Silk Road forums
Discussion => Security => Topic started by: project2501 on April 07, 2012, 05:53 am
-
http://utovvyhaflle76gh.onion/sTORage/talk.masked%5F11.23.2012.tar.gz
-
aliens landed on talk.Masked at core.onion (http://eqt5g4fuenphqinx.onion/)
and apparently hacked it, or flirted with it, or fucked it, or something; maybe everything.
Vive la Revolution!
-
Whoa, the saved web page is trippy. Is it a trick? What does this mean? The site is still up and running.
-
WTF is this? HTML+CSS? Don't tell me a "hacker" figured it how to save pages? ;D
-
It's subtle. There is something going on with the number of page hits and the post count.
At the moment, the talk.Masked "hits today" counter doesn't seem to be working as one might expect. Something else might be going on; there were several (seemingly) related posts leading up to the last post:
3,776 hits today, 23,273 notes
The subject "Pineapple" is suspicious. From the Urban Dictionary:
Pineapple:
The act of backing out of a game or room.
"This room totally sucked so we pineappled."
But I might be reaching.
-
The second to last post seems like it might be setting up or leading up to the "Pineapple" event.
3,827 hits today, 23,271 notes
Fri Apr 6, 11:23 PM EST
11:23 PM EST is 23:23 EST
Then the "Pineapple" post:
3,776 hits today, 23,273 notes
Interesting points:
1. The "hits today" have decreased in the 17 minutes that elapsed between posts.
2. The number 23 occurs excessively.
3. The pineapple post occurred at 11:42 PM EST or 23:42 EST.
4. There was a lot of chatter about the Illuminati leading up to the pineapple event. The Bavarian Illuminati, an Enlightenment-era secret society, was founded by Adam Weishaupt on May 1, 1776.
5. The pineapple post occurred when the board had "3,776 hits today".
-
I've been getting into this. The attack seems to be timing related. Interesting items found so far:
1. There are five posts of the "hits today", "number of posts", and "current time" variety leading up to the pineapple post.
talk.Masked time-stamps posts like "3 minutes ago" or 5 hours ago" and so forth.
2. There were five posts with a time-stamp of "23 hours ago". That is, 23 hours before the pineapple event there were five postings, two of them were about Debian Linux and seem like typical board chat. Here are the other three:
That looks like a server for some video game. Source engine. Basically you're a butthurt kid who just got banned from a game, and now you want us to be your personal army.
DDoS
23 hours ago
Assimilation [eVoltiOn||design} Selection
"The slow blade penetrates the shield." - Gurney Halleck, Dune
Borg china
23 hours ago
Talk: Is Anonymous serious? Too pathetic for words.
.....And I viddied that thinking was for the gloopy ones
...and that the omny ones use like inspiration
.and what Bog sends.
Anonymous Botnets DDOS Borg china
23 hours ago
Then the probing started (at 3:20 AM EST):
3,768 hits today, 23,213 notes
20 hours ago
-
Posts are being deleted from the site on a regular basis. What is really odd is that it is mostly civil posts in the significant conversations that seem to disappear. The belligerent, whimsical and creepy posts are left intact. If it is censorship, it doesn't seem to be sane. I emailed the site owner asking for an explanation.
-
Could be what I think of as 'traffic stenography' (misplet), a lot of that goes on in the Tor network.
You have some indirect method of control in some publicly accessible arena e.g. bus routes, letters to the editor, sequence of songs played on a radio station, seconds between windows updates, misspellings on forum posts... etc.
There is always patterns in such things. Thing is, you can hide information in those patterns to send messages. Only those able to do certain traffic analysis are capable of receiving the message.
Protip: pretending that such patterns exist could also be an excellent way to turn the enemy into paranoid fruitcakes and waste their time, remember, Russell Crowe in A Beautiful Mind? Something like that :D