Silk Road forums
Discussion => Security => Topic started by: kmfkewm on April 07, 2013, 12:26 pm
-
After starting to visit the shipping sub forum a bit more I have become aware of a worrying trend. This trend is vendors buying vendor specific products (tracking stamps, MBB and other shipping supplies) from other vendors. I think that this is extremely worrying from a security perspective. In the case of MBB it is worrying simply because the vendors ordering these supplies are getting them sent to boxes that can of course be put under surveillance. Even if they order the bags from throw away accounts, it wont matter, because only vendors are going to order those and they leak their geolocation anyway so it is simply a matter of matching up the geolocation to the vendors known to operate out of that area. If one of the big MBB vendors turns out to be a fed, or is later compromised, that could lead to the busts of all of the vendors who ordered from them, and it seems that a LOT of vendors are ordering these bags from a select few suppliers selling them on SR. This is extremely worrying to me. Even more worrying is the fact that apparently several vendors are buying tracking stickers from vendors on SR who specialize in selling them. This to me just seems so dumb that anyone could think this is a good idea. Now not only do these tracking sticker vendors get the box information of the vendors they are shipping them to, but they can trivially get the addresses of all customers sent anything with those tracking numbers! This means they can easily send a vendor a hundred tracking stickers, put the box they ship them to under surveillance, identify the vendor, wait for them to send out 100 packs, identify all 100 of the customers addresses, intercept some of the now very easy to locate shipments, find they have drugs in them and raid the vendor. That is just fucking horrible security and I am blown away that any vendors are stupid enough to be doing this! I don't want to point any fingers at anyone, if there is one thing I know it is that a lot of people trying to offer services are not well versed in security , but really to me this full situation just looks like an operation unfolding. They cannot get through our technical security measures so instead they try to get at vendors and customers by tricking vendors into ordering shit from them, in some cases ordering shit from them that allows them to enumerate their entire client bases addresses and locate their packages at will! Now is this certainly happening? No, but it sure as fuck could be, and that is extremely concerning.
-
subbed
-
How the fuck can anyone be this dumb?
Both of these products are easily and readily available on the clearnet.
-
Good points! unpronounceable one ;D
FWIW As for Mylar it can be bought by the meter at your local hydro shop ;)
-
Funny I read this just now. A few hours ago I was having a conversation with someone about how stupid it seems to buy the dope baggies on here. That says nothing but "I am getting ready to distribute". Also, I think it is a VERY dumb move to buy "pre-loaded" usb devices for "security". Maybe it is just me, but these things seem like a 1 way ticket to prison/jail. I really do not want to offend any vendor who is legit in offering these things, but security wise, it seems absurd.
-
Funny I read this just now. A few hours ago I was having a conversation with someone about how stupid it seems to buy the dope baggies on here. That says nothing but "I am getting ready to distribute". Also, I think it is a VERY dumb move to buy "pre-loaded" usb devices for "security". Maybe it is just me, but these things seem like a 1 way ticket to prison/jail. I really do not want to offend any vendor who is legit in offering these things, but security wise, it seems absurd.
Yeah I have called out the preconfigured USB devices in the past but I just figured nobody actually is dumb enough to buy one of them. But from reading the shipping sub forum I can see that several vendors are apparently dumb enough to buy their shipping supplies here. Hm, vendors accessing SR with preconfigured devices they buy on SR, to get orders for drugs from customers (I can only assume over privnote), then putting the drugs in bags they bought off SR , packaging them up and slapping on a tracking sticker they bought off SR. What could possibly go wrong, other than absolute total compromise of everything related to that vendor?
-
It is just far too easy to obtain these things legally and without using a currency that is constantly growing. I do hope vendors that have made this "lapse of judgment" corrects it very quickly. You are putting everyone at risk and most importantly, these are the sly tactics that will be used AND WORK to catch some. I feel like some people are far too wrapped up in making cash on here and moving product to think about what happens when caught. Your bank accounts are drained, your contacts are possibly screwed, you sit in a cell, and most importantly it is a victory for LE vs. SR. Hats off to all of those who go that extra mile!
-
This is why I wish they would charge even MORE for vendors to join....... Too many really young small fries joining that haven't thought out their operations yet...... Takes almost a good YEAR to research and plan out an op for SR that will be safe to run for both the vendors and customers. We take this planning and CONSTANT changes to plans seriously. Please other vendors don't get into habits or routines for your operation. Stagnation is the death of an operation.
-
Everything above.
The moisture barrier isn't the issue, it's the odor barrier, as I understand this, so I guess I need to shift to the term "OBBs."
There are lots of odor blocking products - there is a massive industry to keep stink from escaping enclosures. I don't want to undercut anyone's sales, but, damn, when you know what the materials involved are and what to search for, there are dozens of suppliers available out there with a bare minimum of looking. Foodservice, janitorial, chemical, medical, disaster preparation enthusiasts, etc. There are several completely legit and widespread reasons (eating food, for example) that I can come up with off the top of my head to be buying high-quality preservation products which involve odor barriers.
I'm more interested right now in the tracking labels and the absence of priority stamps at local POs, with the redirects to the automated kiosks.
Coming up routinely at all the post offices we use for work, and random office staff are making comments - we use priority envelopes often with stamps, and the stamp-buying limit stays under petty cash - so it's noticeable.
-
Less worrying than all of the above but still "meh" is this listing that comes via PDF only.
http://silkroadvb5piz3r.onion/silkroad/item/cb148e6799
-
thanks kmfkewm for being outspoken and bringing this to peoples attention, seems like it would be common sense to avoid such practices but sadly thats not in high supply on sr these days. this was one of the things that needed to be brought up to avoid future problems. hopefully more people will read this thread and improve where they can on their business practices.
-
Everything above.
The moisture barrier isn't the issue, it's the odor barrier, as I understand this, so I guess I need to shift to the term "OBBs."
There are lots of odor blocking products - there is a massive industry to keep stink from escaping enclosures. I don't want to undercut anyone's sales, but, damn, when you know what the materials involved are and what to search for, there are dozens of suppliers available out there with a bare minimum of looking. Foodservice, janitorial, chemical, medical, disaster preparation enthusiasts, etc. There are several completely legit and widespread reasons (eating food, for example) that I can come up with off the top of my head to be buying high-quality preservation products which involve odor barriers.
I'm more interested right now in the tracking labels and the absence of priority stamps at local POs, with the redirects to the automated kiosks.
Coming up routinely at all the post offices we use for work, and random office staff are making comments - we use priority envelopes often with stamps, and the stamp-buying limit stays under petty cash - so it's noticeable.
I asked a smart friend of mine about the difference between odor and moisture vapors. Pretty much the two correlate in that lower of one implies lower of the other as well. I cannot find any metrics for odor gas permeability, but MVTR is a well established for water vapors, and it should correlate with odor as well. This means that using MBB , in and of itself, is superior to using regular vacuum sealing bags.
-
Everything above.
The moisture barrier isn't the issue, it's the odor barrier, as I understand this, so I guess I need to shift to the term "OBBs."
There are lots of odor blocking products - there is a massive industry to keep stink from escaping enclosures. I don't want to undercut anyone's sales, but, damn, when you know what the materials involved are and what to search for, there are dozens of suppliers available out there with a bare minimum of looking. Foodservice, janitorial, chemical, medical, disaster preparation enthusiasts, etc. There are several completely legit and widespread reasons (eating food, for example) that I can come up with off the top of my head to be buying high-quality preservation products which involve odor barriers.
I'm more interested right now in the tracking labels and the absence of priority stamps at local POs, with the redirects to the automated kiosks.
Coming up routinely at all the post offices we use for work, and random office staff are making comments - we use priority envelopes often with stamps, and the stamp-buying limit stays under petty cash - so it's noticeable.
I asked a smart friend of mine about the difference between odor and moisture vapors. Pretty much the two correlate in that lower of one implies lower of the other as well. I cannot find any metrics for odor gas permeability, but MVTR is a well established for water vapors, and it should correlate with odor as well. This means that using MBB , in and of itself, is superior to using regular vacuum sealing bags.
OK, this is a matter of molecular size and plastic type and thickness. If it is an odor, then it is either an aerosol or gas. The odors from any and all drugs are usually a little bit of both. The permeability issues can be easily googled for scholastic/scholarly journal papers if you are in the U.S.
Google first for safe storage plastics for all your various acids. Look for safety gloves and acids... pertaining to safety. There is a lot of information about polyethylene, nitrile, latex, polypropylene, etc.... I gotta go for now, but that should get you started.
-
This is why I wish they would charge even MORE for vendors to join....... Too many really young small fries joining that haven't thought out their operations yet...... Takes almost a good YEAR to research and plan out an op for SR that will be safe to run for both the vendors and customers. We take this planning and CONSTANT changes to plans seriously. Please other vendors don't get into habits or routines for your operation. Stagnation is the death of an operation.
What about a 'test or type of written exam, which requires research on vendor AND buyer relevant subjects, including understanding how to configure ones computa and fluency with PGP ...or course .... as well as the 'conditions' new vendors MUST accept or face expulsion e.g. NO FE ...No FE until 30 transactions of at least $100 ... a few thinks like that, and makes penalties i.e fines for 'minor breaches of the Rules of being a SR vendor" and more appropriate penalties for greater transgressions all the way to freezing an account (as they do already ...but let's get incremental with the penalties, 8))
What do you think? A bit like "learning The Knowledge" for a London black cabbie ;D And long time buyers with good stats would smoke vendor tests like these, it might well separate the seed from the chaff :o
-
Should we work to compile a list of all vendors who sell/buy these products from other vendors so we can choose to avoid them for our own security?
-
Now wait a minute... I'm not a vendor and don't go around asking vendor friends to copy/paste the roundtable stuff just for little old me or something, but I'm quite certain I've seen people explicitly state that MBBs are almost impossible to find, hence the reason they get them on SR. Is that really just nonsense?
-
You can buy them online from a few places. Not that hard.
-
we can take this thought experiment:
a vendor on SR has invented a totally impenetrable bag solution, impermeathon. Unfortunately, the only way you can get impermeathon is by ordering it from them. Even if we all agree that impermeathon is impermeable , and dogs will not hit on customers packs if the drugs are in the impermeathon bags, it is even worse than using no sealing bag at all now because all the vendors are centralized in getting orders of impermeathon from a potentially rouge and certainly compromisable node. At the end of the day the argument has nothing to do with what materials are best, and everything to do with what vending practices are best. Given the choice between perfect packaging and overall vendor security, we would be wise to opt for overall vendor security. Thankfully there are ways you can get impermeathon without going through channels on SR, but just keep in mind that if the vendor is compromised it doesn't matter if they ship their drugs through a teleportation device that bypasses customs and postal system entirely.
-
^^ Very good point.
Also, I dunno why people would buy from SR anyway, it's cheaper not buying from SR... unsafe and expensive.
-
Your point is well taken, kmf; I just for whatever reason like to be at least mildly informed and wanted to know if it was really just gibberish I've seen people saying or what. That or a manufactured memory. Either way, I know to ignore that particular bit of info as false now, heh.
-
I was wondering about this myself privately for awhile. There are certain things you can buy here that might indicate you're a vendor, like those MBB bags, even if you use another account.
you can get those bags elsewhere and cheaper too. If it makes my customers feel better, no i don't buy anything here, and really have no need to
Blueveil is right with a previous comment. It takes quite a bit of planning to make sure critical things are kept completely separate, with no crossover. That's the way you're going to be able to stay around for the long term
-
And what about LE using the websites on the clearnet to trace the purchase? Because doing that is going to be way fucking easier than finding an established vendor and making him work with them.
You can imagine not many people actually buy this stuff, it wont take the police long to put 2+2 together. And at least you have anonymity on here.
I trust the vendor I've bought them from.. He was the guy that introduced it all to us. Granted I don't use my own name or address when ordering.. any vendor that is stupid enough to do that deserves to be caught frankly.
Might I add that the bags I get have no serial number or anything either.
-
the MBB bags I use have lot numbers on them, and you can easily cut those out
Yeah I saw this one coming a mile away. But what about the writing on the MBB bag? I don't know where to buy them with cash and I'm worried they can use the writing on the bag to trace it back to the place where I bought it.
-
And what about LE using the websites on the clearnet to trace the purchase? Because doing that is going to be way fucking easier than finding an established vendor and making him work with them.
You can imagine not many people actually buy this stuff, it wont take the police long to put 2+2 together. And at least you have anonymity on here.
I trust the vendor I've bought them from.. He was the guy that introduced it all to us. Granted I don't use my own name or address when ordering.. any vendor that is stupid enough to do that deserves to be caught frankly.
Might I add that the bags I get have no serial number or anything either.
That's what I'm worried about too! But dude, that person selling you the bags might be law enforcement themselves. And even if there is no serial number on the bag, they can still use the writing on the bag to get the manufacturers info. Lots of them include a batch # or some way to identify the bags. Then they can narrow it down to the people in your area who had the bags sent to them.
Mine have no numbers are tracking codes on them - they are just simply a large sheet that I cut out and heat seal together to make pouches with.
I don't feel at risk at all, really.
-
And what about LE using the websites on the clearnet to trace the purchase? Because doing that is going to be way fucking easier than finding an established vendor and making him work with them.
You can imagine not many people actually buy this stuff, it wont take the police long to put 2+2 together. And at least you have anonymity on here.
I trust the vendor I've bought them from.. He was the guy that introduced it all to us. Granted I don't use my own name or address when ordering.. any vendor that is stupid enough to do that deserves to be caught frankly.
Might I add that the bags I get have no serial number or anything either.
That's what I'm worried about too! But dude, that person selling you the bags might be law enforcement themselves. And even if there is no serial number on the bag, they can still use the writing on the bag to get the manufacturers info. Lots of them include a batch # or some way to identify the bags. Then they can narrow it down to the people in your area who had the bags sent to them.
Mine have no numbers are tracking codes on them - they are just simply a large sheet that I cut out and heat seal together to make pouches with.
I don't feel at risk at all, really.
What is more likely, that law enforcement will coerce all clearnet providers into supplying all customer information to them, or that law enforcement will set up shop on a massive international drug selling site and hope that vendors use their service? It doesn't matter if your bags have serial numbers on them or not, you give the vendor a shipping address that can be put under surveillance. LE would be very smart to start selling vending supplies on SR, it is a surefire way to identify vendors stupid enough to order vending supplies on SR.
-
I don't feel at risk at all, really.
I'm pretty sure this is what everyone who has ever been compromised thought as well.
-
Now wait a minute... I'm not a vendor and don't go around asking vendor friends to copy/paste the roundtable stuff just for little old me or something, but I'm quite certain I've seen people explicitly state that MBBs are almost impossible to find, hence the reason they get them on SR. Is that really just nonsense?
Complete nonsense often known as laziness. This is pretty new to me but if vendors are doing this then I honestly would want to know as a buyer because a vendor that lazy and unsafe shouldnt really be in the community. Not to add that as mentioned earlier its actually easier to obtain than ordering from SR.