- cross-posted to:
- legalnews@lemmy.zip
- cross-posted to:
- legalnews@lemmy.zip
All the recent dark net arrests seem to be pretty vague on how the big bad was caught (except the IM admin's silly opsec errors) In the article they say he clicked on a honeypot link, but how was his ip or any other identifier identified, why didnt tor protect him.
Obviously this guy in question was a pedophile and an active danger, but recently in my country a state passed a law that can get you arrested if you post anything the government doesnt like, so these tools are important and need to be bulletproof.
You must log in or register to comment.
He most likely had bad OPSEC.
Secondly, he took this imagery he had created and then "turned to AI chatbots to ensure these minor victims would be depicted as if they had engaged in the type of sexual contact he wanted to see." In other words, he created fake AI CSAM—but using imagery of real kids.
This probably didn’t help much either.
The government is cagey about how, exactly, this criminal activity was unearthed, noting only that Herrera "tried to access a link containing apparent CSAM." Presumably, this "apparent" CSAM was a government honeypot file or web-based redirect that logged the IP address and any other relevant information of anyone who clicked on it.
It looks like a combination of bad opsec and clicking on a download link.
I know there has been some back and forth whether it's good to use a VPN with tor and feel like this is just going to open up that conversation again.
I’ve been looking into this myself recently and it’s definitely an interesting conversation.
It might depend on the VPN provider. If it's someone like Google, no way.
But Mullivad that has a proven track record of not keeping logs, that might be worth it.
I've also heard tor over i2p but don't know enough about the latter to have an opinion
I think the other aspect is that you could be adding more things to make you stand out amongst other tor users.
there’s a more technical term for all this but I can’t recall what it is
Differentiators? The idea behind the tor browser specifically is to make it harder to fingerprint you by giving trackers the exact same information for each browser session across all its users, making it harder to differentiate between one user and another.
There are many ways your real IP can leak, even if you are currently using Tor somehow. If I control the DNS infrastructure of a domain, I can create an arbitrary name in that domain. Like artemis.phishinsite.org, nobody in the world will know that this name exists, the DNS service has never seen a query asking for the IP of that name. Now I send you any link including that domain. You click the link and your OS will query that name through it's network stack. If your network stack is not configured to handle DNS anonymously, this query will leak your real IP, or that of your DNS resolver, which might be your ISP.
Going further, don't deliver an A record on that name. Only deliver a AAAA to force the client down an IPv6 path, revealing a potentially local address.
Just some thoughts. Not sure any of this was applicable to the case.
There are many ways to set up something that could lead to information leakage and people are rarely prepared for it.
Mullvad is pretty good in this regard by forcing you to use their DNS. Though of course, you have to trust them.
Agreed. There are countermeasures to take against everything I mentioned. You just have to be aware and ideally not be a criminal in the first place.
Does Tor have no protection against such a simple attack? I always thought any clearnet address i type in the browser (along with the dns query) hops 3 times.
The Tor network cannot protect against that, because the attack circumvents it. Certain tools, like the Tor browser, do have protection against it (as much as they can) when you use them correctly, but they cannot keep users from inadvertently opening a link in some other tool. Nor can they protect against other software on a user's device, like a spyware keyboard or the OS provider working with law enforcement.
You can do DNS in multiple ways. The question is what you try to do, or what your software tries to do.
I can't answer this with confidence, but I was thinking the link in the email opened in the default browser, which wasn't Tor in their case. Or something in the email client perhaps. Ultimately, I have no idea what happened and I was just speculating
All the crypto in the world won't help if you do stupid stuff and have crap OPSEC.
A big part of that is stay under the radar. If I were NSA I'd be running a great many TOR nodes (both relay nodes and exit nodes) in the hope of generating some correlations. Remember, you don't need to prove in order to raise suspicion.
So for example if you have an exit node so you can see the request is CSAM related, and you run a bunch of intermediate nodes and your exit nodes will prefer routing traffic through your intermediate nodes (which also prefer routing traffic through your other intermediate nodes), you can guess that wherever the traffic goes after one or two relay hops through your nodes is whoever requested it.
If you find a specific IP address frequently relaying CSAM traffic to the public Internet, that doesn't actually prove anything but it does give you a suspicion 'maybe the guy who owns that address likes kiddy porn, we should look into him'.Doing CSAM with AI tools on the public Internet is pretty stupid. Storing his stash on cell phones was even more stupid. Sharing any of it with anyone was monumentally stupid. All the hard crypto in the world won't protect you if you do stupid stuff.
So speaking to OP- First, I'd encourage you to consider moving to a country that has better free speech protections. Or advocate for change in your own country. It's not always easy though, because sadly it's the unpopular speech that needs protecting; if you don't protect the unpopular stuff you jump down a very slippery slope. We figured that out in the USA but we seem to be forgetting it lately (always in the name of 'protecting kids' of course).
That said, OP you should decide what exactly you want to accomplish. Chances are your nation's shitty law is aimed at public participation type websites / social media. If it's important for you to participate in those websites, you need to sort of pull an Ender's Game type strategy (from the beginning of the book)- create an online-only persona, totally separate from your public identity. Only use it from devices you know are secure (and are protected with a lot of crypto). Only connect via TOR or similar privacy techniques (although for merely unpopular political speech, a VPN from a different country should suffice). NEVER use or allude to your real identity from the online persona. Create details about your persona that are different from your own- what city you're in, what your age and gender are, what your background is, etc. NEVER use any of your real contact info or identity info.
Feasibility aside, the shitty laws in question attacks content hosting platforms first(safe harbor laws). So no matter how many vpns i hop through, the site would simply limit the visibility of my post in the region and go about their day.
Yes exactly. This is a big part of why some repressive countries are starting to require identity registration in order to participate in social media. Arresting people is unnecessary if you can simply stamp out non-preferred speech at the point of discussion.
NSA in Amerikkka has been targeting the tor browser and flagging tor traffic for a long time. They will toss intercepts to law enforcement occasionally to be used through parallel construction. They're fond of backdooring security software and hardware and sneaking it into the supply chain.
How hard is it to implement a backdoor in a fully opensource project? (Assuming the project in question has a lot more eyes on it then an overworked developer)
Hard but not impossible. It's been done. XZ Utils, phpmyadmin, OpenBSD's IPSEC stack
I went one step further than OP and actually read the article.
Web-based generative AI tools/chatbots
...
he created fake AI CSAM—but using imagery of real kids.
All the privacy apps in the world won't save you if you're uploading pics to a subscription cloud service.
Reminds me of a few different darknet diaries episodes. https://darknetdiaries.com/transcript/24/
Isn't that calculator photo app backdoored?
It could, but even without it's very dumb to do such thing and think that you are safe
In this comment section: S P E C U L A T I O N, presented as fact. The truth is no one really knows, at least not yet...
