting, the largest web hosting company on the dark net. Visitors to many Freedom Hosting sites found only error pages. Computer security researchers quickly discovered the error pages contained malware that spied on visitors and sent their ip addresses to a server in Virginia. This has lead to speculation the FBI had launched an unprecedented raid on the dark net, successfully exposing the trade of child porn that has long found a haven there. (The exact mechanism of the takedown hasn't been made clear.)

But it wasn't only child porn websites that went dark. By correlating the times that the error messages appeared on sites with the reported time of the Freedom Hosting takedown, Gato put together a list of 68 dark net websites that had been taken down and turned into spying machines. (This is only a fraction of all the sites that were hosted on Freedom Hosting, given Gato's limited sample size.)

A relatively small number appear to be kiddie porn sites. "I would say only 20, 25% of this list is pedophile sites," Gato said. The rest are a hodgepodge of dark net sites, both obscure and popular, illegal and legitimate. HackBB, a popular hacking forum, Noreason, a dark net technical resource, and the TorBackmachine, a dark net clone of the Internet Archive's Wayback machine, were among the other sites taken down.

The list, below, is an interesting cross-section of the dark net. It is not all, or even mostly, illegal stuff. As Gato and other security researchers shed light on the dark net, it's clear that something more interesting is going on: A parallel internet created and used by the cutting edge of privacy-obsessed geekery. The dark net has its own news blogs, forums and community, all infused with a weird, dislocated feel by the dark net's pervasive anonymity that's reminiscent of the early days of the commercial Internet. Obviously, it's good if the feds have found a way to target the trade of child porn on the Tor Network. But as the spotlight shines more brightly on the dark net, will the criminal underbelly take everything else down with it? That would be a shame.

Here's a full list of the descriptions of 68 sites Gato found, including some duplicates indicating multiple locations of the same site were crashed: editorial notes in italics

The Dreadful Onion Hunter « Login
Simon's Intel Tor directory
Anon comments only | tornado front end
Caravana Brasil • Índice
.onion観光案内所入り口 - PukiWiki
UKetalar | UK Ketamine Vendor
Lista polskich stron – PB&M Wiki
Hosts a .onion site list and various .pdfs (Library Still Under Construction)
Login - Underground Market Board popular Tor forum
TorLinks | .onion Link List
Linki sprawdzone (Strona 1) - Pedo - Polish Board & Market
DeepChan - DeepWeb Tor Network 4chan clone
Collectors • Index page
.onion観光案内所入り口 - PukiWiki
Lista polskich stron – PB&M Wiki
The USAHM Archive The Dark Net mirror of conspiracy website USA Hitman
BlackBin » 3dcacd "Free, anonymous, and uncensored tool for online communication"
Polska Ukryta Wiki Polish-language Tor directory
Fraud Network - Home Hacking forum
Simon's Intel Tor directory
Lista polskich stron – PB&M Wiki
KindzazaChan child porn site
Blue Quarters Infoa kaikesta kivasta
BlackBin » 3dcacd
はじめに - Total Sites found retrivied : 4
Millennium Board • Index page
OnionCams child porn forum
r/Onions: Welcome to the forum Tor subreddit mirro
BlackBin » 3dcacd
Lain Iwakura | Wellcome ;)
Extasy 120mg (Strona 1) - [Sprzedam] (N) - Polish Board & Market
はじめに
QTL CORNER • Index page
Area51 Archives - Contact Hacker culture wiki
Otwórz oczy - blog dla ludzi z otwartymi umysłami [light edition and backup for uaga3aoawaj6hohg.onion]
Lista polskich stron – PB&M Wiki
Lista polskich stron – PB&M Wiki
3D Boys • Index page child porn forum
Lista polskich stron – PB&M Wiki
hex space - ./releases
Web Design Guidelines: Onionland Style
The TorBack Machine wayback machine clone
TCF • Index page
NBPP < Narodowy Bank Polski Podziemne
HAPPY BIRTHDAY, PSC (and other animals)
Forum of GnoM • Главная страница child porn forum
Acrimonious 2 Bitcoin escrow service
The Gates To The Clos Network wiki about clos networks
Paradise Village • Index page
Useless - A small lightouse in a sea of shadows
Simon's Intel
Difference between revisions of "Marketplace Reviews" - The Hidden Wiki
Aerie
Lista polskich stron – PB&M Wiki
Drugs - The Hidden Wiki
image uploader
Blue Quarters Infoa kaikesta kivasta
LEEME
Looking for "Sexual abuse" book
Notes // TORtiglione tor Microblogging site
BlackMarket Reloaded v.3 — Login
Lista polskich stron – PB&M Wiki
BlackBin » 3dcacd
SITES DEEP WEB - POR: ANONYMOUS BRASIL DEEP
The Dreadful Onion Hunter « Login
はじめに
Otwórz oczy - blog dla ludzi z otwartymi umysłami [light edition and backup for uaga3aoawaj6hohg.onion]
Blue Quarters Infoa kaikesta kivasta

[image by Jim Cooke]

The following replies are approved. To see additional replies that are pending approval, click Show Pending. Warning: These may contain graphic material.

15

raincoaster Adrian Chen 08/09/13 04:57PM

Finally! This was not an attack on child porn; it was an attack on the Dark Web, and an entirely unnecessary one, since TOR itself was developed for, iirc, the US Navy. The sites were not "hidden" so much as they were on the digital equivalent of dirt roads.

59

FuriousFrank raincoaster 08/09/13 05:00PM

20-25% of it is child porn. I consider that necessary.

31

99Telep☺dpr☹blems raincoaster 08/09/13 05:07PM

I am not buying that. I believe the Feds would monitor and infiltrate the Dark Web no matter what was going on there. Partly this is necessary and partly it is not. People are clearly being surveilled who have no right to be. But I don't think they would attempt to shut it down.

But lets not pretend this raid was carried out in a despotic move to stamp out freedom. It was done because people are raping kids and posting the pictures and video of it online. It's difficult to think that the primary reason was anything more than that.

Freedom Hosting is at fault here. Not the Federal Government.

12

raincoaster FuriousFrank 08/09/13 05:12PM

Well, child porn was passed through Gmail as well. Would you be in favour of shutting down Google?

Child porn was not the real target of this shutdown. They could easily have just shut down the porn sites and left the rest. Instead, they used javascript to infect all the sites they possibly could, porn or not. The government should not make it their business to infect non-malicious websites with any kind of code whatsoever.

4

raincoaster 99Telep☺dpr☹blems 08/09/13 05:13PM

It's not that difficult to think that the primary reason was other than that. They have the capability to check and shut down the porn sites. Instead, they infected them and shut them down. ALL of them. Why?

14

TidyBastard Adrian Chen 08/09/13 05:07PM

are gawker readers always on the governments side?

24

Obliterati TidyBastard 08/09/13 05:10PM

When it comes to crushing a massive child-sex ring?

I certainly hope so.

31

99Telep☺dpr☹blems TidyBastard 08/09/13 05:11PM

No. Not at all. But I wonder why you think the government shouldn't have intervened here? 25% of sites hosting child porn is not some inconsequential amount.

If I were tasked with upholding the law I would do everything in my power to go after these guys. Freedom Hosting has no moral high ground in this.

7

VirilityUntoThee TidyBastard 08/09/13 05:27PM

DEATH TO PEDOPHILES.

2

JoshTheStampede 99Telep☺dpr☹blems 08/09/13 05:32PM

But to continue the analogy, if you find out 20% of a town are pedophiles, you deal with that 20%, you don't just airstrike the town or tear up all the roads leading to it.

86

99Telep☺dpr☹blems Adrian Chen 08/09/13 04:59PM

25% of something isn't a small amount. You need to be able to police your system against illegality otherwise the Feds are going to do it for you.

I hear a lot of freedom advocates say that child porn will be used as an excuse to take down and compromise things like Tor. Well, a lot of that is their own fucking fault. Freedom Hosting would not have been raided if it had purged that sort of thing but it didn't. It allowed that shit to propagate on its servers.

Freedom comes with responsibility. Do they really think a network that allows drug deals, illegal arms trading, and pictures of child rape would simply be allowed to continue with no consequence?

3

willburnforfood 99Telep☺dpr☹blems 08/09/13 05:07PM

Fuckin' A!

24

Beverly Crusher 99Telep☺dpr☹blems 08/09/13 05:19PM

That's like saying 25% of people in prison are rapists, who cares if the rest are just journalists.

12

MissNormaDesmond 99Telep☺dpr☹blems 08/09/13 05:30PM

Yeah, it amuses me that if you point that out, people will call you "naive". I don't know, what do we call the attitude that ignores that Freedom Hosting must have been making shitloads of cash off of what they were hosting, and continues to think of them as foot soldiers of the revolution? Come on, people, they're not Robin Hood, or Zorro — they're more like Michael Corleone (at best). They're businesspeople, and a quarter of their business was as dirty as business ever gets, and they got busted. If you don't want to be collateral damage in a strike against child porn, then start refusing to share a server with it.

10

99Telep☺dpr☹blems Beverly Crusher 08/09/13 05:33PM

No. That's not a proper analogy. Freedom Hosting is a unregulated freezone, a libertine playground, where all things are allowed: open political debate, free expression of ideas, assassins for hire, child rape, etc. This portion of cyberspace was created for the intent of allowing any kind of content and not policing a bit of it.

What if right now in Oklahoma they suspended the police force statewide and declared all things to be legal? In OK It was OK to kill and rape anyone you wanted. Surely there would be people in that state doing nothing wrong but the Feds would march in there and take over the government. Law abiding people would have their rights infringed upon because it was necessary to establish order again.

There is a bigger problem here that just those particular websites. It is that the organization hosting them is complicit in the crimes because they do nothing to stop them.

7

It takes a nation of millions to elect the corrupt Adrian Chen 08/09/13 06:51PM

Nothing like pedophile to bring out the self-righteous amongst the Gawker-teriat. Its a good thing that the government would never use this self-righteousness to further spread its reach over that which, previously had been beyond its touch.

So I give you Brass Eye:

3

Gemmabeta It takes a nation of millions to elect the corrupt 08/09/13 07:19PM

So you expect the FBI to not go after child porn or what?

7

It takes a nation of millions to elect the corrupt Gemmabeta 08/09/13 07:53PM

Is that what I said? No, I believe that I was pointing out that our general over reaction to the presence of kiddie porn provides a near perfect cover for the government to encircle an Internet presence that does not wish to be a public discourse. The article (could you even read it through the fury that kiddie porn invokes) points out that only 25% of the websites were child porn. Why would they do that? Could they not discern what was what? Or was the mere assertion of privacy provocative enough?

milkcookiesssz It takes a nation of millions to elect the corrupt 08/10/13 03:06AM

only 25%? that's nothin'

3

JeffFTW It takes a nation of millions to elect the corrupt 08/10/13 04:00AM

exactly... it is akin to the government finding out that people send kiddie porn via USPS, FedEx, DHL, and UPS... so they open, read, and catalog ALL of the mail that gets sent anywhere.

Just like they did with the word 'terrorism' in order to arrest and detain people when they normally would have no right to do so.