Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×
Government Security The Internet Communications Network Privacy United States

FBI Operated 23 Tor-Hidden Child Porn Sites, Deployed Malware From Them (arstechnica.com) 176

An anonymous reader quotes a report from Ars Technica: Federal investigators temporarily seized a Tor-hidden site known as Playpen in 2015 and operated it for 13 days before shutting it down. The agency then used a "network investigative technique" (NIT) as a way to ensnare site users. However, according to newly unsealed documents recently obtained by the American Civil Liberties Union, the FBI not only temporarily took over one Tor-hidden child pornography website in order to investigate it, the organization was in fact authorized to run a total of 23 other such websites. According to an FBI affidavit among the unsealed documents: "In the normal course of the operation of a web site, a user sends "request data" to the web site in order to access that site. While Websites 1-23 operate at a government facility, such request data associated with a user's actions on Websites 1-23 will be collected. That data collection is not a function of the NIT. Such request data can be paired with data collected by the NIT, however, in order to attempt to identify a particular user and to determine that particular user's actions on Websites 1-23." Security researcher Sarah Jamie Lewis told Ars that "it's a pretty reasonable assumption" that at one point the FBI was running roughly half of the known child porn sites hosted on Tor-hidden servers. Lewis runs OnionScan, an ongoing bot-driven analysis of the Tor-hidden darknet. Her research began in April 2016, and it shows that as of August 2016, there were 29 unique child porn related sites on Tor-hidden servers. That NIT, which many security experts have dubbed as malware, used a Tor exploit of some kind to force the browser to return the user's actual IP address, operating system, MAC address, and other data. As part of the operation that took down Playpen, the FBI was then able to identify and arrest the nearly 200 child porn suspects. (However, nearly 1,000 IP addresses were revealed as a result of the NIT's deployment, which could suggest that even more charges may be filed.)
This discussion has been archived. No new comments can be posted.

FBI Operated 23 Tor-Hidden Child Porn Sites, Deployed Malware From Them

Comments Filter:
  • by JoeyRox ( 2711699 ) on Friday November 11, 2016 @07:23PM (#53268453)
    For fear that I'll unwittingly be taken to a child porn site and then have my IP address logged for immediate arrest.
    • by Anonymous Coward

      Too late, you came to this article. We have your IP and are coming to your home to arrest you.

    • Re: (Score:2, Interesting)

      Pedophiles fear many things. If they seek psychiatric help, the doctor is required to report them. So they stay untreated in the shadows. Other countries are more enlightened. In Japan, pedophiles can buy child-sized sex dolls [independent.co.uk]. Although data is scarce, the dolls appear to provide a release for their predilection and reduce offenses against actual children. This is unlikely to happen in America, but soon we will have a sexual predator as our president, so maybe he will be more empathetic.

      • by tsotha ( 720379 )

        ...but soon we will have a sexual predator as our president...

        Yeah, except... no. Those allegations fell apart the day after the election.

        Besides, we had a sexual predator in the White house starting in 1992, and it didn't seem to matter much.

        • Re: (Score:1, Interesting)

          You've got to understand. This is Slashdot. Most readers here can't get laid, or if they have, their partner count is low. They don't understand what it is like to follow the baseball metaphor for sex. If they have sex at all, it is because the woman finally settles for them and initiates everything (after fucking a lot of alpha guys less worthy than Trump).

          So, "grab them by the pussy" means nothing to a man who only can have sex when a woman grabs him by the balls.

          Anyone who is remotely attractive and ta

          • by Anonymous Coward

            You are so painfully full of shit I don't know whether to laugh or cringe.

            "There are at least 2 dozen girls I've done this with in less than 2 hours," really good sir? A tip of the fedora to you, that's an active fucking imagination you've got. A shame you can't tell the difference between what's real and what goes in in your cum-stained mind.

      • If they seek psychiatric help, the doctor is required to report them. So they stay untreated in the shadows.

        This is a good point. They've made it dangerous for these people to seek treatment (not that many of them do, but still...).

        In a way I almost feel sorry for them. We don't pick what we like or what we're attracted to, and it seems clear that most pedophiles are driven by urges far beyond conscious choice. (I mean, who would consciously choose to be attracted to children? No one, that's who.)

        So obviously we can't let them do what they want to do (molest children), but at the same time we should recognize tha

        • There's been some sort of growth change as of late (I blame the hormones-infested meat the industry pushes into supermarkets). During the last two decades, I'll be darned if I can reliably tell whether that hot chick I see on the street is 24 or 14. Could be anything in between.
          If you don't ask for an ID, you could spend long years in jail.

          Back in 2002 I almost fell for it. Luckily I asked her which University she went to and she serenely said "I'm 8th grade". Mind you, that was in a bar.

          • I'll be darned if I can reliably tell whether that hot chick I see on the street is 24 or 14.

            It's not just you. They sure don't look like they did when I was younger.

            I see young women in stores and yeah, they could be 15 or they could be in their 20s. And they're a lot more curvy or buxom or whatever than I remember them being when I was in high school or junior high. Some scientific studies are claiming that the age of puberty is dropping, so maybe that's it.

            https://www.theguardian.com/so... [theguardian.com]
            http://sph.unc.edu/age-of-pube... [unc.edu]
            https://www.ncbi.nlm.nih.gov/p... [nih.gov]
            http://www.newsweek.com/2015/0... [newsweek.com]

            "At the t

          • by piojo ( 995934 )

            There's been some sort of growth change as of late (I blame the hormones-infested meat the industry pushes into supermarkets). During the last two decades, I'll be darned if I can reliably tell whether that hot chick I see on the street is 24 or 14.

            That's true, but it's not the same thing as pedophilia. Our society has the bad habit of treating someone exactly the same whether they sleep with a kid or a 17 year-old. Media is partly to blame, because "child" is a highly inflammatory term in the context of sexuality, so they overuse that term. The result now is that someone with a healthy brain who is attracted to young adults can end up being treated the same as someone with an abnormal brain (who is attracted to children). Our collective enjoyment of

    • by AmiMoJo ( 196126 )

      I browse with a VPN service all the time. I'm afraid to browse without it, for reasons like this.

      Okay, maybe the VPN provider lied and does keep logs, but at least it's another layer of (likely international) process they need to through.

    • These people are doing several things WRONG. The case is real, kidnappers are not after the money but have much shadier agendas, so where do you think you have to go to see if you can find any clue as to what happened to missing people? All women have a responsibility to tell you if they got pregnant and they will always be in condition to reach you and make you pay for it, eh?
  • by BitterOak ( 537666 ) on Friday November 11, 2016 @07:29PM (#53268481)

    That NIT, which many security experts have dubbed as malware, used a Tor exploit of some kind to force the browser to return the user's actual IP address,

    Does anyone know if that exploit has been fixed or is it still unpatched? If the FBI can use this exploit to catch child pornographers then other, possibly malicious, people can use the same exploit.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      The EFF [eff.org] is trying to force the FBI to disclose the exploit they used. To date, the FBI has not publicly revealed it.

      In addition to difficult questions concerning the Fourth Amendment, Rule 41, and the limits of government hacking, the Playpen cases raise an important question about the future of digital rights: whether, to what extent, and under what circumstances the government must disclose to criminal defendants how the government carried out its hacking.

      In the Playpen cases, the government has provided some information to the accused about how the “network investigative technique,” or “NIT,” operated. But, critically, the government refuses to produce the exploit it used to allegedly take control of suspects' computers.

      That refusal—in addition to all the other problems with the Playpen cases—violates the rights of the accused. And, as at least one court has correctly found, the refusal to disclose the exploit to the defense requires suppression of evidence obtained as a result.

      At its core, the government's argument is: “You don’t need to know how we got into your computer (the exploit) because it does not change the information that we took from your computer (the private information copied and transmitted by the payload). Just trust us on this.”

    • by AmiMoJo ( 196126 )

      It's not a vulnerability in TOR, it's a vulnerability in the Firefox browser that shipped with the TOR Browser bundle. It's been patched.

      Also, it looks like it only affected people with JavaScript enabled. Beware hidden sites that require JavaScript, they are almost certainly traps trying to unmask you.

  • entrapment (Score:5, Insightful)

    by lpq ( 583377 ) on Friday November 11, 2016 @07:30PM (#53268483) Homepage Journal

    Why is this not entrapment?

    If they offer 23 out of 29 sites, that would seem to be increasing enticement...

    • Re: entrapment (Score:2, Informative)

      by Anonymous Coward

      Because they didn't make them do anything they wouldn't have otherwise done and they didn't force them to do it.

    • Because it was a limited time, and presumably they were not promoting the site, just getting residual traffic.
    • I'm just wondering if you have to fail a psych exam to be allowed to do this sort of work (kind of like you need to to serve on a sub)...

    • by Megol ( 3135005 )

      No that is _not_ how it works, unless FBI made people download child pornography that they wouldn't otherwise have downloaded then it isn't entrapment. Police dressing up as hookers isn't entrapment if they don't try to convince people to have sex with them for money. Police acting as drug dealers isn't entrapment unless they try to convince people to buy drugs from them.

      • by lpq ( 583377 )

        And that's why we have a court system. ;^)

        @ http://legal-dictionary.thefre... [thefreedictionary.com], they say this (among many other things):

        "The [entrapment] defense is not available if the officer merely created an opportunity for the commission of the crime by a person already planning or willing to commit it."

        If someone has never seen a child porn site, but stumbles upon one, and is curious about why someone would find such things sexual, and stumbles upon such a site due to their being over 300% more sites (due to police ru

  • by Anonymous Coward on Friday November 11, 2016 @07:35PM (#53268515)

    When, may I ask, will the FBI go after the creators of child porn, and not just the consumers? The peopel who actually and directly abuse children for money? Or is it a lot simpler easier to entrap the customers, since you can wave the contraband in their faces? It's rather like penalizing people who drink poisoned water rather than finding the poisoners.

    • The creators are motivated by and profit from consumer demand

      • by Anonymous Coward

        And there I thought America has learned it's lesson after decades of the "War on Drugs". Arresting junkies does not prevent drug crime. The demand is already there (people are predisposed to take drugs), outlawing people's urges does not magically make urges go away. I would argue that the relationship is inverse, it is child pornographers who prey on the weaknesses of people who have the natural inclination to desire such things.

        But on a more pragmatic note, criminalizing possession has negative effects as

    • I imagine it's because they're outside the US while the consumers are within the US. FBI only operates within the US.
    • by LWATCDR ( 28044 )

      1. They do.
      2. Many of these sites are for sharing kiddie porn. You know like Reddit, YouTube, and Blogs are for sharing things. The consumers are often the creators.
      3. " It's rather like penalizing people who drink poisoned water rather than finding the poisoners." Really? These people are going to a tor dark web site called the playpen and you are trying to paint them as victims? How about this instead, "it is like penalizing people that pay people to sexually abuse children for there entertainment".... Ye

  • Akin to the drug deals that go down at an interstate truck stop when the _name your initials_ sells a kilo for under market value,

    only to ensnare a rube who'd never be able to purchase at that level from legitimate drug dealers.

    We can debate justifying the ethics of creating an environment that may have never existed for a drug arrest, but operating a pedobear porn site for a second crosses a line you cannot return from.

    • Except (Score:5, Informative)

      by s.petry ( 762400 ) on Friday November 11, 2016 @07:58PM (#53268613)

      1. They had 2 warrants and judges approve the tactic. If you want to complain about the judges that is fair game, but the FBI did follow the rules. 2. The FBI did not setup these sites, they seized them through legal process.

      I am extremely pro US Constitution and don't see what they did as wrong. They followed the legal process as they should. What I wish we could see is how many arrests they made from the tactic.

      • Constitutional? yes

        Legal? plausibly

        Defensible behavior? No. "Honey, what did you do at work today?"

        "Ran a kiddie porn site for the greater good!"

        • Defensible behavior? No. "Honey, what did you do at work today?"

          "Ran a kiddie porn site for the greater good!"

          Yes because catching sick fucks through legal means is not "defensible"

          "Honey, what did you do at work today?"
          "I just shutdown a website paedophiles were using. We could have used that website to catch many of them and place them all behind bars but we just decided to close it and let them all go instead."

      • It seems little different from any other kind of sting. Whether you have cops posing as drug dealers, prostitutes, or posing as public officials taking a bribe, so long as the perp is not enticed by the undercover officer or his associates into committing the crime, honey traps are permissible.

      • by Anonymous Coward

        And what makes the US exempt from other countries laws regarding distribution of child porn?

        The FBI could easily be dragged into court in my country for what they did!

    • by Sabriel ( 134364 )

      What I'm wondering is how often such stings have ever collided. "You're-" "under-" arrest..." *stereo* "Wait, what?"

  • by Anonymous Coward on Friday November 11, 2016 @08:00PM (#53268625)

    The hosting site in question was known as "Freedom Hosting", it was the host of many sites including OPVA (main CP video site), Lolita City (main CP pic site), TorMail (used by everyone and their dog) and many others. The cops took over *all* of them when they took the host, what they're talking about here is the server request logs. The NIT was supposedly only deployed on CP sites, but that's a lie it was deployed on all sites hosted by FH. I'm not about to testify on that though.

    The exploit was based on a Javascript exploit in Firefox, in the CP community it was well known that you should disable any form of scripting that TorBrowser insist on shipping enabled because otherwise it'd break too many regular sites. So in the end they caught a few nobodies that didn't follow best practices, shafted someone who only did the hosting and punch water knocking out the main sites. It's like bittorrent, we tend to crowd but the crowd could always meet somewhere else.

    For what it's worth, they also took over TLZ (The Love Zone) and ran it for half a year. Playpen they took over and ran for two weeks. They catch the people who do stupid things like pay for hosting with non-anonymous methods, say compromising things in private messages and so on. They pick of the stupid, the smart stay on... 20+ years and counting, the cops are n00bs. They think the scene is TPB, it's just barely scratching the surface.

    • by Anonymous Coward

      They disclosed the JS exploits from the first FH busts and Playpen was much later. Given how hard they've dug in their heels on this one (letting evidence be suppressed, guaranteeing the person walks free), it's entirely likely this isn't the basic JS exploit from back in the LC days. There's good reason to believe it's file-based (see, 7-zip and JPEG2000 code execution flaws, others that cause certain media players to contact a server when opened) or some more serious bug not involving allowing scripts or

  • by Anonymous Coward on Friday November 11, 2016 @09:01PM (#53268847)

    The FBI needlessly raided, embarrassed, and stole a lot of property from people it disliked irregardless of the fact they didn't even know who they were targeting in most cases. The IP addresses don't equal persons or places to be searched despite what the courts have accepted. I know that because I can demonstrate it here with this very example. I do know that in this case the FBI did know who they were targeting because they were targeting an activist or two or group who stood up against the FBI for immoral and reprehensible behaviour (distributing child porn). Mark Edge and Ian Freeman stood up and called the FBI out just two weeks before they raided the studio of Free Talk Live and home of numerous liberty activists. The government has been targeting Ian Freeman's reputation for some time and slandering/libeling his name making claims he's a paedophile who advocates for the rape of children under six. Ian advocates against the use of violence including against children and doesn't think children under six should be having or are ready for sex.

    Here is what I can tell you: The warrants didn't name a person, place, location, and specific things to be seized. In this case they've stolen a few dozen computers and devices from many innocent parties. The courts literally rubber stamp these types of warrants and higher courts have ensured this continues.

    You can see exactly what happens in the videos below (thanks to other activists who recorded the raid). FTL is a libertarian talk show that has promoted the Free State Project which is a migration of liberty minded activists to New Hampshire for the purpose of pursuing liberty and freedom. Check out www.freekeene.com for Liberty news in New Hampshire. And don't worry- if you join us there are thousands of people here already. You won't be raided as long as you don't live near the home of the most active activists. They didn't succeed in undermining the movement (which actually consists of numerous groups throughout New Hampshire) and within a handful of hours they raised $5,000 and got Free Talk Live on air- before they even missed airing a single episode.

    Check out:

    http://www.copblock.org/156621/got-enemies-have-the-fbi/

    Raid itself:

    http://freekeene.com/2016/03/20/men-donning-badges-steal-property-from-free-talk-live-studios/

  • by bmo ( 77928 ) on Friday November 11, 2016 @09:59PM (#53269091)

    Rule 29 is now amended thusly:

    Rule 29 (a) In the Internet all the girls are men and all kids are undercover FBI agents.
            (b) All child porn servers are FBI servers

    Which should have been obvious before this.

    --
    BMO

  • ...i am happy they are going to be locked away and abused by the guards and hopefuly other inmates in PC
  • by dbIII ( 701233 ) on Saturday November 12, 2016 @12:08AM (#53269537)
    Disgusted but not surprised - how about they put in the hard work of solving crimes instead of the quick way to promotion of enabling crimes and catching the people they have tempted?
    The primary target should be catching the people molesting the kids in the first place, but instead those get left alone as being too difficult.
    • by Anonymous Coward

      Disgusted but not surprised - how about they put in the hard work of solving crimes instead of the quick way to promotion of enabling crimes and catching the people they have tempted?
      The primary target should be catching the people molesting the kids in the first place, but instead those get left alone as being too difficult.

      Um. From what I read, to be a part of at least some of those sites you have to upload your own material, so probably a lot of the people who were signing up WERE actually doing some of the abuse.

  • That's a good move. Instead of fighting windmills trying to shut down the network, use it. No idea how it will fare, but that's the way to go.
  • Oh my God. YOU'RE DOING IT WRONG. You are committing crimes in the course of your undercover investigation and abrogating 4th amendment rights.

    No, "kiddie porn" and "think of the children" doesn't justify it. NOTHING does.

    Signed,

    A concerned citizen

THEGODDESSOFTHENETHASTWISTINGFINGERSANDHERVOICEISLIKEAJAVELININTHENIGHTDUDE

Working...