Guest wrote:It would take sometime for the FBI to compile the list, get the names and such from the providers, and then do a risk analysis of some kind as to who they should get. They will probably do token raruds and arrests, butleave the rest to the states to prosecute.
It's been just a hair more than a month since the Torsploit adventure, and even as we've continued to do some continuing sleuthing behind the scenes, we've sat back and watched how the public perception of things has unfolded. At the risk of over-simplification, we've noted two distinct trends:
- One is the assumption that some unspecified shady arm of the U.S. government was obviously behind Torsploit, and that the attack first squarely into the modus operandi of NSA shenanigans that Snowden and the journalists working with him have been exposing one after another.
Two is a repetition of the "party line" from the FBI and various aligned entities that this was simply some kind of routine law enforcement operation, designed to catch "bad guys" and not only justified but rather routine.
It takes no close reading to see that these two trends are pretty much in direct structural opposition: they can't both be true.
Today, Kevin Poulsen reported on some new data points disclosed as part of the bail hearings of the only person actually charged with a crime in the entire Torsploit story thus far. At that hearing was an FBI agent, who confirmed that the FBI was "behind" the Torsploit attack. So that means that the first version of events, listed above, has proved to be correct?
Not quite. Or not yet, anyhow - and if we were the sort of folks who bet, we'd be putting good money against it. There's still a whole forest of unknowns yet to be disclosed, but here's what we see...
Marques was arrested originally in late July. There is no public data confirming how that initial arrest came to be - how the FBI got on Marques initially. In this week's reports, the FBI is saying that they have "linked" Marques to U.S. bank accounts that were used to pay for servers leased at an unspecified hosting company in France. Did they get those bank records after the raid in late July - or before, and use them to trace to Marques? We don't know, yet.
But the claim is now made that after the late-July arrest, Marques "somehow regained access and changed the passwords, briefly locking out the FBI until it gained back control" (source: Wired). But he was in custody after the original arrest, according to all reports we've read thus far (if this is incorrect, please post a link to accurate data - thanks). How was he wrestling for control of servers if he was in custody?
Kevin Poulsen further states that "In addition to the wrestling match over Freedom Hosting’s servers, Marques allegedly dove for his laptop when the police raided him, in an effort to shut it down." That actually makes sense - given the nature of FDE, unless he down-powered the laptop, the FBI could "scrape" the RAM for his cached passkey and have full access to plaintext (which, apparently, is exactly what they did). But once he was in custody, the whole idea of a "wrestling match" for servers is decidedly odd.
Anyway, Once Marques is in custody it is of course trivially easy for the FBI to gain full control of the servers themselves. Assuming the machines weren't themselves powered down remotely, the FBI (or whomever) would have physical access to them - which allows for the same "RAM scrape" attack against FDE (assuming they were FDE'd). This is assuming they're dedicated boxes, which seems reasonable.
However, even with physical root to the machines (dom0 if they're virtualized), it's quite possible that layers up the chain could be very difficult to access without credentials. We're not familiar with the mechanics of hosting Tor hidden services, but in general one can do a fairly good job of locking down applications upstream from the metal in a box that has been powered down (as for example in a RAM scrape attack). And - we are left somewhat with instincts to go by here - our gut is that this isn't what happened. Here's what seems more likely...
If the FBI was able to locate the physical machines (i.e. servers in France) before the raid on Marques, they'd be able to sit as a "bump on the wire" in the datacentre and wait for a reboot. They could engineer a reboot (assuming the DC is cooperating - which is routine): turn the power off, and wait for the admins of the boxes (whoever that was - assuming they don't know who Marques is yet) to log in and boot the machine back up. If it's FDE'd, the admin could either do so via KVM (trivially easy to intercept) or they'd have a DC employee type in the FDE passphrase (in which case they have it). With that, and some good tech skills, they can "piggyback" on the boot-up & squirrel themselves away up in the OS and in the app layer of the server.
Once there, they can sit and wait to see who logs in.
At some point, they get enough data from that privileged position on the server to ID Marques physically - and they schedule the raid on him. This is congruent with all known facts thus far, and with previously-disclosed FBI attacks on other overseas targets in the past. So far, so good. If they have access to those machines prior to Marques' raid, then they can of course be listening in for any "associates" who might also come through them. That's a key point.
Once Marques is arrested, here's what we think likely happened: someone else with access to the admin capabilities of his machine(s) cycled passwords on them - this is the putative "wrestling match" that took place after his arrest... Marques was not directly involved at all. But if the FBI (or whoever) had physical root, they could win that battle - eventually - unless the outside admins were very clever, very quick, or both. So that'd explain things going down for a while - which is what happened, going from previous press reports.
At this point, Freedom Hosting is down. Marques is in jail. There's no public explanation for what's going on. This is Wired's Kevin Poulsen, reporting on 5 August:
"Shortly after Marques’ arrest last week, all of the hidden service sites hosted by Freedom Hosting began displaying a “Down for Maintenance” message. That included websites that had nothing to do with child pornography, such as the secure email provider TorMail."
(this is also where Kevin first proposes that Torsploit is actually the FBI's "CIPAV" tool - which has been around since at least 2002; more on that below)
So technically, the sites weren't "down" - they were displaying a maintenance page that was loading the malicious .js... from the moment Marques was raided. Which is interesting - and means someone had control of the boxes in all but realtime during or immediately after the raid. We're reading the raid as having taken place on Thursday, 1 August 2013 (Independent: "Barrister Ronan Kennedy, counsel for the Attorney General, said Mr Marques was arrested on Thursday [1 August] on foot of an extradition warrant issued by a US court on July 29.").
The Torsploit iframe injection was noticed pretty quickly (Kevin Poulsen says that "[t]he malware showed up Sunday morning on multiple websites hosted by the anonymous hosting company Freedom Hosting," but we're aware of no definitive argument that it actually "showed up" on Sunday, but rather it seems more likely based on what we've seen that it was first noticed and discussed publicly on Sunday (the Daily Dot says the malware injection started "[s]hortly after Marques went into custody"). If someone has better data on the timing of the first citation of the iframe injection in the wild, we'd love to nail that down. In any case, sometime between Thursday and Sunday, the injection started.
As readers of this thread will already know, we began our forensic work on the two C&C IP addresses ("pitcher" and "catcher") early Monday am. By the end of the day, those IP addresses no longer responded to requests to the usual ports for web traffic - which they had been doing as of Monday am. We've been told by folks since then that they have remained nonresponsive ever since (although other addresses in the "ghost block" do respond, in odd ways - a separate post, that).
Also: there may - or may not - have been some jiggering with ARIN/RIPE records on Monday am, after we flagged the questions surrounding its provenance.
- - -
So, does this week's set of bail hearings for Marques - in which the FBI confirmed it had arrested Marques and said exactly nothing about Torsploit, malware injections, or any post-arrest fiddling with the former Freedom Hosting servers - confirm that the FBI "secretly took control of Freedom Hosting last July, days before the servers of the largest provider of ultra-anonymous hosting were found to be serving custom malware designed to identify visitors" (cite: Kevin Poulsen). Yes, sorta - they did get access to the servers, but exactly when is not yet disclosed publicly. They do claim they had live, operational control of the servers after the 1 August raid - because they claim Marques (or someone else with admin access, since he was in jail) got control back of the machines, then lost control again to... someone.
Kevin's read on this, as we understand it, is that the FBI took over the server(s) - before or after the arrest, it's not clear - and then someone, seeing all the inevitable press coverage of Marques' arrest, cycled passwords and locked the FBI out. Fair enough - we're on page up until there.
But now what happens?
Here again, we read Kevin as suggesting that the FBI got control back and then shortly thereafter (at least on or before Sunday)... and started serving the Torsploit malware via the .js in the iframe. By the end of the day Sunday GMT, word was out and people were analysing Magneto. And that the Torsploit malware is actually just... CIPAV, a known FBI tool.
Hmm, well... Kevin's a smart, conscientious, and well-informed guy. But we're going to respectfully disagree.
Some discongruent points:
- 1. Torsploit made use of a fresh Firefox 0day, which means it was coded quite recently; it couldn't have been old, nor obviously could it date back to 2002. If it's "CIPAV," then it's something so new and so fresh-coded that it's the same as the old tool in name only.
2. Torsploit was deployed against anyone who visited any of Freedom Hosting's sites - including Tormail users. CIPAV was never used previously in that way, not even close. CIPAV was/is a targeted tool.
3. No court orders relating to Torsploit have been disclosed yet (Kevin suggested that it "Magneto reads like the x86 machine code embodiment of a carefully crafted court order authorizing an agency to blindly trespass into the personal computers of a large number of people, but for the limited purpose of identifying them" [italics added]). They could still be sealed, of course - but at this point any such court order is purely imaginary.
4. We have learned, since early August, that the NSA has been on a decades-long binge of illegal/a-legal/extra-legal hacking, intrusion, subversion and disruption of the world's network security technologies... a veritable cavalcade of attacks with nary a court order in sight - not even from the FISA kangaroo court. TAO reins supreme. We've a screenshot of a NSA/CQHQ application that specifically targets Tor users - Quick Ant - although we don't know much more than that... yet.
5. We have heard nothing from the FBI about any arrests or planned arrests of anyone targeted by Torsploit injection de-anonymisation. Indeed, as many folks have pointed out, the method through which Torsploit did this didn't seem to make any effort to ensure there was enough forensically-valid data to power actual prosecutions in a U.S. courtroom... which is what the FBI is paid to do.
6. The FBI has refused to comment on Torsploit - neither confirm its involvement, nor denying it. If this is a burned tool to hit a bunch of Freedom Hosting visitors, what's the point in keeping it "secret" now, if you're the FBI?
7. Torsploit was not selectively deployed against allegedly CP-hosting hidden services. It was served shotgun-style. It went after Tormail users - which, obviously, if one has control of the server sufficient to inject the malware in the server-side "error page" loads, one can choose which visitors get it. Everyone got it - that wasn't an accident... nor was it some "carefully crafted" targeting, as Kevin suggested.
In summary, until we see more objective data - and with all respect to Kevin - we disagree that this is some newly-birthed flavour of CIPAV, and that it was served & managed by the FBI. The pieces just don't add up.
The FBI has taken the public role in the Marques extradition case itself. That is correct. The rest is speculation: was it the FBI "wrestling" with unknown outside Freedom Hosting admins, in the first weekend of August, as Marques sat in a jail cell? Perhaps... but that just stretches the bounds of credulity, to us. There's some .gov folks with ample capability for that kind of realtime tit-for-tat on a reasonably heavily-secured (overseas, non-US) server running Tor hidden services... but not many work for the FBI. Cough - TAO - cough.
Our posited hypothesis is a refinement of what we've said all along: this is an NSA job. The NSA aided the FBI in both locating the FH servers, in France, and in gaining access to them prior to Marques' arrest. After the arrest, an effort was made to cycle (or wipe) the FH servers by someone other than Marques. That effort, demonstrably, failed - some outside entity got root control of FH's machines, realtime. They also out-"wrestled" professional server admins in doing so. Not too shabby.
At this point, Marques' arrest was already splashed across the news. FH had gone down - including Tormail... if not for a considerable time, then almost certainly in blips (a "wrestling match" for admin/root control of physical machines is going to involve downtime, unless this is some sort of bizarre VM-based memory overflow battle... or something). There was no way to keep secret that FH was either compromised, or running somewhat rudderless with its alleged main admin in jail. So the panic was already out, in the public.
And at this point, what the hell would the FBI be doing taking their super-secret CIPAV tool and promptly serving it up as easy-to-reverse .js to hundreds/thousands of people visiting FH and Tormail? They just got a wild hair up their ass, and felt it would be "fun?" They figured, hell, we'll just gather a big database of people using FH - whatever they were doing - and, um, sit on it for a while? We'll go arrest some people... except not actually arrest anyone? It just doesn't fit the pattern, sorry.
What does fit the pattern is this: once someone (TAO) had control of that server (or servers) back after a brief tussle, they decided to use it as a bit of a test lab, a petri dish to see how a new bug would play in the wild. Off the shelf comes the Torsploit 0day - a routine bit of code for an agency who has been subverting security and crypto for a decade strong, secretively, with a massive budget to do so - and they drop it into FH. Everything at FH. In doing so, they gather a really nice dataset.
Yep, the data that streamed back to the "catcher" IP in Virginia are going to be a Tor attack vector researcher's best friend: they'll show the geographic distribution of FH visitors. That cookie-like thing Torsploit dropped into the browser could well connect up with... something - some other NSA system ("The malware also sends, at the same time, a serial number that likely ties the target to his or her visit to the hacked Freedom Hosting-hosted website") - Cheesy Name, or Bogus And, or Bouncing Baby... who the fuck really knows. There's so many secret programs yet to be shown the light of day within Snowden's 50,000-file stash that anyone who claims they know the full extent of NSA shenanigans must needs be playing for laughs.
And, finally, as has been pointed out before, this attack is going to do an outstanding job of FUDding the entire Tor ecosystem. The injection heard 'round the world. The Tor team has been under fire ever since (fairly or not), scrambling to contain the PR damage from Torsploit. Total chaos. People are in a panic: the Tors is broken!!!!!
If you're the NSA, well... not a bad little spot of work, that.
If you're the FBI - you've blown the cover of CIPAV, you've failed to arrest anyone else but Marques, you've targeted countless FH visitors who had nothing to do with CP or anything even remotely illegal, and you've managed to cause an international stink in the process. Which would mean the FBI is dumb - and the FBI isn't dumb. Q.E.D.
See also: "parallel construction," if you're wondering how the FBI might end up on front street in taking credit for Marques' arrest... even if, behind the scenes, it's a laundry list of NSA-powered programmes that are at work. This is the world in which we live.
In time, the truth of all this will out. At core, if nobody else gets charged - beyond Marques and whoever else might be close to him in the alleged actual operations of FH - then this wasn't FBI. The FBI doesn't go on international darknet fishing expeditions - expeditions that are guaranteed to be exposed in the process - just for the hell of it. If they did it, they were going after scalps... and when they hunt scalps, they generally get them. The exposure of Torsploit, its analysis, and the panic it caused? All predictable - and all, therefore, intended. The FBI doesn't fit that model.
We understand that Kevin is convinced this is CIPAV... but calling this CIPAV is about as useful as calling PRISM "Carnivore." 'Nuff said. We've nothing but respect for Kevin's work... but this is the rare case in which we feel he's blinding himself to the larger picture in order to force a fit between his initial assumptions, and the data as they come visible.
It's still possible we're dead wrong on this, of course. If so, we'll send Kevin something cute. An FBI windbreaker, perhaps?
That said, we're seeing the pattern evolve as we predicted a month ago: too many loose ends, too many discongruent pieces, too many stories that don't quite fit up. That's our world, at Baneki: we're used to stuff that leads deeper down the rabbit hole. Kevin's done excellent reporting on the FBI for years - including of course Kingpin - so we can see how it seems to fit that pattern: when one holds a hammer, all the world appears to be a nail.But Torsploit isn't a nail to fit the FBI's hammer. It's something else entirely... what, nobody outside .gov yet knows for sure. In due course, we'll know - and we'll be that much more attuned to the real threat vectors people face out there on the interwebs post-Snowden.
Respectfully,
- Baneki Privacy Labs
.”
