Silk Road forums

Quote from: kmfkewm on January 23, 2012, 01:24 am

Quote from: QTC on January 22, 2012, 06:27 pm

Quote from: Mr. D on January 22, 2012, 06:06 pm

So you're saying that Secure Erase is a better way of cleaning up a compromised computer?

It'd be sweet if there was a tutorial on how to Secure Erase/ dBAN in order to reload windows and its "Non-SR related programs"

FWIW, I spoke to a data recovery engineer who often does outsourced work for local and state police departments, and their opinion was that a simple one-pass wipe would suffice. Additionally, they mentioned if destruction is what you're after, seemingly non-destructive things like taking the cover off an HDD and dealigning the platters by even a few microns or misaligning the head stack would cause serious harm to any recovery outlook.

For local and state police a one pass wipe probably will suffice, for FBI it probably will not.

I don't think that is true about dealigning the platters or misaligning the head stack though, I know for a fact that data has been recovered from platters even after they are shattered into bits and seriously physically damaged. Does your friend not know what spin stand microscopy is? There are even more sophisticated microscope techniques for recovering data from wiped / physically damaged drives, but that by itself is adequate to pull data from shattered platters. If you are not using Secure Erase, your erase probably wasn't secure . You might want to use DBAN on top of it just incase though .

There are lots of different packages out there but most 3 pass or 7 pass 5220.22-M spec cleaners are pretty sufficient for most people. Just make sure you 'delete' or uninstall anything that might be related and go through the folders to make sure it really de-installed everything and then run it. You'd really have to be on quite the list of 'bad guys' for them to take the time and resources to do something like attempt to piece together a broken platter or the sophisticated microscope techniques you are referring to. I'm not specifically familliar with them but I'd be curious in what circumstances this would be merited and at what LE level this would be considered 'commonplace'. I mean sure if you are shipping kilos of coke perhaps but how 'big of a player' do you have to be for them to spend that kind of time/energy in recovering your data?

FBI recovered data from a DBAN wiped drive to pwn a really big carder before. Using secure erase is so easy that you might as well use it since it actually is secure. Also using programs that only wipe single files is almost never secure from forensic recovery. But may be secure from local and state LE.

Quote from: therealstansmith on January 23, 2012, 07:48 am

man its sad to say but this topic is gonna get a lot of sellers busted... should of stuck with dont say shit to help leo

How?

The FBI spends at least several times whatever SR is worth.

We're no smarter than the many experts they use. Think logically.

We're the ignorant ones, not them.

No but the experts who made the tools you use are far smarter than they are

I wonder what law enforcement agencies would do if someone made an assassination market. Similar to SR really, Tor hidden service and all that but instead of buying drugs you place bets on the last day a person will be alive. So you can place a bet that the lead agent of the DEA for example will not be alive on a certain date. The person who picks the correct date wins the entire jackpot, payable in anonymized bitcoins of course. It shouldn't be a Tor hidden service though, NSA might attack a site like that.

The most scary thing about assassinations is how anonymous they can be. Look how hard it is for them to trace drug packages it is probably no easier for them to trace bombs. Hell it took them ages to get the Unabomber and they only got him via a writeprint analysis attack done by his brother. This technique is often very frequently used by special operations teams for the assassination of targets, so they seem to think it is very effective.

Don't over estimate the powers of law enforcement. They are generally a step behind. We could pwn them. However the military would pwn us.

Another good idea is the use of self made UAVs. There are open source software solutions for flying them. And open source designs for making little flying helicopters even. Plus you can even buy them, but that might not be a good idea. There is really no reason why you couldn't use a laptop in one part of the country to control a mini helicopter on the other side, just use a cellular phone network and a VPN. There are mini UAVs with cool features, you can lock them onto vehicles etc and they can carry multi kilo loads. Some sophisticated smugglers use things similar to this to fly drugs over borders, but they could also be weaponized easily.

Booby trapped homes that you get raided could probably wipe out SWAT teams fairly effectively.

Quote from: kmfkewm on January 23, 2012, 03:46 am

Actually if you are anonymous it doesn't matter if you have a password at all, GPG will still offer you protection. A 4,096 bit key is the same size regardless of the password used to decrypt it . Your password is to protect your encryption key not to protect your encrypted messages. Those are protected with your encryption key.

Yeah, you're right, 4096 bits is 4096 bits, and if all the feds have is an armored text file, they don't have squat - but if they seize your computer and get a copy of your keyring, suddenly that passphrase becomes a hell of a lot more important.

If the feds have located someone they know to be an encryption user, and the user continues to get any significant security advantage by using encryption, it just goes to show the feds are fucking incompetent. Most of them are. Some may not be. Unless you are running your military grade encryption algorithms in a secure compartmentalized information facility with two foot thick metal walls and constant surveillance on it, you are not getting the full advantages of military grade encryption. Short of that you could try things like keeping your laptop on you at all times and your home under surveillance to protect from hidden cameras hardware keyloggers etc, but keys and passwords and plaintexts leak so far away via so many channels (not to mention can be stolen in so many other ways) (LCD monitors can have their display reconstructed from several rooms distance away and through walls, via transient electromagnetic pulse analysis) that the only significant security benefit that encryption gives you is the ability to protect your anonymity and the ability to protect yourself from stupid attackers (ignorant to the fact that you use encryption, or ignorant to the techniques capable of stealing keys) and non-targeted attackers (someone randomly steals your laptop to pawn it)

two attacks are very attractive:

human intelligence gathering massive amounts of customer addresses, this would be done via a nym flooding attack with persona management software allowing a small team of agents to operate hundreds or even thousands of distinct personalities / nyms on SR.

Membership observability of the Tor network if bridges are not used will allow any attacker who can monitor some of the Tor directory authorities to enumerate Tor client IP addresses. If such an attacker also orders from vendors here to get postmarks, they could intersect the list of people who live in a certain radius of where the package was sent from with the list of all Tor users, and probably majorly hurt vendor anonymity. This would then need to be followed up on with small surveillance team operations monitoring all of the potential suspects looking for patterns associated with participating as a vendor on silk road. Or simply monitoring of their mail boxes until a dog hits on a pack and they get a warrant to raid and get all the other evidence that they are participating as vendors. Tor doesn't hide the fact that you are using it (unless you use bridges) and the postal system doesn't hide the rough geolocation of the person who sent a package...when those two crowds are intersected the third crowd produced may be (will likely be) small enough for surveillance operations to narrow in on the vendor. In many cases they may not even need to watch more than one person, particularly if the vendor lives in a small rural area and ships from near it.

I see these as two of the most likely attack scenarios. A third likely attack scenario is the monitoring of bitcoin exchanges since about 90% of people here (my estimate) are not properly using Bitcoin and think that it is inherently anonymous when in reality the transaction history is inherently entirely public and fully linkable, making it quite unanonymous unless additional measures are taken.

A fourth likely scenario is the compromise of the SR server, either after it is traced (people here are putting far too much faith in the anonymity of Tor hidden services, when in reality they can be traced with fairly little effort / skill level / legal power / some combination) or after it is remotely pwnt by hackers (people here are also putting too much faith in the SR admins security abilities, and he is putting too much faith in Tor and Bitcoin although he is probably himself fairly safe as a Tor client if he knows how to further anonymize bitcoin). After the server is pwnt the attacker could simply harvest addresses for a few months and interpol could coordinate a fairly tremendous international operation against large numbers of people who do not use GPG to encrypt their addresses. Or they might even try to MITM people who use GPG encryption, measures need to be taken against this as well.

I think those are the four most likely things that will happen. You can protect yourself from all of them but I doubt more than 5-10% of the users here are. Most of the people protected from these sorts of attack are from the private forum scene also, most likely, we have groups who have been working on their security and operating techniques for over a decade now after all....some of us are pretty close to being almost impossible to bust other than by human intelligence (ordering product from a fed) or surveillance (ordering product from someone who ordered product from someone who ordered product from a fed, if they do a long term multi-jurisdictional surveillance operation without actually inserting their own malicious nodes into the network. Using fake ID boxes and counter surveillance techniques can make this more difficult / expensive for them to do, but it is really hard to protect from surveillance of identified physical product routes). We are currently working on developing hardware that will detect essentially all interceptions, that idea will turn out to be a massive leap in security for us since interception is currently also one of the biggest risks involved with this.

Firstly it's not intended to protect you from the hacking elite, I've never made that claim even once.

It really isn't intended to protect from much of anything, that is the main issue with it.

Secondly VMware is NOT full hardware virtualization, it's paravirtualization in this case (Full hardware virtualization is only available in their ESX products).

I am pretty sure ESX products are actually for paravirtualization, where as vmware workstation etc are full hardware virtualization. You are confusing

The more you respond the more it's clear that you have a very limited understanding (much more so than I had thought) of virtualization. I've made a career of it and security for well over a decade now, can you make that same claim? I doubt it.

I have only been studying computer security for about six years, but I do find it unlikely that you have ever worked in the computer security industry.

The only claim I've made as to it's purpose is it's intended to keep your data and transactions secure from LE.

And it will not, which is the issue

I never made any claims about the DEA. What intelligence work I did I really can't comment on for a plethora of reasons and you must be out of your fucking skull to think I would disclose any details related to that, I might as well eat a bullet before I disclose those details. The most I can say is I worked in general terms in the information security field, but thats all I will disclose.

Actually you did make claims about the DEA and the NSA. I didn't ask for specific details I just am curious which sort of work it was, SIGINT, COMINT, MASINT, etc. I don't think anyone will kill you for saying that will they?!

ASLR? Really? Are you really going to suggest that ASLR is even REMOTELY necessary for this application? If so go butt fuck your fantasy lover Theo and be done with it already. While ASLR provides levels of security to protect against hacks and the like thats NOT what this device is intended to be secure from as I have said over and over again but apparently that thick skull of yours doesn't seem to allow much data to penetrate it. I guess it's too secure.... 

ASLR and a 64 bit OS are at least highly suggested if you want to avoid being pwnt by the nth buffer overflow vulnerability in whichever applications you use. Yes we know you don't think your VM is secure from hackers, that is why it is strange to market it as a security oriented VM. You also have implemented its other security features poorly, and many of them are just eye candy that serve no real security function.

See above dickbag. Nobody made any claim that spybot was going to protect anyone from a would be attacker, it's a malware tool, thats all. Which if they are only using it for it's intended purpose is completely unnecessary, just like ASLR.

Scanning for malicious tracking cookies and generic spyware is essentially useless for serious security, but being immune to buffer overflow vulnerabilities in all of the applications you run seems like a pretty necessary thing to me.

Again failing to understand how virtualization works. Go do some reading Jr. because even if they had a whole dump of the HOST machines memory it's highly unlikely they would be able to retrieve the key from the guest. Secondly if someone comes bashing in your door, don't you think pulling the plug might be a wise move? Which would prevent them from obtaining a useable copy of what was in memory prior to pulling the plug unless they restore power in less than about 5-6 seconds. Which somehow I don't think the goon squad will be able to do.

1. They will root the guest VM and dump the key from memory there? After all the guest VM has the network facing applications that they can target already running inside of it.

2. If the key is in the guest VM memory it is also in host VM memory

3. They have much more than 5-6 seconds to forensically analyze the RAM after power is cut

4. I don't think you can likely pull the plug before they restrain you

So all you need for SR is firefox? Weird, if you are such a fucking expert how is it you missed the fact there are several other tools that should ALWAYS be used with SR?

And all of the tools are more or less the same on Windows or Linux.

Against who? Who is this device protecting against? You seem to often go on tangents and lose sight of this very important fact, but the more you punch away at that keyboard the more I realize you really are just another wanna be blackhat with no concept of what is reasonable security measures are and what is completely unreasonable and overkill for a particular application.

The more you pound on the keyboard the more I see you are either delusional or an epic troll

You again are talking about security that is extremely overkill for this application. I'm not even going to repeat myself for the 100th fucking time. You have absolutely NO fucking clue what I know about security and what security mechanisms I am familliar with.

I have no idea because you have not demonstrated any security know how, all you have demonstrated is the ability to install some random stuff (shit) and what is required for SR on Windows XP.

What I have admitted is that I am interested in making money in exchange for my professional skillset that I use every day in the real world and am compensated quite well for.

It is a shame if you are being paid to do anything related to security, but not that surprising. Most corporate security people blow.

Your wrong, I know this for a fact. I will not elaborate on this further but AES256 on it's own has been compromised in the past.

When it is used as a checksum AES-256 has had its security substantially reduced, I think there was also an attack that caused significant damage to it when used as a symmetric encryption algorithm, however there are no known cases of AES-128 or higher being directly broken. You can spout off bullshit uncited claims and say you have secret inside info all you want, but at the end of the day it just makes you look like a fuckwad. Citation, technical details, or shut the fuck up, to put it nicely.

Again showing your lack of comprehension of security in virtualization applications. There is isolation between guest memory and host memory, when was the last time you examined the memory dump of a guest VM generated from the host? If you did it wasn't very useful because it needs to be generated from within the guest to be useful.

1. They will analyze the virtual drive looking for the leak
2. Things in guest memory also must be in host memory

Nothing is ever %100 fool proof, suggesting anything otherwise would be disingenuous at best. If you are such an expert at cryptanalysis and/or forensics hows about I provide you with a file and a message inside it and when you are able to recover the data then you will have earned some semblance of a leg to stand on, until then you are nothing more than a forum troll spouting off at the mouth about things you don't know anywhere near what you suggest you do about.

I doubt that I can decrypt anything you send me that has been encrypted with a strong algorithm. I also doubt that the NSA can. You are the one claiming that AES-256 can be cracked, not me.

You clearly (again) demonstrating a significant lack of knowledge about the types of virtualization in use and the mechanisms and features of each. This vm is NOT full hardware virtualization or HVM for those in the industry (like myself) refer to it.

HVM and full hardware virtualization are not the same thing, you can have full hardware virtualization via binary translation without using HVM. This is the way the terms are very commonly used anyway, technically I believe that binary translation is not actually full hardware virtualization, but virtualbox is still called full hardware virtualization even if it isn't getting hardware support from the CPU.

The scope of the project is to keep you safe from local/state and FBI LE, thats it.

This product will not keep you safe from FBI and is unlikely to keep you safe even from many state and local agencies.

Quote from: Mr. D on January 22, 2012, 06:06 pm

So you're saying that Secure Erase is a better way of cleaning up a compromised computer?

It'd be sweet if there was a tutorial on how to Secure Erase/ dBAN in order to reload windows and its "Non-SR related programs"

FWIW, I spoke to a data recovery engineer who often does outsourced work for local and state police departments, and their opinion was that a simple one-pass wipe would suffice. Additionally, they mentioned if destruction is what you're after, seemingly non-destructive things like taking the cover off an HDD and dealigning the platters by even a few microns or misaligning the head stack would cause serious harm to any recovery outlook.

For local and state police a one pass wipe probably will suffice, for FBI it probably will not.

I don't think that is true about dealigning the platters or misaligning the head stack though, I know for a fact that data has been recovered from platters even after they are shattered into bits and seriously physically damaged. Does your friend not know what spin stand microscopy is? There are even more sophisticated microscope techniques for recovering data from wiped / physically damaged drives, but that by itself is adequate to pull data from shattered platters. If you are not using Secure Erase, your erase probably wasn't secure . You might want to use DBAN on top of it just incase though .

how much are you looking to pay I have a friend looking to sell a lot of ketamine right now. He usually charges about $15,000 per kilo but since there is a 50/50 escrow system requirement here I doubt he would go lower than $30,000. He would probably also raise his price to not have to pay the SR tax, so add that on top of the $30,000 for an estimate of what you would expect to pay. If you are still interested let me know and I will point him over here, right now he only works on one private forum and I don't think he has an account here yet.