Tor Project speculates on how law enforcement agencies managed to locate black market websites using the Tor network in "Operation Onymous."
By now, virtually anyone on the Internet should have heard that law enforcement agencies around the world in a concerted effort have taken down over 400 website pages belonging to around 27 services suspected of providing illicit services on November 5 and 6. What everyone knows is that "Operation Onymous" succeeded in arresting 17 suspects believed to be operating these illicit websites providing services ranging from selling drugs to hiring hit men.
These agencies also managed to seize drugs, gold, silver, and approximately $1 million worth of bitcoins. What no one seems to be able to confirm is how these agencies gained control of these Tor hidden services. There is now rampant speculation of FBI's new Tor-breaking technology and widespread compromise of the Tor network.
One popular theory is that rather than developing new, cutting-edge technology, agencies were able to locate these hidden services and perpetrators due to mistakes committed by the suspects themselves. It may just simply have been good, old-fashioned detective work. The feds may have been able to identify Blake Benthall as the administrator of infamous online black market Silk Road 2.0 due to one amateur mistake: he registered the site's server to blake@benthall.net. A blog post on Tor also posits that security errors such as an insufficient processor power or memory may have made these websites vulnerable to attacks.
Executive Director of the Tor Project Andrew Lewman speculated that police may have simply followed Bitcoin transactions to identify the arrested suspects. Bitcoin, the popular peer-to-peer digital currency system, is often used in transactions for black market sites due to its encryption and difficult traceability. In May, Ivan Pustogarov and his colleagues presented a viable method to deanonymize Bitcoin users, even when using Tor services. CERT researcher Alexander Volynkin previously suggested that there were even more vulnerabilities in the Tor network and was set to expose these flaws in a Black Hat presentation in August. However, the presentation was abruptly pulled due to the content not being approved for public release by both Carnegie Mellon University and Software Engineer Institute.
Another popular rumor is that agencies use malware like SQL injections to locate these sites. A SQL injection exploits database query software to either steal data or insert malicious code. Direct attacks on Tor relays are another strong possibility that has concerned Tor developers and users. Tor is frequently updated to shore up its defenses against deanonymization attacks like the Guard Discovery attack, which allowed hackers to identify the guard node of hidden services. Because the guard node is the only relay to contain the IP address of the hidden websites, hackers can compromise it to obtain access to the location of the hidden services.
Despite the best efforts by law enforcement agencies to land a heavy blow on the dark Web, another website on the Tor network by the name of Silk Road 3.0 sprouted up this Friday. Cutting one black market site only leads to the creation of another and for law enforcement agencies, anonymity will remain their biggest obstacle to stemming global trafficking and prostitution services on the web.
The continued creation and usage of black market sites may signal an unwavering trust in the anonymity that the Tor network still provides. What operators of the black market should realize however, is that people will always make human mistakes and those very mistakes may lead to their own demise (or arrest).