Thread: Feds shut down $1.2 BILLION criminal internet marketplace

Bitcoin promoter pleads guilty to unlicensed use of currency

http://www.reuters.com/article/2014/09/04/us-usa-crime-bitcoin-idUSKBN0GZ2OG20140904

11/6/2014

http://www.alipac.us/f19/internation...2-0%94-314094/

RISK ASSESSMENT / SECURITY & HACKTIVISM

Silk Road, other Tor “darknet” sites may have been “decloaked” through DDoS [Updated]

Crafted Web requests may have caused servers to give up their locations.

by Sean Gallagher - Nov 9 2014, 1:00pm PST



The FBI-ICE-Europol seizure page greeted users to Doxbin's main .onion page. Doxbin and Silk Road 2.0 were part of a 410-site sweep of the Tor darknet.

Last week’s takedown of Silk Road 2.0 wasn’t the only law enforcement strike on "darknet" illicit websites being concealed by the Tor Project’s network of anonymizing routers. A total of 410 .onion pages on at least 27 different sites, some of which sell everything from drugs to murder-for-hire assassins, were shut down as part of Operation Onymous—a joint operation between16 member nations of Europol, the FBI, and US Immigration and Customs Enforcement.

While 17 arrests were made, some operators of sites taken down by the worldwide sweep remain at large. One of them—the co-operator of Doxbin, a site that allowed others to post personal identifying information frequently used for intimidation, identity theft, or other malicious purposes—has shared details of his site’s takedown with Tor developers in hopes they’ll find ways to protect other users of the network. An apparent distributed denial of service (DDoS) attack against Doxbin may have been used to uncover its actual location, and the same approach may have been used to expose other darknet servers seized by law enforcement.

Log files shared by the Doxbin proprietor, who calls himself nachash, suggest that sites may have been “decloaked” using Web requests intentionally crafted to break Tor’s Hidden Services Protocol. It’s also possible that his site was given up by bad PHP code. In a series of e-mails to the tor-dev list entitled “yes, hello, Internet supervillain here," nachash, said that his server—a virtual private server running the German hosting service Hetzner—was initially hit by what he believed was a denial of service attack in August.

Update: The operator of Doxbin sent an update on Sunday evening to Tor developers, saying that at least part of what he reported as a denial of service attack earlier was in fact someone crawling his website.

However, the crawler was not involved in the malformed traffic sent later.

From August 21 to August 28, the logs show a wave of requests that include text proceeded by %5C%22—which in PHP requests would be parsed as a quotation mark by PHP code. Trailing the “escaped” quote, the requests include what appear to be URLs for websites such as Twitter and Hack Forums. However, those websites were actually loaded with fake subdirectories such as “/old/code/fail”:



/ A snippet of the log files of Doxbin showing malformed requests via Tor that may have been used to "decloak" the server.

The requests pushed the traffic for the service up to about 1.7 million page requests for August—nearly three times the normal traffic load for the site. A month later, the same pattern began again, and nachash said that he started redirecting those requests to another Tor hidden service site (the Hidden Wiki’s “Hard Candy” page, a directory of child pornography sites). “I also added a grip -v“—the “invert match” feature for the GNU grep command, which excludes a specific pattern from output—“to my log report script in order to filter out the noise,” nachash wrote. “[this was] possibly a mistake, but we both tailed logs and watched for something like a different attack style that the DDoS was being used to cover and never noticed anything.” Eventually the requests trailed off from a peak of five requests per second down to one every three to six seconds. Ultimately, the requests stopped entirely.


@loldoxbin

The theory posited by “the kid who started Doxbin“ to nachash was that the attack was an attempt to force connections to the site’s various .onion addresses to follow paths that went over Tor network nodes set up by law enforcement. By filling up the “circuits” through secure Tor network nodes, law enforcement operatives could have made it possible to connect to the services only through Tor routing servers they controlled—allowing them to see the real Internet Protocol address of the server hosting them.

Doxbin went down on November 6, the same day that Silk Road 2.0 was seized, at or before 1 PM UTC, nachash wrote:

“I checked the most current Doxbin onion and attempted to ssh into the box every couple of hours for around the first 24 hours, until a friend pointed out that one of the old Doxbin onions was serving up the Silk Road 2.0 seizure page. At the time, the main onion was serving up some 404 page (Which I expected to eventually point to some sort of honeypot, but the pigs really let me down on that one), while other onions were unresponsive. This had changed by the next day, when all the onions from the Doxbin box were pointed to the seizure page. The speculation has been that the cops were adding onions one at a time, and my personal experience supports that. Police who are dedicated to seizing and taking control of hidden services are still struggling with managing a torrc file [the Tor service configuration file] efficiently. Go figure.

While no tears may be shed over sites like Silk Road 2.0 and Doxbin, the implications for other hidden services—and for users of the Tor network in general—are unnerving. If it’s possible for government actors to use denial-of-service attacks to force Tor traffic over connections that are owned and operated by them, it could present privacy problems for anonymized sites used by whistle-blowers, political activists and dissidents, journalists, and others trying to avoid the eyes of oppressive regimes.

Sean Gallagher / Sean is Ars Technica's IT Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland.

@thepacketrat on Twitter← OLDER STORY
NEWER STORY →

YOU MAY ALSO LIKE

• 
• The catch-22 predicament of Silk Road defendant Ross Ulbricht
  
• 
• A portable router that conceals your Internet traffic
  
• 
• FBI arrests Blake “Defcon” Benthall, alleged operator of Silk Road 2.0 [Updated]
  
• 
• Silk Road 2.0, infiltrated from the start, sold $8M per month in drugs
  
  
• http://arstechnica.com/security/2014/11/silk-road-other-tor-darknet-sites-may-have-been-decloaked-through-ddos/

2 former federal agents charged with stealing Bitcoin during Silk Road probe

By Evan Perez, CNN Justice Reporter
Updated 1:24 PM ET, Mon March 30, 2015



Silk Road founder's parents speak out 04:00


Washington (CNN)The federal government became owners of one of the biggest troves of Bitcoin, thanks to seizing millions of dollars in the digital currency from criminals associated with the online black market Silk Road.

Two federal agents who led the probe allegedly decided they wanted some of the money for themselves, according to a new federal court documents.

The two now-former agents from the Drug Enforcement Administration and the U.S. Secret Service are charged with wire fraud, money laundering and other offenses for allegedly stealing Bitcoin during the federal investigation of Silk Road, an underground illicit black market federal prosecutors shut down last year.

The charges in a criminal complaint filed in San Francisco federal court paints a picture of corrupt federal agents trying to enrich themselves as they tried to bring down one of the Internet's top cybercriminals.

The charges against the agents could end up causing complications for the government's case against Ross Ulbricht, also known as "Dread Pirate Roberts", the Silk Road founder. Ulbricht was found guilty last year of aiding drug trafficking with his site.​ He is awaiting sentencing. As a result of the case against Ulbricht and others, the federal government seized bitcoin that it said at the time was valued at over $33 million.

The agents are: Carl Force, 46 years old, of Baltimore, a special agent with the Drug Enforcement Administration, and Shaun Bridges, 32, of Laurel, Maryland, a special agent with the U.S. Secret Service.

Force was a lead agent in the case and was the main investigator communicating with Ulbricht. Force is charged with wire fraud, theft of government property, money laundering and conflict of interest.
Bridges was the computer forensics expert on the case. He is charged with wire fraud and money laundering.

Force allegedly set up fake online personas and tried to extort money from Ulbricht, including once trying to get $250,000 from him in exchange for not providing information to federal investigators, the criminal complaint says.

Using the online persona "French Maid," Force did succeed in getting $100,000 in Bitcoin from Ulbricht, which Force deposited in his personal accounts, the federal complaint says. He later used a series of Bitcoin and personal U.S. dollar transactions, including a $235,000 wire transfer to an account in Panama, to launder the stolen money, prosecutors allege in the complaint.

According to prosecutors, Force also used his position as an executive at a digital currency exchange called CoinMKT, in which he was an investor, to seize accounts of customers. He transferred $297,000 in illegally-seized digital currency to his personal accounts, prosecutors allege in the criminal complaint.

Bridges allegedly stole $820,000, using a series of wire transfers to move Bitcoin that earlier had been stolen from Silk Road in early 2013 and deposited in a Japanese bitcoin exchange Mt. Gox, according to prosecutors. Two days later, Bridges signed the government's warrant to seize millions of dollars in bitcoin from Mt. Gox accounts.

Later, when he learned the FBI was investigating suspicious activity in the Silk Road investigation, he transferred $250,000 from his personal account to one he shared with someone else, according to the complaint.

http://www.cnn.com/2015/03/30/politi...aling-bitcoin/

Originally Posted by JohnDoe2

Two federal agents who led the probe allegedly decided they wanted some of the money for themselves, according to a new federal court documents.

I'm reminded of the old copyeditor's motto: Every writer needs and editor - and every editor needs and editor!

I don't know enuf about this to make a specific suggestion, but in general it'd be a good idea to incorporate a revolving sleuth - a.k.a. inspector general - into any large scale undercover actions.
******************************
Americans first in this magnificent country

American jobs for American workers

Fair trade, not free trade

I.C.E. News Release

CONTRABAND

05/28/2015

Largest drug trafficker from shuttered ‘Silk Road’ website sentenced in Chicago to 10 years in federal prison

CHICAGO — A European drug trafficker, who used an underground website for worldwide drug sales, was sentenced in federal court Thursday to 10 years in prison for selling millions of dollars worth of illegal drugs for bitcoins.

This sentence resulted from an investigation by U.S. Immigration and Customs Enforcement's (ICE) Homeland Security Investigations (HSI).

Cornelis Jan Slomp, 23, of Woerden, the Netherlands, previously pleaded guilty in April 2014 to conspiracy to import and distribute various controlled substances worldwide. Slomp was also ordered to forfeit $3,030,000 in illegal drug proceeds from his criminal enterprise. Slomp has been in federal custody since his arrest in August 2013.

Slomp, who operated under the username "SuperTrips," conducted more than 10,000 illegal online drug transactions and received about $385,000 in bitcoins as payment for his illegal drug sales. By his own admission, and as confirmed by law enforcement's examination of the data retrieved from the Silk Road server, Slomp was the world's largest drug trafficker on Silk Road.

Shortly before law enforcement agents shut down the Silk Road website in August 2013, HSI special agents arrested Slomp when he flew from the Netherlands to Miami, Florida. At the time, Slomp had arranged to spin off his U.S. trafficking business to his largest U.S.-based wholesale re-distributor of illegal drugs, Angel William Quinones, of Largo, Florida.

Quinones, who was also later arrested, has since pleaded guilty in federal court and has been sentenced to 70 months in prison for his role in the scheme.

According to court documents, from March 2012 through about August 2013, Slomp distributed the following items worldwide:

• 104 kilograms of powder 3,4-methylenedioxy-N-methylamphetamine (MDMA);
• 566,000 ecstasy pills containing MDMA;
• four kilograms (8.8 pounds) of cocaine;
• three kilograms (6.6 pounds) of Benzodiazepine;

Slomp also had substantial quantities of amphetamine, lysergic acid diethylamide (LSD) and marijuana, in addition to substantial quantities of methamphetamine, ketamine and Xanax. All were to be distributed on his SuperTrips Silk Road vendor account.

https://www.ice.gov/news/releases/la...icago-10-years

Silk Road founder gets life for creating online drug site

Published May 29, 2015 Associated Press

FILE - This Feb 4, 2015, file courtroom sketch, shows defendant Ross William Ulbricht as the deputy recites the word guilty multiple times during Ubrichts trial in New York. (AP Photo/Elizabeth Williams, File)


NEW YORK – A San Francisco man who created the online drug-selling site Silk Road was sentenced Friday to life in prison by a judge who cited six deaths that resulted from drugs bought on his website and five people he tried to have killed.

U.S. District Judge Katherine Forrest told Ross Ulbricht he was a criminal even though he doesn't fit the typical profile — he has two collegiate degrees — and she brushed aside his attempt to characterize the business as a big mistake.

"It was a carefully planned life's work. It was your opus," she said. "You are no better a person than any other drug dealer."

Forrest said the sentence was necessary to show others who might follow in his path that there are "very serious consequences." She also ordered $183 million forfeiture.

Ulbricht, 31, was convicted in February of operating the site for nearly three years from 2011 until his 2013 arrest.

Prosecutors say he collected $18 million in bitcoins through commissions on drug sales on a website with thousands of listings under categories like "Cannabis," ''Psychedelics" and "Stimulants."

They said he brokered more than 1 million drug deals worth over $183 million while he operated on the site with the alias Dread Pirate Roberts — a reference to the swashbuckling character in "The Princess Bride."

The judge said Ulbricht's efforts to arrange the murders of five people he deemed as threats to his business was proof that Silk Road had not become the "world without restrictions, of ultimate freedom" that he claimed he sought.

Forrest said she was "blown away in fury" at the "breathtakingly irresponsible" Internet postings of a doctor who advised customers on Silk Road about the effects of various drugs.

Prosecutors cited at least five deaths traced to overdoses from drugs bought on Silk Road, and a parent of two of the victims spoke in court.

Before the sentence was announced, a sniffling and apologetic Ulbricht told Forrest he's a changed man who is not greedy or vain by nature.

"I've essentially ruined my life and broken the hearts of every member of my family and my closest friends," he said. "I'm not a self-centered sociopathic person that was trying to express some inner badness. I do love freedom. It's been devastating to use it."

His hands folded before him, Ulbricht was stoic as the sentence was announced. As he left the courtroom, he carried with him photographs of those who died as a result of drugs purchased on Silk Road.

http://www.foxnews.com/us/2015/05/29...ine-drug-site/

So when are they going haul the GM Execs to prison for life for selling cars with faulty ignition switches that kept the airbags from working properly that have so far killed 100 people who died in their vehicles as a result of the failure of the airbags to open up due to the "switch from hell"?

Deaths Due to GM’s Faulty Ignitions Hits 100

Still 37 more death benefit claims to review.

by Michael Strong on May.11, 2015

GM said it has repaired more than 70% of the vehicles with its faulty ignition switch.

The number of deaths attributable to the faulty ignition switches in the 2.6 million vehicles recalled by General Motors has hit 100.
According to the latest update from Kenneth Feinberg, the administrator the $550 million victims fund established by the automaker, the number of death claims rose this week by three. There are 37 applications still to be considered after 227 have been denied. The automaker said it has repaired between 70 and 75% of the vehicles.

In addition to the claims for death benefits, Feinberg’s staff approved 12 claims for people who suffered lost limbs, brain damage or pervasive burns in crashes, which are described as Category One. The claims for another 172 people who suffered less severe injuries that required hospitalization or outpatient treatment have also been approved, also known as Category Two injuries.

The fund, which stopped accepting claims at the end of January, has received 4,342 claims for benefits: 474 death benefits, 289 Category One injuries and 3,579 more for Category Two injuries. The fund still has a total 589 injury claims to review.

The fund was initially established with $400 million, but the automaker noted it could rise as high as $600 million, although GM CEO Mary Barra said there would ultimately be no limit on the fund. GM raised it to the current level of $550 million last month.

The problem with the switches is sometimes they slipped from the “on” to the “accessory” position causing a loss of power to the vehicles’ steering and airbags resulting in a loss of control of the vehicle that caused accidents where the airbags didn’t deploy.

After a lengthy investigation it was determined that some GM engineers knew about the problem as early as 2003. The automaker finally began recalling the cars after pressure from federal regulators and the public mounted.

However, the company is also dealing with a series of lawsuits related to the switches as well. The company recently scored a major victory in its effort to shield itself from those lawsuits linked to the switches it used in older vehicles.

A federal judge has ruled the “new GM” is not liable for death and injury claims for crashes that occurred prior to the automaker’s emergence from bankruptcy in July 2009 – even in the event of misconduct by the “old GM.” But ruling from the federal bench in New York, Judge Robert Gerber did say owners could seek damages if they prove vehicles equipped with those switches have lost value since GM exited Chapter 11.

The automaker hailed the news, which, it said, “doesn’t establish any liability against GM.” It also noted that the burden will be on plaintiffs to prove any new claims for losses.

By various estimates, GM could be spared anywhere from $7 billion to $10 billion in potential legal liabilities from those whose death or injury might have been linked to one of the vehicles equipped with a faulty ignition switch.

http://www.thedetroitbureau.com/2015...ions-hits-100/

Originally Posted by Judy

So when are they going haul the GM Execs to prison for life for selling cars with faulty ignition switches that kept the airbags from working properly that have so far killed to people who died in their vehicles as a result of the failure of the airbags to open up due to the "switch from hell"?

http://www.thedetroitbureau.com/2015...ions-hits-100/

6/9/2015

U.S. Weighs Wire-Fraud Charge Against General Motors

Charge stems from auto maker’s failure to recall vehicles equipped with defective ignition switch

http://www.alipac.us/f19/u-s-weighs-...motors-320201/

7/15/15

http://www.alipac.us/f19/darkode-hac...ffline-321294/