<story><title>A dark web tycoon pleads guilty, but how was he caught?</title><url>https://www.technologyreview.com/s/615163/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught/</url></story><parent_chain></parent_chain><comment><author>marta_morena</author><text>This sounds fishy. He probably pleaded guilty as part of a plea deal, so law enforcement has a scapegoat and some meaningless &amp;quot;media success&amp;quot; in exchange for him getting a drastically reduced sentencing. They always do that, threaten people with insane penalties if they don&amp;#x27;t accept so shitty plea deal and if you are not super certain that you can win, you will likely accept that one, just because it seems &amp;quot;safer&amp;quot;.&lt;p&gt;There are a LOT of cases like this, just most of them don&amp;#x27;t gain this publicity. Actually, 95% of court cases never reach court because of this. Innocent people plead guilty because they don&amp;#x27;t have the wealth and resources to win in court. USA is a shithole when it comes to law enforcement. Medieval and sad. Land of the free (as long as you are rich, that is).</text></comment>
<story><title>A dark web tycoon pleads guilty, but how was he caught?</title><url>https://www.technologyreview.com/s/615163/a-dark-web-tycoon-pleads-guilty-but-how-was-he-caught/</url></story><parent_chain></parent_chain><comment><author>ohmygodel</author><text>Running a hosting server for onion services, as was done in this case, is a terrible idea. It greatly increases the risk of deanonymization. The question is less how this hosting service was discovered and more how it ever stayed up long enough to become so notorious. Here&amp;#x27;s why:&lt;p&gt;1. Each hidden service chooses a &amp;quot;guard&amp;quot; relay to serve as the first hop for all connections.&lt;p&gt;2. A server running multiple hidden services has a guard for each of them. Each new guard is another chance to choose a guard run by the adversary.&lt;p&gt;3. An adversary running a fraction p of the guards (by bandwidth) has a probability p of being chosen by a given hidden service. A hosting service with k hidden services is exposed to k guards and thus has ~kp probability of chosen an adversary&amp;#x27;s guard. With, say, 50 hidden services, an adversary with only 2% of guards has nearly 100% chance of being chosen by one of those 50 hidden services.&lt;p&gt;4. The adversary can tell when it is chosen as a guard by connecting to the hidden service as a client and looking for a circuit with the same pattern of communication as observed at the client. Bauer at el. [0] showed a long time ago this worked even using only the circuit construction times.&lt;p&gt;5. The adversary&amp;#x27;s guard can observe the hidden service&amp;#x27;s IP directly.&lt;p&gt;The risk of deanonymization with onion services in general (i.e. even not using an onion hosting service) is significant against an adversary with some resources and time. Getting 1% of guard bandwidth probably costs &amp;lt;$500&amp;#x2F;month using IP transit providers (e.g. relay 8ac97a37 currently has 0.3% guard probability with only ~750Mbps [1]). And every month or so a new guard is chosen, yielding another chance to choose an adversarial guard. Not to mention the risk of choosing a guard that isn&amp;#x27;t inherently malicious but is subject to legal compulsion in a given jurisdiction (discovering the guard of a hidden service has always been and remains quite feasible with little time or money, as demonstrated by Øverlier and Syverson [2]).&lt;p&gt;[0] &amp;quot;Low-Resource Routing Attacks Against Tor&amp;quot; by Kevin Bauer, Damon McCoy, Dirk Grunwald, Tadayoshi Kohno, and Douglas Sicker. In the Proceedings of the Workshop on Privacy in the Electronic Society (WPES 2007), Washington, DC, USA, October 2007.&lt;p&gt;[1] &amp;lt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;metrics.torproject.org&amp;#x2F;rs.html#details&amp;#x2F;014E24C0CD21D2B9829E841D5EC1D3C415F866BF&amp;gt;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;metrics.torproject.org&amp;#x2F;rs.html#details&amp;#x2F;014E24C0CD21D...&lt;/a&gt;&lt;p&gt;[2] &amp;quot;Locating Hidden Servers&amp;quot; by Lasse Øverlier and Paul Syverson. In the Proceedings of the 2006 IEEE Symposium on Security and Privacy, May 2006.</text></comment>