Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - kmfkewm

Pages: 1 ... 81 82 [83] 84 85 ... 249
1231
Newbie discussion / Re: SR mentioned in Australian court
« on: April 25, 2013, 09:39 am »
This is why you don't try to import significant weight into Australia. Over an ounce from Netherlands would be likely to make it into USA, but if you are in Australia keep it to 5 grams or so I would say. People debate about how effective Australian customs are, but just the number of stories we hear of people having interceptions of fairly small orders (ounce) is enough for me to be convinced that it is harder to import into Australia than most places.

1232
Of course they can see what is going on. But they are brainwashed so badly that their view of reality is highly distorted. The average US citizen is constantly subjected to relentless propaganda. The US is a democratic republic, but some smart sociopaths have found the weakness of this form of governing. Enough people are so easily manipulated that it becomes information warfare. The people who control the propaganda control the minds of the people who control the government. Government propaganda controls the people who ostensibly control the government. It has turned into a de facto dictatorship in this way. There are a few different factions who struggle with each other to control the people, but they are all united in being hardline statists. On one hand we have the religious people, primarily conservative republicans. They are brainwashed with religion and patriotism. On the other hand we have the socialists, primarily liberal democrats, they are brainwashed by the subverted education system and a malignant desire to 'help others'. They are indoctrinated in so many ways. From the flags waving everywhere you look, people on every news station of television telling them how to think and interpret events, shows on television trying to mold them into an image, the preachers at churches interpreting the holy books for them, the institutes of education mixing propaganda in with the real knowledge they teach to them and more, the list of channels through which they are bombarded with manipulation goes on and on. They are human drones, programmed devices, and the programmers program them in such a way that they will give power to their masters.

The Internet is a great tool for fighting this propaganda bombardment. Purely broadcast media is for brainwashing people, multicast is for educating people. But of course the government is even starting to spread their propaganda in sophisticated ways on the internet, using software that allows single agents to manage thousands of pseudonyms easily, to paint an incorrect and government favorable perception of public perception in public perception.

Maybe it is impossible for us to stop this. It is only getting worse, the technologies and techniques they use more sophisticated. I become more and more convinced that violence is the only way to stop them. I think that the current government must be overthrown, and democracy abolished. In its place should be a totalitarian yet highly libertarian dictatorship. The people should not have any ability to use any process to remove the libertarian leaders from power. Nobody would have any rightful reason to contest such a political system, it would be the opposite of what is traditionally thought of as totalitarian. Statist totalitarianism is like Stalinism, Nazism, the current political system in North Korea, and to a large extent even the current government of countries like China. Libertarian totalitarianism is the exact opposite of this, there is a group in total power in that they cannot be removed from political power by the will of the people, but this group only protects the people from having their rights violated and being turned into slaves. Essentially the people must have choice removed from them when it comes to political things, and they must be forced into freedom. Normally you may think that people will naturally choose to be free and they do not require being forced into freedom. This may be true of an individual in a vacuum, but the issue is that people want to restrict the freedom of others. We must have a power structure put into place that can prevent the majority of people from victimizing the minorities. The current government slices the people into small groups and turns the large group against each of the smaller subsections it is composed of, and in this way they divide and they conquer.

1233
Newbie discussion / Re: This is not a DOS attack
« on: April 25, 2013, 07:39 am »
So DPR lied to us?

 DPR said that he didn't go so far to discover what kind of attack it was. He said that the problem gave an appearance of an attack


Technically....he said, "The attack appears to be DoS in nature"

From Wikipedia -

"In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users."

At its most basic, the point is to make the site unavailable.....

Seems to be working......
Someone who doesn't know shit about networking might call this a DOS attack.  They would also call unplugging a server a DOS attack as stated earlier in this thread. A North Korean nuclear missile taking out the server or an EMP taking out the server would be a DOS attack by that definition. Hell not paying your power bill would keep anyone from accessing the site.


Quote
In a denial of service attack, the user sends several authentication requests to the server, filling it up. All requests have false return addresses, so the server can't find the user when it tries to send the authentication approval. The server waits, sometimes more than a minute, before closing the connection. When it does close the connection, the attacker sends a new batch of forged requests, and the process begins again--tying up the service indefinitely.
That is the real meaning.

No that is one specific implementation of a DoS attack. There are CPU exhaustion attacks, memory exhaustion attacks, and all kinds of attacks that have nothing at all to do with bandwidth exhaustion. I believe what  you just named is an open socket exhaustion attack, it doesn't even have to do with bandwidth. The most commonly known of form for a DoS attack is bandwidth exhaustion, but the term is so incredibly broad that it applies to all kinds of almost completely unrelated things. It is like saying "2 + 2 IS NOT ADDITION 1 + 1 IS ADDITION".

1234
Newbie discussion / Re: This is not a DOS attack
« on: April 25, 2013, 07:35 am »
This guy doesn't know what hes talking about, its a copy / paste from reddit... and that guy copy pasted from TOR faq lol.

http://www.reddit.com/r/SilkRoad/comments/1d1ibb/bad_news_availability_of_sr_down_to_confirmed/

It did sound familiar ! Tor FAQ has something in its abuse section about how Tor is not just a big botnet to be used by anyone who wants to DDoS a target, or amplify the bandwidth output of their botnet. This is true! However, the original poster grossly misinterpreted this as meaning that hidden services cannot be DDoSed, or that DDoS attacks can not be carried out through Tor. What it really means is that, although some things , like UDP based DDoS attacks, cannot be carried out through Tor, that other sorts of attacks are not MAGNIFIED by Tor or made POSSIBLE by Tor. Tor can be used for anonymizing the source of a DDoS attack though. And DDoS attacks against hidden services are possible in all kinds of ways.

1235
Newbie discussion / Re: This is not a DOS attack
« on: April 25, 2013, 07:32 am »
I am not any sort of tech-geek, but I emailed Tor directly and asked if DDoS attacks were possible on hidden services.  They sent me a link to the following:

Quote
Defense against Denial of Service of Introduction Points

The adversarial version of the previous section involves attackers intentionally hammering the Introduction Points of a Hidden Service to make it unreachable by honest clients. This means that an attacker can temporarily bring down a Hidden Service by DoSing a small number of Tor relays.

To defend against such attacks, Syverson and Øverlier introduced Valet nodes in their PETS 2006 paper: "Valet Services: Improving Hidden Servers with a Personal Touch". Valet nodes stand in front of Introduction Points and act as a protection layer. This allows Hidden Services to maintain a limited number of Introduction Points, but many more contact points, without clients learning the actual addresses of the Introduction Points.

Valet nodes are not implemented yet, mainly because of the big implementation and deployment effort they require.

So, I don't really understand a lot of what it says, but it looks to me like it's saying a DDoS attack *IS* possible on an .onion
Reread that then read it again if you have to. 
Quote
by DoSing a small number of Tor relays.
DOSing the relays. Relay IPs are public so yes you can DOS relays. Those are peoples connections. There would still be many people able to access the site. Now if you DDosed all relays then TOR wouldn't work for anyone and the SR forums wouldn't load either. We are all on TOR just fine right now. The relays are not being DOSed and neither is Silk Road.

If you DDoS all of a hidden services introduction nodes NOBODY who doesn't already have an established connection can access the hidden service. Introduction node DDoS was definitely my first thought because it is quite trivial to exhaust their processing abilities. However, as Astor pointed out in another thread, people who do manage to get established connections to the marketplace are also experiencing slow loading times. That would not be a likely effect of introduction point DDoSing , which would simply make it impossible for new people to establish any connection to the site in the first place. However, there are many other ways to DDoS a hidden service, as I have mentioned multiple times now so will not repeat again.

You are clearly very ignorant of how Tor works and the basics of cyber security.

1236
Newbie discussion / Re: This is not a DOS attack
« on: April 25, 2013, 07:23 am »
I posted about this earlier, but no one listens to the new guys. It is definitely not a DDOS. Use your heads. Why would the latest maintenance message state that the DDOS is still going on, yet you can access the site, but certain features don't work (picture uploads). This is a lie to cover up the fact that SR is on php 4 and got hit with the null byte attack. Theyre trying to upgrade not only their site code, but also their LAMP to fix the issue. Problem is, this shouldn't have been an issue to begin with. This is what happens when you have someone learning to code, while fixing a site.

I don't want to make any jumps to conclusions, but the fact of the matter is that a DDoS attack or DoS attack against a Tor hidden service is entirely possible. That said I have not been exceptionally impressed with the apparent security skill of SR, but on the other hand CUSTOMERS ARE RESPONSIBLE FOR THEIR OWN SECURITY. So it really shouldn't matter too much. Relying on a server / site operator to keep you secure is fucking retarded. Security is your own responsibility. On the other hand, maybe a misconfiguration or other issue has needlessly made the site vulnerable to DoS attacks. I have no idea. But it is incorrect to say that bandwidth DDoS , or anything like that, is impossible to do against a hidden service. Some very specific forms of DDoS are impossible to do over Tor, but some forms of DDoS are possible to do against hidden services that are not possible against clearnet sites.

1237
Newbie discussion / Re: This is not a DOS attack
« on: April 25, 2013, 07:18 am »
What makes you so sure?
For one it is not possible to perform a denial of service attack on a TOR hidden service. Tor only transports correctly formed TCP streams, not all IP packets, you cannot send UDP packets over Tor. You can't do specialized forms of this attack like SYN flooding either. So denial of service attacks are not possible over Tor. Tor also doesn't allow bandwidth amplification attacks against external sites. You need to send in a byte for every byte that the Tor network will send to your destination.

You think that correctly formed TCP streams can not be used to exhaust bandwidth??? Well, that is completely wrong. Someone with a botnet doesn't need to do a bandwidth amplification attack to DDoS a target, they have a massive botnet with lots of bandwidth. Just having thousands of zombie clients refreshing a website constantly, many simultaneous times, is enough to DDoS it, and that is how many DDoS attacks are carried out.  Also there are all kinds of other ways that DoS attacks can be performed. Hidden services are inherently weak to their introduction points being DoSed with CPU exhaustion attacks. They can be traced to their entry guards and the entry guards DDoSed, which will make it impossible to access the hidden service if it has strict entry guards set. The actual web server software can have flaws in it that make it weak to resource exhaustion attacks, a lot of the time DoS is of CPU or RAM and not of bandwidth at all. It is completely and entirely incorrect to say that DDoS or DoS are impossible to do against hidden services.

1238
Newbie discussion / Re: This is not a DOS attack
« on: April 25, 2013, 07:12 am »
This is not a denial of service attack. You can not do a DOS attack on tor hidden services. This is a null byte attack. This is only happening because Silk Road is coded very poorly.

Of course you can do DoS and DDoS against hidden services. The easiest way to prevent anyone from reaching a hidden service is to enumerate all of its introduction points and spam them with fake extend cells to exhaust their processing capabilities. You can also DDoS the hidden service in a traditional way, you simply need the nodes on the botnet to send their traffic through the Tor network up to the hidden service. It is just a normal server, it is not immune from anything. The server software itself could also have some bug or configuration issue that lets an attacker do non-bandwidth resource exhaustion. Tracing hidden services to entry guards is possible as well, at which point the entry guards can be DDoSed and if the HS is set to use strict entry guards then it will go down as well. In summary, you clearly have no idea what the fuck you are talking about so please stfu and gtfo.

1239
I wonder what type of "Tor exploit" this is. The first thing that comes to mind is hammering the intro points. One solution would be to increase the number of intro points. There isn't a config option for that, so you would have to change the Tor source code and build your own version.

However, I don't think that's it, since that would only affect establishing a connection. After that all clients would be routed through rendezvous points distributed across the network, which doesn't explain the slow loading even after you're connected. kmf, any ideas?

OTOH, is he sure it's a Tor exploit and not a server exploit, resource exhaustion attack, or something like that?

Ah wasn't aware people were connecting but then having slow loading times. It could be DDoS through Tor, if that is the case they would quickly be able to determine it simply by looking at server logs though. That would lead to a slow down as well as unreliability of establishing a connection in the first place.

1240
Tor has been strengthening itself from this sort of blocking for a long time now. Japan is late in the game, and I doubt they are going to convince ISP's to block with the intensity of the Chinese censors, who are currently the most skilled at trying to block Tor. Right now it is give and take between Tor and China, with neither of them staying ahead for too long. With the advent of obfsproxy Tor has been making serious progress in their blocking resistance though. Their bridging system can still be significantly improved, but they generally don't want to improve it until it is required to (they actually like the back and forth, and prefer to keep the progress of the blocking technology as slow as possible, rather than risk getting in a fast arms race that they might end up losing). So, for one it is not likely that Japanese ISP's are going to be at the forefront of Tor blocking, and it is entirely possible that simple bridges will be enough to get around it. And for two, even if they match China in their blocking abilities, the general back and forth will still apply, and bridges + Obfsproxy version whatever will be able to circumvent them much of the time.

1241
There are a few reports of LSD overdose. The primary one that comes to mind involved a mix up between crystal LSD and cocaine. The user sniffed over a hundred milligrams of pure LSD crystal, bled out their skin and died. However deaths from LSD are freak accidents. In the normal course of events, you will not overdose on LSD. It would cost thousands of dollars for the average person to obtain enough LSD to have a shot at killing themselves. If you look at Erowid you will see the estimates for LD50 are somewhere around 15mg I believe (it has been a while since I looked). This is considered a conservative estimate though, and there are many reports of people taking more than this and living. If you eat a sheet or less you can be pretty confident that you are not going to die, and if you can count the number of 100ug hits you have taken on your fingers and toes, you are not going to die.

I personally would not feel safe taking a thumbprint though. I have heard stories of people taking 25+ mg of LSD crystal and living, but I think they are indeed risking potential death at such high doses. On the other hand, the average dose is about one tenth of a single milligram, so the people taking 25 mg doses are taking 250 times as much as most people do.

1242
It is entirely possible that it is not an intentional DoS attack but rather is a DoS from the non-malicious clients of SR. Hidden services scale horribly and once you get past 200 or so simultaneous users things really get sketchy in regards to reachability. I don't know why they have come to the conclusion that it is a DoS attack though. If it is naturally arising from Tor being incapable of coping with such a popular hidden service, one thing they could do is create a second .onion that points to the same thing. Freenode is a popular IRC network that recently had to do this because their original .onion had its introduction nodes DDoSed from all the legitimate users it had. Unfortunately it is really trivial for malicious attackers to make it impossible to reach a .onion though, I will spare the exact details of the attack though. This is really a design problem with Tor, and unfortunately it is not even very high up on the developers list of things to work on. Most of the funding and research going into Tor currently involves bypassing censorship attempts at the ISP level (ie: bridges, obfsproxy), hidden services are somewhat of an after thought, and the primary developer who was still maintaining hidden service code quit working for Tor Project quite a while ago.

1243
ALL major desktop windowing systems have no isolation between GUI windows. If any one of your applications is pwnt, EVERYTHING can be keylogged. There are defenses though, you can use virtual machines like Qubes does, or you can use things like SELinux sandboxes. There are other techniques as well. Desktop OS's with windowed applications have long been considered insecure, this is one of the main reasons why. On the other hand who wants to do everything from command line. Qubes is a good step in the right direction, I haven't been using it myself but I do use multiple virtual machines and keep what I run on the host to the bare minimum.

1244
It doesn't have so much instability because it doesn't have users. That is not the fault of SR, but a limitation of how much Tor can scale. If SR wants to fix this issue one thing they can do is use two different .onion domains that point to the same thing. When one becomes overloaded the other will still work. That is what Freenode did once they couldn't scale with the amount of users using their IRC server over the hidden service anymore.

1245
Shipping / Re: fingerprints ?
« on: April 24, 2013, 02:21 am »
Fingerprints ARE enough to get you busted and if you think otherwise you are plain and simple fucktarded.

Quote
Additionally, if you see the Canadapost you will see how many people are touching your package without gloves...there is prints all over these things....

Maybe it is outside your field of expertise, but there is a basic forensics technique called intersection that applies to all sorts of things. In this case the attacker would order multiple packages from the vendor, then they would lift prints off of all of them and intersect the crowds until only the vendors prints are remaining. Your fingerprints may hide in a tiny ass crowd on one package, but over two or three or four packages and your prints are the only unique ones left.

Really I am dumbfounded that anybody here would argue against the importance of wearing gloves when packaging things. There is absolutely no debate to be had. My guess is they are either LE trying to create the impression of there being ANY debate in regards to the importance of not leaving fingerprints on shit, or they are trolls, or they are complete fucking idiots. In fact, I am certain that they absolutely must be one of the previously mentioned things.


I don't think he was trying to say that you should not wear gloves. He was saying if you didn't wear it sending a single package then it is not a big deal. If you are saying that having your fingerprints on a single package would be enough to get you in jail then that is what is dumbfounding. Unless you are from like North Korea or something...

Yes you should wear gloves...no fingerprints on a single package would not be enough to get you in jail...

Having your fingerprints on one single package is enough intelligence to get you put under surveillance for enough additional evidence to be gathered to get you sent to prison. If the prints are on the inside of the package it is probably enough to get you raided in and of itself. So yes a single fucking print on a single drug package is enough to get you in jail. It is a huge deal if you don't wear gloves while sending a single package, if the DEA is ordering the package from you to try to gather forensic intelligence ! If you dipshits would read the leaked .pdf from the Australian feds investigating SR, you would see that they ordered packages from vendors here and forensically analyzed them looking for fingerprints and other trace evidence. There is no debate here, you guys are flat out fucking wrong.

Pages: 1 ... 81 82 [83] 84 85 ... 249